Data Processing Agreement

Interpretation. Terms defined in the GDPR, including "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority", have the meaning given to them in the GDPR. Capitalised terms that are not defined in this DPA, including "Agreement", "Service", "Workspace", "User", "Paid Plan", "Subscription Term" and "Output", have the meaning given to them in the Terms of Service.

Definitions. In this DPA:

1. (a)
   "Customer Personal Data" means the personal data that ManyPI processes on behalf of the Customer in providing the Service, as further described in clause 1.3 and Annex I;
2. (b)
   "Data Protection Law" means the GDPR, the German Federal Data Protection Act (BDSG) and, to the extent they apply to the processing, the UK GDPR, the UK Data Protection Act 2018 and the Swiss Federal Act on Data Protection of 25 September 2020 (the "FADP");
3. (c)
   "EEA" means the European Economic Area, and "third country" means a country outside the EEA;
4. (d)
   "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021;
5. (e)
   "Sub-processor" means a processor engaged by ManyPI to carry out specific processing activities on Customer Personal Data; and
6. (f)
   "Sub-processor List" means the list of Sub-processors published at https://manypi.com/legal/sub-processors, which is the current version of Annex III.

Customer Personal Data. Customer Personal Data comprises in particular:

1. (a)
   contact and lead records that the Customer uploads, imports or creates, or instructs the Service to research and collect;
2. (b)
   CRM records, including companies, deals, tasks, notes and activity history;
3. (c)
   mail data, namely the content and metadata of messages sent through the Service and, where the Customer connects a mailbox, the message headers and message bodies synchronised from that mailbox;
4. (d)
   outreach records, including campaign membership, delivery status, replies, unsubscribes and suppression entries;
5. (e)
   files and datasets that the Customer uploads for analysis; and
6. (f)
   the results of web research that the Customer instructs the Service to perform.

The Customer as controller. Subject to clause 1.5, the Customer is the controller of Customer Personal Data. The Customer decides which individuals to research, which contacts to import, which mailbox to connect, what to communicate and on which legal basis. ManyPI processes Customer Personal Data only for the purposes the Customer determines.

Customer acting as processor. Where the Customer processes Customer Personal Data as a processor on behalf of a third party, for example as an agency using the Service for its own clients, the Customer warrants that its instructions to ManyPI, including the engagement of ManyPI and of the Sub-processors, are authorised by that third party. ManyPI then acts as a further processor engaged by the Customer, and this DPA applies accordingly. The Customer is ManyPI's sole point of contact and shall pass on to the third party any notification or information that ManyPI provides under this DPA.

ManyPI as processor. ManyPI processes Customer Personal Data as the Customer's processor or, where clause 1.5 applies, as a further processor.

ManyPI as independent controller. ManyPI is an independent controller, and not the Customer's processor, for the processing it determines itself, namely:

1. (a)
   the registration and administration of accounts, and billing;
2. (b)
   the security of the Service, the prevention of abuse and service telemetry;
3. (c)
   its own product analytics, including PostHog browser analytics with consent and separate server-side operational telemetry;
4. (d)
   support correspondence; and
5. (e)
   the operational caches described in §13.

Separation of roles. The processing listed in clause 1.7 is governed by the Privacy Policy, not by this DPA. Except as described in §13, ManyPI does not use Customer Personal Data for any of those purposes. Where Customer Personal Data is incidentally present in diagnostics or security records necessary to provide or protect the Service, or where ManyPI must access Customer Personal Data to investigate a suspected breach of the Acceptable Use Policy, that processing remains subject to this DPA, including its rules on purpose limitation, minimisation, Sub-processors and deletion.

Subject matter. The subject matter of this DPA is the processing of Customer Personal Data by ManyPI on behalf of the Customer in providing the Service under the Agreement.

Duration. The processing continues for the term of the Agreement and thereafter until ManyPI has returned or deleted Customer Personal Data in accordance with §9.

Nature of the processing. The processing comprises collection, recording, organisation, structuring, storage, retrieval, consultation, enrichment, analysis (including analysis by artificial intelligence), use, transmission, restriction, erasure and destruction.

