Data Processing Agreement

The relationship is not the same at every stage, and this agreement is explicit about that rather than assuming one role throughout.

For sending, and everything after it — the campaign, the messages, the replies, the engagement record — you are the controller and xcelit is the processor. You decide who is contacted and why; we act on your documented instructions, which are the settings, audiences and campaigns you configure in the product, together with this agreement.

For building an audience from our data sources — where you describe the audience you want and we search third-party providers to assemble it — we are joint controllers with you, because we apply our own selection and scoring logic to decide which individuals appear. Clause 4 sets out how that is divided. Where you upload your own list instead, no joint controllership arises: we are your processor from the moment you supply it.

This is separate from the xcelit Privacy Policy, which covers data where xcelit is itself the controller — your own account details, billing records and product usage. This agreement covers only prospect data.

The categories are deliberately narrow. We process:

• Business contact data — name, job title, employer, work email address, company domain, and where available a public professional profile URL.
• Public activity signals — facts already published by or about the prospect’s company, used to make an email specific rather than generic.
• Engagement records — whether a message was delivered, opened, replied to, bounced, or unsubscribed, and the content of replies received.

Data subjects are the individuals you choose to contact. We do not ask for, and you must not upload, special-category data (health, biometric, political, religious, trade-union, sexual-orientation data), data about children, or financial account data.

The lawful basis for contacting a prospect is yours to establish and to be able to demonstrate. In particular you confirm that:

• You have a lawful basis for the processing — in most B2B cases legitimate interest — and have carried out any balancing assessment your jurisdiction requires.
• You will honour opt-outs and data-subject requests promptly, using the tools the product provides.
• Your lists were lawfully obtained. Purchased, rented, scraped or otherwise unlawfully compiled lists are not permitted.
• You will comply with the sending laws applying to you and to your recipients — including CAN-SPAM, GDPR/ePrivacy, and India's DPDP Act, 2023.

These commitments also appear in the Outreach Terms, and breaking them is grounds for suspension.

This clause is the arrangement required by Article 26 GDPR. It applies only to the audience-building step described in clause 1 — when you describe an audience and we search third-party providers to assemble it. It does not apply to lists you upload, or to anything that happens after an audience exists.

Responsibilities divide as follows:

• You determine the purpose — who you want to reach and why, and you establish the lawful basis for contacting them.
• We determine part of the means — which data sources are queried, and the selection and scoring logic that decides which individuals match your description.
• We are the point of contact for a data subject asking about the audience-building step: how they were sourced, from where, and how to object to it. Write to support@xcelit.co.in.
• You are the point of contact for everything after: why they were contacted, what was sent, and requests to stop.

A data subject may exercise their rights against either of us regardless of this division, as Article 26(3) requires. Whichever of us receives the request will action the part it controls and pass the remainder to the other without undue delay. The essence of this arrangement is this clause, published here and freely accessible.

Each of us is responsible for our own part. We do not accept liability for your decision to contact an audience, and you do not accept liability for our sourcing logic.

• We process prospect data only on your documented instructions, and will tell you if an instruction appears to us to breach applicable data-protection law.
• Personnel with access to prospect data are bound by confidentiality obligations.
• We apply the technical and organisational measures described in clause 7.
• We assist you, so far as is reasonable, with data-subject requests, impact assessments, and regulator consultations.
• We will not sell prospect data, and will not use it to train machine-learning models.

You give general authorisation for us to engage sub-processors. Each is bound by data protection terms no less protective than these, and we remain liable for their performance. The current list is published at outreach.xcelit.co.in/legal/subprocessors.

We will give at least 30 days’ notice before adding or replacing a sub-processor. If you reasonably object on data-protection grounds within that period, you may terminate the affected service and receive a pro-rata refund of prepaid fees.

Measures actually in force, not aspirations:

• Encryption in transit (TLS) for all traffic, and encryption at rest for the database and object storage.
• Tenant isolation enforced in application code: every query touching customer data is scoped to the owning workspace, and cross-tenant access attempts fail closed rather than returning empty results.
• Role-based access control, with separate operator and customer roles.
• Credentials held in a managed secret store, never in source control.
• Audit logging of administrative and data-affecting actions, retained for at least 12 months.
• Automated suppression of addresses that unsubscribe, bounce, or report a message as spam.
• Regression tests asserting tenant isolation, which run before each deployment.

Our infrastructure and sub-processors operate primarily in the United States, the European Union and India, so prospect data may be transferred across borders. Where personal data protected by the GDPR is transferred outside the EEA or UK, transfers rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914) — Module Two (controller to processor) between you and us, and Module Three (processor to processor) between us and our sub-processors — together with any supplementary measures the transfer requires. Transfers of personal data under India’s DPDP Act, 2023 are made in accordance with that Act.

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting prospect data you control. The notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, the measures taken or proposed, and a contact point. We will assist you with your own regulatory notifications.

If a prospect contacts us directly to exercise a right — access, rectification, erasure, restriction, portability, or objection — we will not respond substantively on your behalf. We will forward the request to you without undue delay and help you answer it.

Unsubscribe requests are the exception: every message carries a working unsubscribe link, and an unsubscribe is applied immediately and automatically to your workspace. Opt-outs are scoped to the sender who received them; an unsubscribe from your campaigns does not affect another customer’s permissions, and theirs does not affect yours. Addresses that hard bounce or generate a spam complaint are suppressed platform-wide, because those are facts about the mailbox rather than about consent.

We retain prospect data for as long as your workspace is active. On termination you may export your data for 30 days, after which we delete or irreversibly anonymise it within a further 60 days, excluding backups, which age out on their normal cycle of no more than 35 days, and records we must keep by law.

Suppression records — unsubscribes, bounces and complaints — are retained after deletion of the rest. Deleting the evidence that someone opted out is how people get contacted again by mistake, and retaining it is itself a compliance obligation.

On reasonable written notice, and no more than once in any 12-month period unless a regulator or a breach requires otherwise, we will make available the information reasonably necessary to demonstrate compliance with this agreement, and will contribute to an audit conducted by you or an independent auditor you appoint who is not a competitor of ours.

Where this agreement conflicts with the Outreach Terms or the general xcelit Terms of Service, this agreement prevails in respect of the processing of prospect personal data. It takes effect when you first use xcelit Outreach and continues for as long as we process prospect data on your behalf.