Data Processing Agreement

Version 2026-09-13 · MayeLeads Ltd

This Data Processing Agreement ("DPA") forms part of the Terms of Service between MayeLeads Ltd ("Processor", "we") and the customer organisation using ProspectRadar ("Controller", "you"). It is entered into under Article 28 of the UK GDPR and applies whenever we process personal data on your behalf.

Where this DPA conflicts with the Terms of Service, this DPA prevails in respect of the processing of personal data.

1. Roles of the parties

You are the controller of the personal data you place into, or generate through, ProspectRadar. You decide which employers to research, which individuals to contact, what to say to them, and on what lawful basis. We are your processor and act only on your documented instructions.

Your use of the Service, including the settings you choose, constitutes your documented instructions. We will tell you if, in our opinion, an instruction infringes UK GDPR.

We are an independent controller for a narrow, separate set of data: your own account and billing records, and service security logs. That processing is described in the Privacy Notice, not here.

2. Subject matter, duration, nature and purpose

Subject matter	Business development from public job advertisements. For a recruitment business: identifying employers with open vacancies, identifying a relevant hiring contact, sending outreach, and recording responses. For a business selling products or services: identifying companies whose advertisements indicate work the product or service addresses, identifying a relevant decision-maker, sending outreach, and recording responses. Each workspace operates as one or the other, never both.
Duration	For as long as you hold an active workspace, plus the retention period in section 9.
Nature	Collection from public and licensed sources, enrichment, storage, organisation, automated analysis, transmission by email, and erasure.
Purpose	Solely to provide the Service to you. We do not use your data to market to your prospects, to build a shared contact database, or to train AI models.

3. Categories of data subject and personal data

Data subjects

• Hiring managers, HR staff and other employees of prospective client companies.
• For a recruitment business that switches on the candidates module: job seekers on your own book, whose details you obtained from them directly (an uploaded CV, a registration, a conversation) and hold with their consent.
• Your own staff who hold ProspectRadar accounts.

Personal data

• Business contact details: name, job title, employer, work email address, work telephone number, public professional profile URL.
• Candidate details, where the candidates module is used: name, personal email address and telephone number, current or target role, location and postcode, salary expectation, notes you record, the record of their consent, and the text of a CV they provided. CV text is read by fixed rules to fill those fields and is never sent to an AI provider.
• Correspondence: the outreach emails you send and the replies you receive, including their full content.
• Interaction records: send, delivery, bounce, open where applicable, reply classification, call outcomes and notes entered by your staff.
• Suppression records: an email address or domain recorded as having objected to contact, retained precisely so contact does not recur.

No special category data is required by the Service. Article 9 data, criminal offence data and children's data are outside the scope of these instructions. If you place such data into free-text fields you do so as controller and outside our agreed instructions.

4. Our obligations

1. We process personal data only on your documented instructions, including for international transfers, unless required by law - in which case we will inform you first, unless that law prohibits it.
2. We ensure that anyone authorised to process the data is subject to a duty of confidentiality.
3. We implement the technical and organisational measures in section 7.
4. We engage sub-processors only under section 6.
5. We assist you, by appropriate technical and organisational measures and insofar as possible, in responding to data subject rights requests (section 8).
6. We assist you with your obligations under Articles 32 to 36 - security, breach notification, impact assessments and prior consultation - taking into account the nature of processing and the information available to us.
7. At your choice, we delete or return the personal data at the end of the Service, and delete existing copies unless law requires storage (section 9).
8. We make available the information necessary to demonstrate compliance with Article 28 and allow for audits under section 10.

5. Your obligations

You warrant that:

• You have a lawful basis for each instance of processing you direct, and have identified it. For unsolicited business-to-business email in the UK this is ordinarily legitimate interests under Article 6(1)(f), supported by a legitimate interests assessment you have carried out and recorded. For email to a candidate it is their consent, which you record against their candidate record before any email can be sent, and which they may withdraw through the opt-out link in every message.
• You comply with the Privacy and Electronic Communications Regulations 2003 ("PECR") in respect of every electronic message sent through the Service, including the requirement that the sender is identified and that a means to opt out is provided in every message.
• You will honour every objection promptly. The Service records objections automatically and blocks future sending to that address or domain across your whole workspace; you must not circumvent this.
• You provide the transparency information required by Articles 13 and 14 to the individuals you contact. Because you obtain their details indirectly, Article 14 applies and ordinarily requires notice at the latest within one month or at first communication.
• Your instructions do not require us to breach UK GDPR or PECR.

6. Sub-processors

You give general written authorisation for us to engage the sub-processors listed below. We will give you at least 30 days' notice before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve your objection you may terminate the affected part of the Service without penalty.

We impose on each sub-processor the same data protection obligations as are set out in this DPA, and we remain fully liable to you for their performance.