Purpose of the processing. ManyPI processes Customer Personal Data for the sole purpose of providing the Service to the Customer, namely its lead research, CRM, outreach, mailbox synchronisation, workflow automation, data extraction, analysis and AI-assisted functions, and the hosting, security, backup and support necessary to provide them.

Data and data subjects. The types of personal data and the categories of data subjects are set out in Annex I.

Frequency and location. The processing is continuous. The locations of processing are set out in §11 and Annex III.

Documented instructions. ManyPI shall process Customer Personal Data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which ManyPI is subject. In that case ManyPI shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

What constitutes an instruction. The Customer's instructions are given by:

1. (a)
   this DPA and the Terms of Service;
2. (b)
   the Customer's configuration and use of the Service through its user interface, its API or its MCP server, including through an AI client that the Customer connects to it, for example which contacts to import, which research to run, which mailbox to connect, which campaigns to send and which automations to enable;
3. (c)
   the standing instruction in clause 7.4; and
4. (d)
   any further instruction that the Customer gives in text form to legal@manypi.com.

Users and form of instructions. Instructions given through the Service by Users of the Customer's Workspace are instructions of the Customer. The Customer shall confirm in text form, without undue delay, any instruction it gives orally.

Infringing instructions. ManyPI shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. ManyPI may suspend the execution of the instruction concerned until the Customer confirms or amends it.

Instructions that cannot be followed. ManyPI shall inform the Customer without undue delay if it is unable to follow an instruction, in particular because the instruction requires processing that the Service does not support. ManyPI is not obliged to extend the functions of the Service in order to follow an instruction.

Purpose limitation. ManyPI shall not:

1. (a)
   process Customer Personal Data for any purpose other than providing the Service in accordance with the Customer's instructions;
2. (b)
   sell Customer Personal Data or use it for its own marketing;
3. (c)
   disclose Customer Personal Data to third parties, except as provided in this DPA or required by Union or Member State law;
4. (d)
   combine Customer Personal Data with personal data that it processes on behalf of other customers or as controller, except as described in §13; or
5. (e)
   use Customer Personal Data to train, fine-tune or improve artificial-intelligence models, as provided in §12.

Requests from public authorities. If ManyPI receives a legally binding request from a public authority for the disclosure of Customer Personal Data, ManyPI shall:

1. (a)
   notify the Customer without undue delay, unless the law prohibits such notification;
2. (b)
   challenge the request where, after careful assessment, it concludes that there are reasonable grounds to consider the request unlawful; and
3. (c)
   disclose only the minimum Customer Personal Data that it is lawfully required to disclose.

Confidentiality of personnel. ManyPI shall ensure that every person authorised to process Customer Personal Data has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality, and that the obligation continues after the end of that person's engagement.

Authorised personnel. ManyPI is a sole proprietorship. Access to production systems and to Customer Personal Data is limited to the owner and individually authorised personnel (employees or contractors) bound by written confidentiality obligations, and in each case to the extent necessary for that person's tasks.

Processing on instructions. ManyPI shall ensure that every person acting under its authority who has access to Customer Personal Data processes it only on the Customer's instructions, unless required to do so by Union or Member State law, and is informed of the data protection requirements relevant to that person's tasks.

Administrative access. ManyPI maintains an internal administration interface that can display aggregated records and, in defined circumstances, individual Workspace records. ManyPI uses it only to provide support, to administer accounts and billing, to maintain the security of the Service and to investigate suspected breaches of the Acceptable Use Policy. Access to the interface:

1. (a)
   is restricted by an identifier held in the runtime environment rather than in the application database;
2. (b)
   is logged with actor, path, IP address, user agent and timestamp; and
3. (c)
   requires, for every write operation, a one-time code delivered through a separate channel.

Access logs. On request, ManyPI shall provide the Customer with the logs of administrative access relating to its Workspace.

Security measures. ManyPI shall take all measures required under Article 32 GDPR, namely appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risk of varying likelihood and severity for the rights and freedoms of natural persons.

