Legal · v1.1

Data Processing Agreement

GTM Intelligence Ltd · Registered in England & Wales · Company no. 16414756

Effective date: 1 October 2025 · Revision date: 21 December 2025

Parties Controller: The Client named in the Order Form (“Controller”). Processor: GTM Intelligence Ltd, 61 Standen Road, London SW18 5TH, United Kingdom (“GTM” or “Processor”).

1. Subject-matter and Duration

1.1 Subject-matter

GTM will process personal data uploaded, transmitted, or otherwise made accessible by the Controller in connection with the Services (the “User Data”) for the purpose of providing the Services, including go-to-market enrichment, analytics, background processing/agents, and any enabled integrations.

1.2 Duration

Processing will continue for the Subscription Term and for up to thirty (30) days thereafter to support orderly export/return, deletion, and account closure, unless applicable law requires longer retention of specific data.

1.3 Credentials and tokens

Where the Controller enables integrations by authorising OAuth/API access, credentials/tokens will be stored securely and will be revoked, disabled, or deleted within a reasonable time and where technically feasible upon termination of the relevant integration, termination of the Agreement, or Controller request, subject to the technical capabilities and constraints of the integration provider.

2. Nature and Purpose of Processing

2.1 Processing activities

Processing activities may include: hosting and storage; access control and authentication; tenant routing and configuration; transformation and deduplication; enrichment (for example firmographic append and classification); analytics, dashboards and reporting; background processing/agents; and read-only synchronisation from Controller-authorised integrations limited to the objects and scopes configured by the Controller.

2.2 No automated decision-making

The Services are not intended to perform automated decision-making or profiling that produces legal effects concerning a data subject or similarly significantly affects a data subject.

3. Categories of Data and Data Subjects

3.1 Data subjects

Employees, contractors, or representatives of the Controller’s prospects, leads, customers, partners, and other business contacts; and the Controller’s authorised Users and administrators.

3.2 Personal data categories

Name, job title, employer, business email/phone, business social URL, CRM/object fields the Controller selects for sync or upload, notes and tags, and related activity/usage metadata generated within the Services.

3.3 Special categories

The Parties do not intend for the Services to process special category data (UK GDPR/EU GDPR Art 9) or data relating to criminal convictions and offences. The Controller shall not upload, provide, or authorise processing of such data unless explicitly agreed in writing and supported by appropriate safeguards.

4. Processor Obligations (UK GDPR/EU GDPR Art 28)

4.1 Instructions

GTM shall process User Data only on the documented instructions of the Controller, including as necessary to provide the Services under the Agreement and to comply with applicable law. If GTM believes an instruction infringes applicable data protection law, GTM will inform the Controller (unless prohibited by law).

4.2 Confidentiality

GTM shall ensure persons authorised to process User Data are bound by confidentiality obligations and receive data protection training appropriate to their roles.

4.3 Security

GTM shall implement and maintain appropriate technical and organisational measures (“TOMs”) designed to protect User Data as described in Annex II.

4.4 Integrations and tokens

Where the Controller enables an integration (for example Salesforce, HubSpot or other systems) by approving OAuth/API access, GTM will:

  • (a) store credentials/tokens encrypted;
  • (b) request least-privilege scopes where supported;
  • (c) use them only to read/sync the objects and fields configured by the Controller; and
  • (d) not write to the Controller’s systems unless explicitly enabled by the Controller.

4.5 Sub-processors

GTM may engage sub-processors to process User Data only in accordance with Section 4.6 and Annex III. GTM will impose equivalent data protection obligations on sub-processors by contract.

4.6 Sub-processor changes and objections

GTM will provide advance notice of any material addition or replacement of sub-processors where practicable. Where advance notice is not practicable (for example, urgent security changes, outage prevention, or legal requirements), GTM will notify the Controller as soon as reasonably practicable after the change.

The Controller may object on reasonable, documented data protection grounds within the notice period (or, for urgent changes, within a reasonable period after notice). The Parties will work in good faith to address the objection. If the objection cannot be resolved, either Party may terminate the affected Services in accordance with Annex III (Change process).

4.7 Assistance

Taking into account the nature of processing and the information available to GTM, GTM shall provide reasonable assistance to the Controller to:

  • (a) respond to data subject requests; and
  • (b) conduct DPIAs and consult with regulators where required (UK GDPR/EU GDPR Arts 28–36).

Where the Controller’s requests require material effort beyond the Services’ standard functionality, GTM may charge reasonable fees at its standard rates, agreed in advance.

