Data Processing Agreement

Prospectrum is operated by Brand Armor AI V.O.F., registered in the Netherlands, company registration number 99567814, VAT number NL869042981B01. acting as processor. You, the customer, are the controller for the personal data contained in the leads and outreach you process through Prospectrum, as set out in our Privacy Policy and Terms of Service.

Reach us at admin@prospectrum.app.

The subject matter is the processing of personal data contained in the business leads you discover, score, and contact through Prospectrum, and the replies you receive. Processing lasts for as long as your account is open, and ends when your account is closed and the retention periods in our Privacy Policy §7 have run out.

We process this data to run the service on your instruction: discovering matching businesses, scoring them, drafting and sending outreach, and routing replies back to you.

• Categories of data subjects: contacts at the businesses you target (owners, staff, or general business mailboxes).
• Categories of data: business name, address, phone, website, publicly listed email, and the content of outreach and replies.

We process personal data only on your documented instructions, given by configuring a campaign, approving a lead, or sending outreach through the product, unless the law requires otherwise, in which case we will tell you before processing unless that notice is itself prohibited.

Anyone we let process this data is bound by confidentiality, whether by contract or professional duty.

We apply appropriate technical and organisational measures under GDPR Article 32, matching what our Privacy Policy §9 describes: encrypted transport, encryption at rest via our infrastructure providers, encrypted storage of sending credentials, and restricted, authenticated access to production data.

We use the sub-processors listed at prospectrum.app/subprocessors, each bound by data protection terms at least as protective as this DPA. We will give account owners at least 30 days' notice by email before adding a new sub-processor, so you have a chance to object.

We will help you respond to a data subject request (access, correction, deletion, objection, or portability) concerning the lead or outreach data we process for you, and help you meet your obligations under GDPR Articles 32 to 36, including notifying you without undue delay if we become aware of a personal data breach affecting your data.

When your account is closed, your lead and outreach data is deleted within 90 days, as described in our Privacy Policy §7. You can also close your account and delete this data at any time from your account page; suppression records (bounces and unsubscribes) are the one exception, kept indefinitely so we never contact someone who asked us not to.

On reasonable written notice, we will provide the information necessary to demonstrate compliance with this DPA, and allow for an audit, including inspections, conducted by you or an auditor you appoint, at your cost and no more than once a year unless a regulator or a security incident requires otherwise.

Where a sub-processor is located outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses (Module 2, controller to processor, adapted as Module 3, processor to sub-processor, where applicable) or an adequacy decision, together with that sub-processor's own data processing terms. Those clauses are incorporated into this DPA by reference for each affected sub-processor.

Questions about this DPA go to admin@prospectrum.app, or use the contact form.