Annex II. The measures in force at the effective date of this DPA are set out in Annex II. ManyPI shall regularly test, assess and evaluate their effectiveness. ManyPI may adapt them to technical progress, provided that the overall level of security is not reduced.

Customer's assessment. The Customer has reviewed the measures in Annex II and considers them appropriate to the risks presented by the Customer Personal Data it chooses to process through the Service.

Customer's own measures. The Customer remains responsible for its own security practices, in particular the strength and confidentiality of its credentials, the management of Users and roles in its Workspace, the security of any mailbox it connects, and its choice of which categories of data to place in the Service.

General authorisation. The Customer grants ManyPI a general written authorisation within the meaning of Article 28(2) GDPR to engage Sub-processors, subject to this §6. The Sub-processors listed in Annex III at the effective date of this DPA are approved.

Notice of changes. ManyPI shall inform the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days before the change takes effect, by:

1. (a)
   updating the Sub-processor List; and
2. (b)
   sending an email to every Customer that has subscribed to change notifications in the manner described in the Sub-processor List.

Right to object. The Customer may object to an intended change on reasonable grounds relating to data protection by writing to legal@manypi.com within the notice period. The parties shall discuss the objection in good faith. If ManyPI neither withdraws the change nor offers a reasonable alternative, and the objection is not resolved, the Customer may terminate the affected Paid Plan or the Agreement with immediate effect and without penalty. ManyPI shall then refund, on a pro-rata basis, any fees prepaid for the unused remainder of the Subscription Term.

Deemed approval. If the Customer does not object within the notice period, the change is deemed approved.

Urgent changes. Where a Sub-processor must be replaced at short notice to address a security risk, or because the Sub-processor ceases to provide its service without adequate notice to ManyPI, ManyPI may make the change immediately. ManyPI shall inform the Customer as soon as possible thereafter in the manner set out in clause 6.2. The Customer's right to object under clause 6.3 applies, with the notice period running from the date of that notice.

Obligations of Sub-processors. Before a Sub-processor processes Customer Personal Data, ManyPI shall impose on it, by a contract in writing, which may be in electronic form, data protection obligations that are in substance the same as those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of the GDPR. ManyPI shall assess each Sub-processor before engaging it.

Liability for Sub-processors. Where a Sub-processor fails to fulfil its data protection obligations, ManyPI remains fully liable to the Customer for the performance of that Sub-processor's obligations.

Information about Sub-processor terms. On request, ManyPI shall provide the Customer with the data protection terms agreed with a Sub-processor, including the transfer mechanism relied on, or a summary of them. ManyPI may redact commercial information and information that it is obliged to keep confidential.

Customer-configured integrations. The Service allows the Customer to connect third-party systems of its own choosing, for example a CRM, a project tracker or a custom MCP server. The providers of those systems are not Sub-processors. The Customer authorises and directs those connections and decides what Customer Personal Data flows through them, and any transmission to such a provider is made on the Customer's instructions. The Customer is responsible for having a legal basis for the transmission, for any agreement with the provider that Data Protection Law requires, and for any transfer mechanism that Chapter V GDPR requires.

Assistance. Taking into account the nature of the processing, ManyPI shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR.

Self-service functions. The Service provides functions which the Customer shall use in the first instance, and with which the Customer can, without ManyPI's involvement:

1. (a)
   search for and view the contact records in its Workspace;
2. (b)
   correct and delete those records;
3. (c)
   export contact records in a structured, commonly used and machine-readable format; and
4. (d)
   add an address to the suppression list of the Workspace, to which the Service also adds an address automatically when the recipient unsubscribes, a message to the address hard-bounces or a complaint is received.

Requests received by ManyPI. If ManyPI receives a request from a data subject concerning Customer Personal Data, ManyPI shall not decide on the request on its merits. Unless Union or Member State law requires otherwise, ManyPI shall:

1. (a)
   identify the Customer concerned from the information the data subject provides, such as the message received and its headers, to the extent that information allows;
2. (b)
   forward the request to that Customer without undue delay; and
3. (c)
   inform the data subject that the request has been forwarded and which Customer is responsible for it.