4.8 Breach notification

GTM shall notify the Controller without undue delay after becoming aware of a personal data breach affecting User Data and will provide information as it becomes available to support the Controller’s notification obligations.

4.9 Deletion or return (Controller choice)

Upon termination or expiry of the Agreement, at the Controller’s choice, GTM shall:

  • (a) Return: make User Data available for export in a common format (return/export); or
  • (b) Delete: delete User Data from active systems.

If the Controller requests an export, GTM will make the export available and will delete User Data from active systems within thirty (30) days after the export is made available, unless retention is required by applicable law. If no export is requested, GTM will delete User Data from active systems within thirty (30) days after termination/expiry, unless retention is required by applicable law.

Backup copies are retained and overwritten on a rolling basis in accordance with GTM’s backup and disaster recovery processes and are not ordinarily accessed except for restoration, resilience testing, security investigation, or legal/compliance purposes.

5. International Transfers

5.1 Transfer safeguards

Where User Data is transferred outside the UK/EU/EEA, the Parties shall ensure appropriate safeguards are in place, including (as applicable):

  • (a) EU Standard Contractual Clauses (EU 2021/914), Module 2 (Controller to Processor) and Module 3 where applicable; and
  • (b) the UK International Data Transfer Addendum and/or UK IDTA (as applicable).

5.2 Supplementary measures

Supplementary measures (such as encryption and data minimisation) will be applied where appropriate. Where required, information on transfer safeguards and supporting assessments will be made available on request.

6. Liability

Each Party remains liable for its respective data protection obligations. GTM’s aggregate liability under this DPA is capped at the total fees paid under the Agreement in the twelve (12) months preceding the claim, except where a higher cap is required by law.

7. Governing Law and Jurisdiction

This DPA is governed by the laws of England and Wales. Disputes shall be resolved by the courts of London, UK.

Annex I – Details of Processing (UK GDPR/EU GDPR Arts 28 & 30)

A. Parties

Controller: Client named in Order Form. Processor: GTM Intelligence Ltd.

B. Processing operations

  • Hosting and storage of User Data within tenant environments.
  • Authentication, access control, audit logging, and tenant configuration/routing.
  • Transformation, deduplication, enrichment and classification of records.
  • Analytics, dashboards, and reporting for authorised Users.
  • Background processing/agents to perform long-running tasks initiated by authorised Users or configured workflows.
  • Read-only sync from Controller-authorised integrations limited to scopes, objects, and fields configured by Controller.
  • Secure export/return and deletion of User Data on termination.

C. Purpose

Provide go-to-market insights and functionality to Controller’s authorised Users, including enrichment and analytics.

D. Retention

Live processing during Subscription Term. On termination/expiry, User Data is returned (export made available) or deleted in accordance with Section 4.9, subject to applicable law.

E. Locations of services (high-level)

The Services are delivered using third-party cloud providers. Components may include:

  • Frontend/edge delivery and security: Cloudflare (global edge).
  • Application runtime and background processing: Google Cloud Run (services) and Google Cloud Run Jobs (region(s) configured by GTM).
  • Database/auth/storage (system of record): Supabase (tenant region configured by GTM; UK default; EU/US optional by agreement).

The Controller acknowledges that limited operational and security-related data (such as billing contacts, support communications, and security logs/telemetry) may be processed in other locations to operate and secure the Services, subject to appropriate safeguards.

Annex II – Technical and Organisational Measures (UK GDPR/EU GDPR Art 32)

1. Encryption

  • TLS 1.2+ in transit.
  • Encryption at rest (provider-managed). Where available on eligible tiers, additional key management options may be supported.

2. Access control

  • Role-based access (least privilege) for internal access.
  • Multi-factor authentication enforced for staff/admin access.
  • Periodic access reviews and prompt removal of access on role change/termination.

3. Application and data controls

  • Logical segregation of tenants and access controls designed to prevent cross-tenant access.
  • Where applicable, database policies (for example row-level security) to enforce access restrictions.
  • Secrets managed using secure secret storage; no credentials in source control.

4. Change control and SDLC

  • Version-controlled deployments, peer review where practicable for production changes, and environment separation where practicable.

5. Availability and resilience

  • Regular backups and recovery procedures appropriate to the Services.
  • Backup retention and overwrite on a rolling basis.
  • Monitoring and alerting for service reliability and security events.

