Data Processing Addendum

1. Parties and Scope

This Data Processing Addendum ("DPA") is entered into between Cadivra Limited ("Processor", "we", "us") and you, the customer ("Controller", "you").

This DPA forms part of and is incorporated into the Cadivra Terms of Service. In the event of any conflict between this DPA and the Terms of Service on data processing matters, this DPA shall prevail.

This DPA applies to the processing of personal data that Cadivra carries out on your behalf in connection with the Platform, as described in Section 4 below.

2. Definitions

"Personal Data", "Data Subject", "Processing", "Controller", "Processor", and "Personal Data Breach" have the meanings given in the UK GDPR (as retained by the European Union (Withdrawal) Act 2018, and as amended by the Data Protection Act 2018) and, where applicable, the EU General Data Protection Regulation (EU 2016/679).

"Customer Data" means any personal data you upload, import, or otherwise provide to Cadivra in connection with the service, including contact names, email addresses, job titles, company names, engagement data (opens, clicks, replies), and any other information about third-party individuals. It also includes, where you connect a mailbox, the subject, headers and body text of replies and delivery notices that Cadivra retrieves from that mailbox on your instruction.

"Approved Sub-Processor" means a third-party processor engaged by Cadivra to process Customer Data in accordance with Section 7.

3. Roles of the Parties

3.1 You are the Data Controller in respect of Customer Data. You determine the purposes and means of processing (for example, conducting outreach campaigns to your contacts).

3.2 Cadivra is the Data Processor. We process Customer Data only on your documented instructions and solely for the purpose of providing the Platform.

3.3 Dual-role acknowledgement. Separately from its role as Processor for Customer Data, Cadivra acts as an independent Data Controller in respect of: account registration and administration data; billing and payment information; support and communications data; security, fraud prevention, and abuse detection data; aggregated and anonymised usage statistics; and any data processed to comply with Cadivra's own legal obligations. Cadivra's processing as a controller is described in its Privacy Policy and is not subject to this DPA.

3.4 Services you connect to Cadivra (such as your email provider - e.g. Microsoft 365, Google Workspace - and your CRM - e.g. HubSpot) are independent services selected and controlled by you. They are not Cadivra sub-processors under this DPA. Where you connect such a service, Cadivra reads from and writes to it on your instruction (for example, syncing contacts and writing back engagement, meeting, and outcome data). Your use of those services is subject to your own agreements with the relevant provider.

4. Details of Processing (Article 28(3))

• Subject matter: provision of the Cadivra email outreach platform
• Duration: the term of your subscription, plus any post-termination retention period set out in Section 10
• Nature and purpose: hosting, storing, displaying, and transmitting Customer Data to enable contact management, AI-assisted email content generation, email sending via your connected providers, and outreach performance analytics
• Categories of Data Subjects: your business contacts and prospects
• Types of Personal Data: contact names, email addresses, job titles, company names, engagement data (opens, clicks, replies), message content from a connected mailbox (reply subject, headers and body text, and delivery-failure notices), and any other data fields you upload

5. Controller Obligations

You warrant and represent that:

• You have a lawful basis under applicable data protection law (UK GDPR and, where applicable, EU GDPR) for processing the personal data you upload.
• You have complied with all applicable data protection laws in collecting the contact data you provide to us.
• Where personal data has been obtained from a source other than the data subject, you will provide the data subject with the required privacy information within a reasonable period and in any event before using the Platform to contact them, in accordance with Article 14 UK GDPR.
• You are responsible for honouring data subject rights requests (access, erasure, rectification, portability, etc.) in respect of Customer Data.
• Your use of Cadivra complies with the Privacy and Electronic Communications Regulations 2003 (PECR), the EU ePrivacy Directive, CAN-SPAM, CASL, and any other applicable electronic marketing or anti-spam legislation.
• You will not upload special category data (Article 9 UK GDPR) or criminal offence data (Article 10) to the Platform without our prior written agreement on additional safeguards.

