Data Processing Agreement

Effective: 30 October 2026

Parties and scope

This Data Processing Agreement ("DPA") is concluded between the customer who uses Cold Leads ("Customer", controller) and Anton Tkachenko, ID (IČO) 17587557 ("Processor"), and forms part of the Terms of Service. It applies to personal data that the Customer stores or processes in Cold Leads about its own contacts, leads and correspondents ("Customer Personal Data"). It is accepted together with the Terms; no signature is required. Account data of the Customer's users is governed by the Privacy Policy, where the Processor acts as a controller.

Processing on instructions

The Processor processes Customer Personal Data only to provide the Service and only on the Customer's documented instructions — the Terms, this DPA, the Customer's settings and the actions the Customer takes in the Service (for example importing contacts or launching a campaign) — unless EU or Member State law requires otherwise, in which case the Processor informs the Customer before processing unless the law prohibits it. The Processor informs the Customer if, in its opinion, an instruction infringes data-protection law.

Confidentiality

Customer Personal Data is confidential. The Processor's staff do not access it except when the Customer asks for support and allows access, to investigate abuse flagged by the automated content check or reported to the Processor, or when the law requires it, and each access is limited to what the case needs. Every person authorised to process Customer Personal Data is bound by confidentiality. The Processor does not sell Customer Personal Data, does not use it for advertising and does not use it to train AI models.

Security measures (Art. 32 GDPR)

The Processor maintains appropriate technical and organisational measures, including: HTTPS with HSTS for all traffic; encrypted connections to the database; separation of data by account, with every request checked against the account; access only for the Customer's invited members with roles; login passwords held only as salted hashes by the authentication provider; mailbox passwords and access tokens encrypted with AES-256-GCM using a key kept outside the database; secret API keys and app tokens stored only as hashes; card data handled only by the payment provider; masking of all in-app content in session replays; rate limits and an automated content check against abuse.

Subprocessors

The Customer gives general authorisation to engage the subprocessors listed in the Privacy Policy (coldleads.app/privacy). The Processor imposes on each subprocessor data-protection obligations equivalent to this DPA and remains responsible for them. The Processor announces any new subprocessor by updating that list and, for subprocessors that receive Customer Personal Data, by e-mail to the account owner at least 14 days in advance; the Customer may object on reasonable grounds and, if no solution is found, terminate the Service with a refund of prepaid fees for the unused period.

International transfers

Where a subprocessor processes Customer Personal Data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the subprocessor is certified) or the European Commission's Standard Contractual Clauses offered by that subprocessor.

Assistance and data-subject rights

The Service lets the Customer access, correct, export and delete Customer Personal Data and record opt-outs. The Processor assists the Customer, taking into account the nature of processing, with requests from data subjects and with the obligations under Articles 32–36 GDPR. Requests the Processor receives directly from the Customer's contacts are forwarded to the Customer or handled through the do-not-contact list (coldleads.app/remove-my-email).

Personal-data breaches

The Processor notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal-data breach affecting Customer Personal Data, with the information available about its nature, likely consequences and the measures taken, and supplements it as more becomes known.

Deletion and return

The Customer can export Customer Personal Data at any time in Settings → Your data. When the Customer deletes contacts or the account, the data is erased from the live database; copies in the hosting provider's backups are overwritten when those backups expire on the provider's schedule. The Processor keeps no copy except where the law requires retention.

Audits

The Processor makes available the information necessary to demonstrate compliance with this DPA and answers the Customer's reasonable questions in writing. Where this is not sufficient, the Customer or an auditor bound by confidentiality may audit compliance once a year with 30 days' notice, at the Customer's cost and without access to other customers' data.

Details of processing (Annex)

Subject matter and purpose: providing the Cold Leads CRM and e-mail service. Duration: for the term of the Customer's account and until deletion as described above. Nature: storage, organisation, verification of e-mail addresses, sending and receiving e-mail, AI-assisted drafting on request. Data subjects: the Customer's contacts, leads, clients and correspondents. Categories of data: names, e-mail addresses, phone numbers, company and role, social-profile links, tags, notes, e-mail messages and interaction history. Special categories: none are intended; the Customer should not store them.

Liability and precedence

Liability is governed by the Terms of Service. If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA prevails. Contact for data-protection matters: support@coldleads.app.

Security & privacy · Terms of Service · Privacy Policy