6.1 Sub-processors that may receive personal data

Sub-processor	Purpose	Data received	Location
Anthropic	Analysing vacancy text, drafting outreach, classifying replies	Vacancy descriptions, contact name and title, reply content	US / EU
OpenAI	Same, when configured as the fallback AI provider	As above	US / EU
Google (Gmail API / Workspace)	Sending and receiving outreach, where you connect a Google mailbox	Full message content, sender and recipient addresses	Global
Your own SMTP/IMAP provider	Sending and receiving outreach, where you configure SMTP instead	Full message content, sender and recipient addresses	As determined by you
Hunter.io	Finding and verifying a work email address	Person name, employer name, employer domain	EU
Apollo.io	Finding a work email address, where enabled	Person name, employer name, employer domain	US
Serper (Google Search API)	Locating a company website and public professional profiles	Search queries containing person and employer names	US
Google Places API	Company identification and telephone lookup	Employer name and location	Global

AI providers and training. We send prompts to the AI providers above under their business/API terms, which provide that inputs and outputs are not used to train their models. We do not enable any setting that would permit such training. We do not send candidate CVs to AI providers.

6.2 Sources we read from

These services supply vacancy and company information to us; we do not send them personal data about your prospects, so they are not sub-processors of your data. They are listed for transparency: Adzuna, Reed, Companies House, postcodes.io, and the public job board APIs of Greenhouse, Lever, Workable and SmartRecruiters. Where you self-host, these calls originate from your own infrastructure.

Professional profiles. Where the Service identifies a likely decision-maker, it does so from public search-engine results (a name, a job title and a public profile link returned by the search API). The Service does not access, log in to, crawl or scrape LinkedIn or any other social network, and it never sends a message through them: any contact on such a network is composed and sent manually by a member of your staff, from their own account, using a message the Service merely drafts. Email addresses are derived from the employer's own domain and confirmed with its mail server, or supplied by the licensed providers above.

6.3 Hosting

Where we host the Service for you, the database and application run on infrastructure we control, and the hosting provider is a sub-processor. Where you run your own instance, you are the host and no hosting sub-processor applies.

7. Security measures

Taking into account the state of the art, the costs of implementation and the risks involved, we implement at least the following:

• Tenant isolation. Every customer's data is bound to a workspace and filtered at the data access layer, not merely in the user interface, so an application error cannot return another customer's records. Isolation is covered by an automated test suite that runs on every change.
• Credential encryption. API keys and mailbox tokens are encrypted at rest using AES-based symmetric encryption (Fernet) with a key derived from a deployment secret that is never stored in the database.
• Access control. Role-based access (owner, manager, member, read-only viewer) per workspace, and an optional private-desk mode restricting a recruiter to their own records.
• Transport security. HTTPS for the application; TLS for outbound mail and for every sub-processor API.
• Audit trail. Every material action against a lead is recorded with actor and timestamp.
• Deliverability and contact-quality controls. Email addresses are verified before use, invalid addresses are blocked, and a bounce-rate circuit breaker suspends sending automatically - reducing the volume of mail sent to incorrect individuals.
• Backups. Regular database backups with a defined retention period, held on the same device as the live data with owner-only file permissions. They are not separately encrypted: the device's own disk encryption (FileVault or BitLocker) is the control, and you are responsible for enabling it.
• Least data. For prospects, only business contact details necessary for professional outreach are collected; the Service does not seek home addresses, personal email addresses or special category data. For candidates, only what they provided themselves is held, and it is removed automatically twelve months after their consent unless renewed.

8. Data subject rights

The Service provides the means for you to meet requests directly and without our involvement:

• Objection and opt-out. Every outbound message contains a one-click opt-out link. Using it records a suppression entry that blocks all future contact to that address, and cancels any scheduled follow-ups. Your staff can also suppress an address manually.
• Access and portability. A lead's complete record, including all correspondence and its timeline, is visible in the interface and exportable.
• Rectification. Contact details can be corrected in place.
• Erasure. A lead and its associated contact can be deleted. Note that a suppression record is deliberately retained after erasure, holding only the email address or domain and the fact of objection, so that contact does not resume. This is ordinarily necessary for compliance with PECR and Article 21(3).

If a data subject contacts us directly about data we process on your behalf, we will not respond substantively but will forward the request to you without undue delay.

9. Retention, return and deletion

• Personal data is retained for as long as your workspace is active. Candidate records are retained for twelve months from the date of consent, after which the personal details are removed automatically unless consent is renewed; a candidate can be erased by an owner or manager at any time.
• On termination you may export your data. We delete it, and copies in backups, within 90 days of termination, except where law requires longer.
• Suppression records are retained after deletion of the underlying lead, for the reason in section 8.
• Where you run your own instance, retention is entirely within your control.

10. Audit

We will make available information reasonably necessary to demonstrate compliance with Article 28, and will contribute to audits or inspections conducted by you or an auditor you mandate. Audits shall be at your cost, on at least 30 days' written notice, no more than once in any 12-month period unless a personal data breach has occurred or a supervisory authority requires otherwise, and subject to confidentiality.

11. Personal data breaches

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, and will provide the information you need for your own notification obligations under Articles 33 and 34, including the nature of the breach, categories and approximate numbers affected, likely consequences and the measures taken. We will not notify a supervisory authority or data subjects on your behalf unless you instruct us to.

12. International transfers

Some sub-processors in section 6 are located outside the UK. Where personal data is transferred outside the UK, the transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or under adequacy regulations where they apply, together with any supplementary measures required by a transfer risk assessment.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits either party's liability to a data subject or a supervisory authority, or excludes liability that cannot lawfully be excluded.

14. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.