Standing instruction to stop contact. Where a data subject asks ManyPI directly to stop further contact from a Customer through the Service, the Customer instructs ManyPI, in addition to the steps in clause 7.3:

1. (a)
   to add the data subject's email address, without undue delay, to the suppression list of the Workspace from which the data subject was contacted; and
2. (b)
   to inform the Customer that it has done so.

Further assistance. Where a request cannot be answered using the self-service functions, ManyPI shall provide reasonable further assistance without undue delay and at no charge. Where the Customer's requests for assistance are manifestly unfounded or excessive, ManyPI may charge for the assistance at rates notified to the Customer in advance.

Notification of breaches. ManyPI shall notify the Customer of a personal data breach affecting Customer Personal Data without undue delay, and in any event within forty-eight (48) hours, after becoming aware of it. ManyPI shall send the notification to the email address associated with the Customer's account and, where the breach is likely to result in a risk to the rights and freedoms of natural persons, shall in addition contact the Customer directly.

Content of the notification. The notification shall describe, to the extent then known:

1. (a)
   the nature of the breach, including, where possible, the categories and approximate number of data subjects and of personal data records concerned;
2. (b)
   the likely consequences of the breach;
3. (c)
   the measures taken or proposed by ManyPI to address the breach, including measures to mitigate its possible adverse effects; and
4. (d)
   the name and contact details of a contact point at ManyPI.

Information in phases. ManyPI shall not delay the notification in order to complete its investigation. Where it cannot provide all the information at the same time, ManyPI shall provide it in phases without undue further delay.

Containment. ManyPI shall without undue delay take the measures reasonably necessary to contain the breach, to investigate it and to mitigate its adverse effects, and shall keep the Customer informed of material developments.

Documentation. ManyPI shall document every personal data breach affecting Customer Personal Data, including the facts relating to it, its effects and the remedial action taken, and shall make that documentation available to the Customer on request.

Notifications by the Customer. The Customer is responsible for any notification to a supervisory authority under Article 33 GDPR and any communication to data subjects under Article 34 GDPR. ManyPI shall not make such a notification or communication on the Customer's behalf unless the Customer instructs it to do so.

No admission. A notification under this §8 is not an acknowledgement of fault or liability.

Assistance under Articles 32 to 36 GDPR. Taking into account the nature of the processing and the information available to it, ManyPI shall assist the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36 GDPR, namely security of processing, the notification of personal data breaches to the supervisory authority and their communication to data subjects, data protection impact assessments and prior consultation of the supervisory authority. In particular, ManyPI shall provide the information about the Service that the Customer reasonably requires for a data protection impact assessment.

Return or deletion. After the end of the provision of the Service, ManyPI shall, at the Customer's choice, return or delete all Customer Personal Data and delete existing copies, unless Union or Member State law requires storage of the personal data. The Customer exercises that choice in accordance with clauses 9.2 and 9.3.

Return by export. The Customer may export Customer Personal Data using the export functions of the Service at any time during the term of the Agreement and during the export window provided in §13 of the Terms of Service, which runs for thirty (30) days after the Agreement ends or, where the Customer switches provider under that section, after the transitional period. The Customer is responsible for exporting within the export window. Where the export functions do not cover a category of Customer Personal Data described in Annex I, ManyPI shall, on a request in text form received within the export window, provide that data in a structured, commonly used and machine-readable format.

Deletion. After the export window expires, or earlier on the Customer's instruction in text form, ManyPI shall delete Customer Personal Data from its production systems.

Backups. Encrypted backups are retained on a rolling cycle for disaster recovery and are overwritten in the ordinary course. Customer Personal Data deleted from production systems remains in backups until they are overwritten, and in any event for no longer than ninety (90) days after its deletion from production. During that period ManyPI shall not access it in the ordinary course of operations and shall not process it for any purpose other than restoring the Service. If a backup is restored, ManyPI shall delete again, without undue delay, any Customer Personal Data that had been deleted before the restoration.