6. Incident response

  • Processes to detect, investigate, contain, remediate, and document security incidents.
  • Breach notification to Controller without undue delay after awareness (Section 4.8).

7. Vendor management

  • Maintain an up-to-date record of sub-processors authorised to process User Data.
  • Where available, review independent assurance reports (for example SOC 2 or ISO 27001) or equivalent attestations for key providers.

8. Data minimisation

  • Process only the data necessary to provide the Services.
  • Special category data is not intended to be processed unless explicitly agreed with safeguards.

9. Integrations and tokens

  • OAuth/refresh tokens stored encrypted.
  • Scopes limited to those approved/configured by Controller.
  • Tokens revoked/disabled/deleted within a reasonable time and where technically feasible on termination or Controller request, subject to third-party constraints.

10.Audit and compliance information

  • GTM will make available to the Controller reasonable information necessary to demonstrate compliance with this DPA, taking into account the nature of the Services and information available to GTM.
  • The Controller (or an auditor mandated by the Controller) may conduct audits/inspections relating to User Data processing on reasonable notice and during normal business hours, provided the audit is:
  • (a) limited to information and systems relevant to the Services;
  • (b) subject to appropriate confidentiality undertakings;
  • (c) conducted in a manner that avoids unreasonable disruption to GTM operations; and
  • (d) subject to measures necessary to protect security and third-party confidential information.
  • Where appropriate, GTM may satisfy audit requests by providing responses to security questionnaires and/or desk review of available third-party assurance reports.
  • The Controller bears its own audit costs and will reimburse GTM’s reasonable costs of assistance for audits that require material effort beyond standard support, agreed in advance.

Annex III – Authorised Sub-processors

GTM may engage the following sub-processors to process User Data in connection with the Services.

A. Core sub-processors

Supabase

  • Service: Database, Authentication, Storage (system of record)
  • Locations: UK by default; EU/US where configured per tenant
  • Safeguards: Provider DPA; EU SCCs + UK IDTA/UK Addendum (as applicable) or equivalent lawful mechanism

Google Cloud

  • Service: Application runtime (Cloud Run services) and background processing (Cloud Run Jobs), related cloud infrastructure
  • Locations: As configured by GTM (typically aligned to tenant/service region)
  • Safeguards: Provider DPA; EU SCCs + UK IDTA/UK Addendum (as applicable) or equivalent lawful mechanism

Cloudflare

  • Service: Frontend hosting/delivery, DNS/TLS, edge security and performance
  • Locations: Global edge network
  • Safeguards: Provider DPA; EU SCCs + UK IDTA/UK Addendum (as applicable) or equivalent lawful mechanism

Google Workspace

  • Service: Business email and support communications
  • Locations: As configured by GTM
  • Safeguards: Provider terms/DPA; EU SCCs + UK IDTA/UK Addendum (as applicable) or equivalent lawful mechanism

B. Optional / feature-dependent sub-processors (used only if enabled)

OpenAI

  • Service: AI-assisted features (for example summarisation/enrichment)
  • Locations: Determined by provider and configuration
  • Safeguards: Provider terms/DPA where applicable; EU SCCs + UK IDTA/UK Addendum (as applicable) or equivalent lawful mechanism; data minimisation and access controls

Anthropic (Claude)

  • Service: AI-assisted features, and the NEO GTM connector for Claude, which allows an authorised User to query their own tenant’s data from Claude. The tenant served by a connector token is resolved per request and cannot be changed by a prompt.
  • Locations: Determined by provider and configuration
  • Safeguards: Provider terms/DPA where applicable; EU SCCs + UK IDTA/UK Addendum (as applicable) or equivalent lawful mechanism; data minimisation and access controls

Workflow orchestration provider (if used)

  • Service: Workflow automation/orchestration
  • Locations: As configured
  • Safeguards: Provider DPA; EU SCCs + UK IDTA/UK Addendum (as applicable) or equivalent lawful mechanism

Development partner (if used)

  • Service: Development services (no production hosting)
  • Locations: Remote
  • Safeguards: NDA and contractual confidentiality; access controls; limited and supervised access where needed

Change process

GTM will provide advance notice of material sub-processor changes where practicable. Where advance notice is not practicable, GTM will notify the Controller as soon as reasonably practicable. The Controller may object on reasonable, documented data protection grounds within the notice period (or, for urgent changes, within a reasonable period after notice). If the Parties cannot agree on mitigation within a reasonable period, either Party may terminate the affected Services by written notice.