6. Processor Obligations

Cadivra shall:

• Process Customer Data only on your documented instructions, unless required to do so by UK or EU law (in which case we will notify you before processing, unless the law prohibits this).
• Ensure that all personnel authorised to process Customer Data are bound by appropriate confidentiality obligations.
• Implement and maintain appropriate technical and organisational security measures to protect Customer Data, as described in Section 9.
• Notify you without undue delay, and in any event within 48 hours, upon becoming aware of a Personal Data Breach affecting Customer Data, providing sufficient information to enable you to meet your notification obligations under Articles 33 and 34 UK GDPR.
• Provide reasonable assistance with data subject rights requests, data protection impact assessments (DPIAs), and prior consultations with the ICO or other supervisory authority, as required under Articles 32 - 36 UK GDPR.
• At your choice, delete or return all Customer Data upon termination of the service (subject to Section 10), and delete existing copies unless retention is required by applicable law.
• Make available all information reasonably necessary to demonstrate compliance with this DPA and the obligations of Article 28 UK GDPR.

7. Sub-Processors

7.1 You grant general authorisation for Cadivra to engage sub-processors for the processing of Customer Data. The current list of sub-processors is set out below and is maintained at:

https://cadivra.com/sub-processors

7.2 We will notify you of any intended changes to sub-processors by updating the sub-processor list and sending email notification at least 14 days before the new sub-processor begins processing. You may object to a new sub-processor within 14 days of notification. If we cannot reasonably accommodate your objection, either party may terminate the affected service upon 30 days' written notice.

7.3 We impose data protection obligations equivalent to those set out in this DPA on each sub-processor by way of a written contract. Cadivra remains liable to you for the performance of each sub-processor's obligations in respect of Customer Data.

8. International Transfers

Customer Data is hosted within the European Union (Railway, Netherlands). Some sub-processors (such as Anthropic and Cloudflare) are based in or route data through the United States. The full, current list is at cadivra.com/sub-processors. Where Customer Data is transferred outside the UK or EEA to a country not covered by an adequacy decision, we ensure appropriate safeguards are in place, including:

• The UK International Data Transfer Agreement (IDTA);
• The UK Addendum to the EU Standard Contractual Clauses;
• The EU Standard Contractual Clauses (for EEA-origin data); or
• Other lawful transfer mechanisms as applicable.

Copies of the applicable transfer mechanism are available upon request.

9. Security Measures

We implement and maintain appropriate technical and organisational measures to protect Customer Data, including:

• Encryption of data in transit using TLS
• Encryption at rest of credentials for connected accounts, including OAuth access and refresh tokens, mailbox passwords and integration secrets, using authenticated symmetric encryption (AES-128 in CBC mode with HMAC-SHA256)
• Role-based access controls with least-privilege principles, and per-workspace isolation enforced on our servers
• Two-factor authentication available on all accounts and enforceable workspace-wide by owners on our higher plans
• Automated static analysis, secret scanning and database-migration safety checks on every change, with explicit human approval required before a production release
• Documented incident response and release rollback procedures
• Personnel bound by written confidentiality obligations

A fuller description of these measures, including the specific protections applied to content retrieved from a connected mailbox, is set out in section 7 of our Privacy Policy.

10. Data Retention and Deletion

• Customer Data is retained for as long as your account is active.
• Upon termination or written request, we will make Customer Data available for export for 30 days.
• After the 30-day export period, Customer Data will be deleted from our active systems within 30 days.
• Copies of Customer Data in our hosting provider's routine database backups are not individually editable. They are overwritten on that provider's rotation cycle, and are restored only to recover the service as a whole after a failure, never to reinstate an individual account.
• We may retain data where required by applicable law (e.g. billing records for HMRC compliance).

11. Audits

We will make available to you all information reasonably necessary to demonstrate compliance with this DPA. Upon at least 30 days' written notice, and no more than once per year (unless required by a supervisory authority), you or a qualified independent auditor may conduct an audit, subject to reasonable scope, timing, confidentiality obligations, and minimal disruption to our operations. Audit costs are borne by you unless the audit reveals a material breach by us.

12. Liability

The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms of Service.

13. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact

Cadivra Limited. Email: [email protected]

Email: [email protected]