Statutory retention. Where Union or Member State law requires ManyPI to store Customer Personal Data beyond the periods in this §9, ManyPI shall restrict its processing to the purpose of that requirement and delete the data when the requirement ends. Records that ManyPI keeps as controller, in particular invoices and accounting records retained for up to ten (10) years under § 257 HGB and § 147 AO, are not Customer Personal Data; they are governed by §13 of the Terms of Service and the Privacy Policy.

Confirmation. On request, ManyPI shall confirm the deletion in text form.

Operational caches. Entries in the operational caches described in §13 are not Customer Personal Data and are governed by §13, not by this §9.

Information and audits. ManyPI shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and in this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, in accordance with this §10.

Documentation. On request and at no charge, ManyPI shall provide:

1. (a)
   a description of its current technical and organisational measures;
2. (b)
   the Sub-processor List, the transfer mechanism relied on for each Sub-processor and the information described in clause 6.8;
3. (c)
   the documentation of transfer impact assessments described in clause 11.5;
4. (d)
   the logs described in clause 4.5; and
5. (e)
   any certification or third-party assessment report relating to the Service that ManyPI holds.

Questionnaires. ManyPI shall complete a reasonable written security and data protection questionnaire at no charge, within thirty (30) days of receipt, once in any twelve-month period and additionally after a personal data breach affecting Customer Personal Data.

Choice of means. The Customer may rely on the information provided under clauses 10.2 and 10.3 to verify ManyPI's compliance. Where the Customer considers an inspection necessary, it may conduct one in accordance with clause 10.5. An inspection does not require the Customer to show that the information provided is insufficient.

Inspections. The Customer, or an auditor mandated by it, may inspect ManyPI's compliance with this DPA, on site or remotely, subject to the following conditions:

1. (a)
   the Customer gives at least thirty (30) days' notice in text form stating the scope of the inspection, save that a shorter period applies where it is justified by a personal data breach or required by a supervisory authority;
2. (b)
   the inspection takes place during normal business hours in Berlin and without undue disruption to ManyPI's operations;
3. (c)
   inspections take place no more than once in any twelve-month period, unless required by a supervisory authority, following a personal data breach affecting Customer Personal Data, or where there are reasonable indications that ManyPI is not complying with this DPA;
4. (d)
   the auditor is bound by a statutory or written obligation of confidentiality;
5. (e)
   the auditor is not a competitor of ManyPI; and
6. (f)
   the inspection gives no access to the data of other customers, and no access to systems in a manner that would compromise their security.

Sub-processors. Facilities and systems operated by Sub-processors are verified through the certifications and audit reports that those Sub-processors make available. ManyPI shall provide them to the Customer on request, to the extent the Sub-processor permits.

Results. The Customer shall provide ManyPI with a copy of any audit report. The Customer shall treat the information obtained in an inspection as confidential, except where disclosure to a supervisory authority or otherwise is required by law. ManyPI shall remedy without undue delay any non-compliance with this DPA that an inspection identifies.

Costs. The Customer bears its own costs of an inspection and shall reimburse ManyPI's reasonable costs of supporting it, at rates notified in advance, unless the inspection reveals a material breach of this DPA by ManyPI, in which case ManyPI bears its own costs.

Supervisory authorities. Nothing in this §10 limits the powers of a competent supervisory authority. ManyPI shall cooperate, on request, with the competent supervisory authority in the performance of its tasks, and shall inform the Customer without undue delay of any inspection or measure by a supervisory authority that concerns Customer Personal Data, unless the law prohibits it.

Data locations. ManyPI's primary storage of Customer Personal Data is located in the EEA. The primary database is hosted in the European Union (Supabase, EU region), and background processing infrastructure is located in Germany and Finland (Hetzner Online GmbH). The Sub-processors and their locations are listed in Annex III.

Conditions for transfers. ManyPI shall transfer Customer Personal Data to a third country or an international organisation only:

1. (a)
   on the Customer's documented instructions under §3, which include the engagement of the Sub-processors approved under §6; and
2. (b)
   in compliance with Chapter V GDPR.

