Data Processing Agreement

For the contact and organization records you manage, search, and export in Clapleads Atlas, you are the data controller and we act as your data processor. You decide what data to collect and how to use it; we process it on your behalf under your instructions, as described in our Terms of Use.

For account data (your name, email, billing details), we act as the controller — see the Privacy Policy for that relationship.

We use a small number of third parties to run the platform. Each only sees the data it needs to do its job.

This is the complete list — we do not use undisclosed sub-processors.

If we add or replace a sub-processor, we will update the table above and change the "Last updated" date on this page. For a material change — a new sub-processor that will handle your data — we will also post it on our release notes and, once we support it, an email notice, before the change takes effect.

Where a sub-processor is located outside your region and that transfer requires a legal safeguard, we rely on that provider's Standard Contractual Clauses (SCCs) as the transfer mechanism — the same mechanism used across the industry for cross-border processing. We do not maintain a separate, platform-specific SCC addendum today; if you need one executed directly with us for your organization, contact support.

The technical and organizational measures that protect data processed on your behalf are described in full on the Security page — including account protection, encryption in transit, suppression-list enforcement on every export, and audit logging. We do not currently hold SOC 2, ISO 27001, or similar third-party certifications.

If we become aware of a security incident that compromises the confidentiality, integrity, or availability of data you have entrusted to us, we will notify you without undue delay after becoming aware of it, with what we know at the time: the nature of the incident, the data categories likely affected, and the steps we are taking. We will follow up as our investigation progresses.

You can export your data at any time while your account is active. If you close your account, we delete or anonymize your account data within a reasonable period, consistent with our Privacy Policy and any retention we are legally required to keep (for example, billing records).