Important. This page is a procurement-ready framework, not a signed DPA. A binding document requires the correct legal entities, dates, processing annex, security schedule, subprocessors, transfer modules and signatures.
1. Scope, hierarchy and roles
The DPA will apply where WorldsContact processes personal data on the customer’s behalf to deliver contracted services. The customer acts as controller or processor, and WorldsContact acts as processor or subprocessor as appropriate. The signed agreement and DPA define document priority.
2. Documented instructions
WorldsContact will process customer personal data only on documented instructions, including instructions inherent in the service configuration, unless law requires otherwise. If an instruction appears unlawful, WorldsContact may notify the customer and pause affected processing while the parties assess it.
3. Confidentiality and personnel
People authorised to process customer data will be subject to confidentiality obligations and access will be limited according to role and need. Customers are responsible for managing their own workspace users and permissions.
4. Security measures
The executed DPA will attach technical and organisational measures reflecting the deployed architecture. Expected topics include identity and access control, password protection, transport security, secret management, logging, vulnerability handling, availability, backups, incident response, personnel access and secure deletion. No certification will be claimed unless independently obtained and current.
5. Subprocessors
WorldsContact will maintain a current list of subprocessors, their function and processing location; impose data-protection obligations appropriate to the service; remain accountable as required by law; and provide the agreed notice of material additions or replacements. See the Subprocessor register.
6. International transfers
If protected data moves outside its originating jurisdiction, the parties will identify a lawful mechanism. For EEA transfers this may include adequacy or the applicable modules of the EU Standard Contractual Clauses; for UK data, the approved UK mechanism may also be required. Transfer assessments and supplementary measures will be addressed where applicable.
7. Data-subject requests
Taking into account the nature of processing, WorldsContact will provide reasonable assistance for customer responses to access, correction, deletion, restriction, objection, portability and related requests. If a request concerns customer-controlled data, we may direct the person to the relevant customer unless law prevents it.
8. Security incidents
After becoming aware of a confirmed personal-data breach affecting customer data, WorldsContact will notify the customer without undue delay as set out in the executed DPA. Notices will include available information about the nature, likely consequences and mitigation. Notification is not an admission of fault.
9. Compliance assistance
WorldsContact will provide reasonable information and assistance for security obligations, breach assessments, data-protection impact assessments and regulator consultations, considering the processing and information available to us.
10. Audits
The DPA will define a proportionate evidence-first audit process, frequency, confidentiality, advance notice, scope, cost allocation and safeguards for other customers. On-site audits will generally be reserved for material unmet legal or contractual needs.
11. Return and deletion
At the customer’s choice and subject to law, WorldsContact will delete or return customer personal data after service termination according to the agreed export window and backup lifecycle. Limited records may be retained where required for security, dispute resolution, suppression or statutory obligations.
12. Annex A — Processing description
Contact discovery, verification, domain analysis, prospecting, campaign and support services selected by the customer.
Term of the service plus agreed deletion, backup and legal-retention periods.
Customer users, business contacts, prospects, subscribers and correspondents designated by the customer.
Professional identity, business contact, company, campaign, preference, suppression, engagement and technical data.
Continuous or on-demand according to customer use.
Deliver, secure, support and improve the contracted service under documented instructions.
13. Annex B — Restricted data
Unless expressly agreed, the service is not intended for special-category data, precise financial account data, payment-card data, government identifiers, authentication secrets, health records, children’s data or criminal-conviction data. Customers must not upload these categories.
14. Contracting
To request an executable DPA, provide the parties’ legal names, roles, regions, relevant modules, data categories, expected volume, service configuration and security contact.
Request DPA review →