Transfer mechanisms. The transfer mechanisms are set out in Annex IV, as follows:

1. (a)
   where the Customer is established in the EEA, or the provision of Customer Personal Data to the Customer is covered by an adequacy decision, no further transfer mechanism is required between the Customer and ManyPI (Annex IV, Part A);
2. (b)
   where the Customer is established in a third country and the provision of Customer Personal Data to the Customer is not covered by an adequacy decision, that provision is governed by Module Four of the Standard Contractual Clauses, which are incorporated into this DPA for that purpose (Annex IV, Part B);
3. (c)
   for onward transfers to Sub-processors in third countries, ManyPI puts a transfer mechanism in place directly with each Sub-processor (Annex IV, Part C); and
4. (d)
   transfers involving the United Kingdom or Switzerland are governed by Annex IV, Part D.

Onward transfers to Sub-processors. Certain Sub-processors are established outside the EEA, principally in the United States and Israel, or may access Customer Personal Data from outside the EEA. ManyPI shall transfer Customer Personal Data to them only to the extent necessary for the function they perform, and only once a transfer mechanism under Chapter V GDPR is in place with the Sub-processor concerned.

Transfer impact assessments. Where a transfer relies on the Standard Contractual Clauses, ManyPI shall assess, in the light of the circumstances of the transfer, whether the law and practices of the country of destination prevent the recipient from fulfilling its obligations under them. ManyPI shall document that assessment, implement supplementary measures where necessary, such as encryption in transit and at rest and minimisation of the data transmitted, and make the documentation available under §10.

Loss of a transfer mechanism. If a transfer mechanism ceases to be available, for example because an adequacy decision is invalidated, ManyPI shall without undue delay rely on another mechanism already in place with the recipient, put a new one in place or suspend the transfer, and shall inform the Customer. If no transfer mechanism can be put in place, the Customer may terminate the affected Paid Plan or the Agreement, and the refund provision in clause 6.3 applies.

Transfers initiated by the Customer. The Customer is responsible for compliance with Chapter V GDPR for any transfer of Customer Personal Data that it initiates, including a transmission to the provider of a customer-configured integration under clause 6.9 and access to its Workspace by persons outside the EEA to whom the Customer grants it. This does not affect ManyPI's obligations under Annex IV, Part B.

AI functions. The Service uses artificial intelligence to research leads, draft messages, extract structured data from web pages, classify inbound replies and answer questions about uploaded datasets. OpenAI is ManyPI's only provider of AI models and is engaged as a Sub-processor under §6.

Data transmitted. Depending on the function used, ManyPI transmits to the AI provider:

1. (a)
   the Customer's instructions and questions;
2. (b)
   contact records supplied as context for drafting;
3. (c)
   excerpts of inbound reply bodies, of up to about 1,200 characters, for sentiment and intent classification;
4. (d)
   the content of files that the Customer uploads for analysis; and
5. (e)
   excerpts of web pages retrieved during research, the full pages being processed on ManyPI's own infrastructure and only the relevant excerpts sent onward.

No training. ManyPI shall not use Customer Personal Data to train, fine-tune or improve any artificial-intelligence model, whether its own or a third party's. ManyPI's contract with its AI provider prohibits the provider from using data submitted through the interface used by the Service to train its models, and ManyPI shall not engage an AI provider on terms that permit such use.

Review of Output. Output is generated probabilistically and may be inaccurate, incomplete or misleading. It supports the Customer's judgement and does not replace it. The Customer is responsible for reviewing Output before acting on it, in particular before sending a message drafted with its assistance; §8 of the Terms of Service applies.

No decisions under Article 22 GDPR. The Service scores and ranks contacts to help the Customer prioritise its own outreach. That scoring produces no legal effects concerning the data subject and does not similarly significantly affect them within the meaning of Article 22 GDPR. §8 of the Terms of Service prohibits the use of the Service to make decisions of that kind, and the Customer shall not configure the Service to make them.

Purpose of this section. This §13 describes the one respect in which information obtained while providing the Service to one customer is used in providing the Service to others, so that the Customer can take it into account in its own assessment of the Service.

The caches. To avoid retrieving the same publicly available information and querying the same mail servers repeatedly, which would burden third-party infrastructure, ManyPI maintains two operational caches that are shared across customers:

1. (a)
   a cache of contact details published by companies on their own websites, keyed by domain, holding published email addresses, telephone numbers, named roles and social profile links; and
2. (b)
   a cache of email deliverability results, keyed by email address, holding whether a mailbox was found to exist, the reason, and the responding mail server's response code.

How the caches are used. When the Customer instructs the Service to look up a domain or to verify an email address, ManyPI first consults the relevant cache. If the cache holds a current entry, ManyPI provides that entry to the Customer's Workspace instead of performing the lookup again, even where the entry was created in the course of another customer's lookup. If the cache holds no current entry, ManyPI performs the lookup, provides the result to the Customer's Workspace and stores the result in the cache.

ManyPI as independent controller. ManyPI determines the purposes and means of the processing in the caches and is an independent controller, not the Customer's processor, in respect of it. The legal basis is Article 6(1)(f) GDPR: the legitimate interest of ManyPI, and of the operators of the systems that would otherwise be queried repeatedly, in avoiding redundant lookups. ManyPI has carried out and documented a balancing assessment for this processing. The result provided to the Customer's Workspace is Customer Personal Data and is subject to this DPA.

Safeguards. ManyPI shall maintain the following safeguards:

1. (a)
   entries are not used, and are deleted automatically, thirty (30) days after they were last checked; some kinds of result are used for a shorter period;
2. (b)
   no customer account can read the deliverability cache, so that its contents cannot be browsed or searched and it cannot be used to test whether arbitrary email addresses exist; a customer receives only the result for an address it has itself submitted for verification;
3. (c)
   entries in the company contact cache are returned to a customer whose research concerns the same domain, in place of retrieving the company's website again;
4. (d)
   neither cache records which customer, Workspace or User performed or consulted a lookup; and
5. (e)
   neither cache is used to build profiles of individuals, and neither is otherwise disclosed, sold or licensed.

Relationship to Customer Personal Data. Cache entries are not Customer Personal Data. They are not deleted under §9 when the Agreement ends; clause 13.5(a) governs their deletion.

Rights of data subjects. A person may object to the processing of their data in the caches, or request erasure of their entry, at privacy@manypi.com. Because ManyPI acts as controller, the person exercises these rights against ManyPI directly, independently of any customer. Erasure of a cache entry does not affect data held in a customer's Workspace, which remains under that customer's control.

Responsibility for lawfulness. The Service enables the collection of personal data about, and communication with, individuals who may have no prior relationship with the Customer. The Customer is responsible for the lawfulness of that processing and of those communications, and for ensuring that its instructions comply with Data Protection Law.

Warranties. The Customer warrants and undertakes that:

1. (a)
   it is the controller of Customer Personal Data or, where clause 1.5 applies, is authorised by the controller to give the instructions it gives;
2. (b)
   it has a valid legal basis under Article 6 GDPR for every processing operation it instructs, including collection, enrichment, storage and contact;
3. (c)
   it complies with its information obligations under Articles 13 and 14 GDPR towards every data subject whose data it processes through the Service, including, where the data was not obtained from the data subject, by providing the information required by Article 14 GDPR within a reasonable period and at the latest within one month or, if the data is used to communicate with the data subject, at the latest at the time of the first communication, and by identifying the source of the data;
4. (d)
   it complies with all applicable law on electronic communications and marketing in each jurisdiction in which it contacts individuals, including the national implementations of Directive 2002/58/EC, § 7 UWG in Germany (which requires prior express consent to advertising by email, including towards businesses, subject to the narrow exception in § 7(3) UWG), the CAN-SPAM Act in the United States and CASL in Canada;
5. (e)
   it honours opt-outs, objections and erasure requests from data subjects without undue delay;
6. (f)
   it is entitled to connect every mailbox it connects and, where a mailbox belongs to an organisation, is authorised by that organisation to grant access to its contents;
7. (g)
   it does not instruct the processing through the Service of special categories of personal data under Article 9 GDPR, or of personal data relating to criminal convictions and offences under Article 10 GDPR, unless it has first agreed this with ManyPI in text form and the parties have implemented appropriate additional safeguards;
8. (h)
   it does not use the Service to process the personal data of children; and
9. (i)
   it complies with the Acceptable Use Policy.

Notice of irregularities. The Customer shall inform ManyPI without undue delay if it detects errors or irregularities in the processing of Customer Personal Data by ManyPI.

Indemnity. The Customer shall indemnify ManyPI against claims asserted against ManyPI by third parties, including data subjects and supervisory authorities, that arise from a breach of this §14 for which the Customer is responsible, including the reasonable costs of ManyPI's legal defence and, to the extent legally permissible, fines. The procedure in §6 of the Terms of Service applies.

Suspension. Where ManyPI has a reasonable and substantiated belief that processing instructed by the Customer is unlawful, ManyPI may suspend the affected function. ManyPI shall inform the Customer of the grounds without undue delay and give it a reasonable opportunity to respond. §12 of the Terms of Service applies to the procedure.

Terms of Service apply. The liability of the parties under or in connection with this DPA is governed by §15 of the Terms of Service, which applies to this DPA as if set out in it.

Unlimited liability. Nothing in this DPA or in the Terms of Service limits or excludes:

1. (a)
   liability for intent or gross negligence;
2. (b)
   liability for injury to life, body or health;
3. (c)
   liability under the German Product Liability Act (Produkthaftungsgesetz);
4. (d)
   liability that cannot be limited or excluded under Data Protection Law or other mandatory law; or
5. (e)
   the liability of either party towards a data subject under Article 82 GDPR.

Data subjects. Article 82 GDPR governs the liability of the parties towards data subjects, including the right of a party that has paid full compensation to claim back from the other party the part of the compensation corresponding to the other party's part of the responsibility for the damage (Article 82(5) GDPR). A limitation of liability agreed between the parties does not affect a data subject's claims.

Standard Contractual Clauses. Where the Standard Contractual Clauses apply under Annex IV, Part B, Clause 12 of those clauses prevails over this §15 to the extent of any conflict.

Term. This DPA takes effect as stated in the Preamble and remains in force for as long as ManyPI processes Customer Personal Data, until all Customer Personal Data has been returned or deleted in accordance with §9. Obligations that by their nature are intended to continue after that time, in particular those in §4, survive.

Order of precedence. In the event of a conflict, the following order of precedence applies:

1. (a)
   the Standard Contractual Clauses, where they apply under Annex IV, Part B;
2. (b)
   this DPA, including its Annexes;
3. (c)
   the Terms of Service; and
4. (d)
   any other document forming part of the Agreement.

Amendments. ManyPI may amend this DPA where necessary to reflect a change in Data Protection Law, a decision or guidance of a supervisory authority or a court, a change in the Standard Contractual Clauses or in an adequacy decision, or a material change to the Service. No amendment may cause the processing to fall short of the requirements of Article 28 GDPR. Changes of Sub-processors are governed by §6, not by this clause.

Notice and termination. ManyPI shall give the Customer at least thirty (30) days' notice of a material amendment by email to the address associated with the Customer's account. If the amendment materially reduces the Customer's rights or ManyPI's obligations, the Customer may terminate the affected Paid Plan or the Agreement, without penalty, before the amendment takes effect, and ManyPI shall refund, on a pro-rata basis, any fees prepaid for the unused remainder of the Subscription Term.

Severability. If a provision of this DPA is or becomes invalid, the remaining provisions continue in force. The invalid provision shall be replaced by a valid provision that comes closest to the parties' intention and satisfies the requirements of Article 28 GDPR.

Governing law and jurisdiction. This DPA is governed by the law of the Federal Republic of Germany, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. To the extent permitted by law, the exclusive place of jurisdiction for disputes arising under or in connection with this DPA is Berlin, Germany. The governing law and choice of forum of the Standard Contractual Clauses are those set out in Annex IV, Part B.