This Data Processing Addendum (“DPA”) forms part of the agreement between IBL Holding Ltd. (“Processor” or “IBL”) and the customer organization (“Controller” or “Customer”) governing Customer’s use of Reveiler, to the extent IBL processes Personal Data on behalf of Customer.
1. Definitions
“Applicable Data Protection Law” means privacy and data-protection law applicable to the processing under the Agreement. “Personal Data,” “Controller,” “Processor,” “Data Subject,” and “Processing” have the meanings given by applicable law. “Subprocessor” means a processor engaged by IBL to process Customer Personal Data on Customer’s behalf.
2. Scope and roles
Customer is the Controller (or a Processor acting for another Controller) for Customer Personal Data processed through Reveiler. IBL is the Processor to the extent it processes such data on Customer’s documented instructions. IBL may separately act as a Controller for its own account administration, billing, security, fraud prevention, legal compliance, and business relationship records.
3. Customer instructions
IBL will process Customer Personal Data only on documented instructions from Customer, including the Agreement, Customer’s configuration and use of the Service, support requests, and other lawful written instructions, unless processing is required by law. If IBL is legally permitted to do so, it will inform Customer before processing required by law.
IBL will inform Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law and may suspend the affected processing while the parties address the issue.
4. Customer responsibilities
Customer is responsible for the lawfulness, fairness, transparency, accuracy, and minimization of Customer Personal Data and for establishing any required lawful basis, notices, consents, permissions, and rights-management process. Customer is also responsible for the legality of prospect research, enrichment, outreach, connected-mailbox use, and other instructions it gives through Reveiler.
5. Confidentiality
IBL will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.
6. Security
IBL will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the processing, available technology, costs, and risks.
Tenant/workspace access controls and role-based authorization.
Server-side handling of provider secrets and application credentials.
Administrative separation of proprietary provider governance from customer access.
Audit and privacy-request controls.
Application-level controls for mailbox disconnect, consent state, data export, and supported deletion workflows.
Data-category governance for external research/provider routing.
Some infrastructure controls, including underlying storage encryption, key management, backups, and provider-side token or object deletion, are operated by platform or external providers. IBL will not represent an external action as confirmed unless supported by available evidence.
7. Subprocessors
Customer authorizes IBL to engage Subprocessors to provide the Service. IBL will impose data-protection obligations on Subprocessors as required by Applicable Data Protection Law. IBL will remain responsible for its obligations under this DPA to the extent required by law and the Agreement.
IBL may maintain a Subprocessors & Third-Party Services Notice describing relevant providers and service categories. Where Applicable Data Protection Law requires prior notice of a new Subprocessor, IBL will provide a reasonable mechanism for such notice. Customer may object on reasonable data-protection grounds within the stated notice period, and the parties will work in good faith on a commercially reasonable solution.
8. International transfers
Where Customer Personal Data is transferred across borders and Applicable Data Protection Law requires a transfer mechanism, the parties will use an applicable lawful mechanism. For transfers subject to the EU GDPR or UK GDPR, this may include the applicable Standard Contractual Clauses and, where required, the UK Addendum or another valid mechanism.
9. Data-subject requests
Taking into account the nature of the processing, IBL will provide reasonable assistance to Customer through available technical and organizational measures for responding to Data Subject requests. If IBL receives a request relating to Customer-controlled data, IBL may refer the requester to Customer unless law requires IBL to respond directly.
10. Security incidents
IBL will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data where notification is required by Applicable Data Protection Law. Notification will include available information reasonably necessary for Customer to meet its obligations, and may be provided in phases as information becomes available.
A notification does not constitute an admission of fault or liability.
11. DPIAs and regulatory assistance
Taking into account the nature of processing and information available to IBL, IBL will provide reasonable assistance with legally required data-protection impact assessments and prior consultations relating to Customer’s use of the Service. Customer remains responsible for determining whether such an assessment or consultation is required.
12. Return and deletion
Upon termination or a valid Customer instruction, IBL will return or delete Customer Personal Data within the capabilities of the Service and applicable retention requirements, unless law requires retention. Customer acknowledges that deletion from active application records may not immediately remove data from backups, external providers, or underlying private storage where deletion is controlled by another platform.
Where an underlying object or external copy cannot be deleted or deletion cannot be confirmed by the application, IBL will treat the disposition as an external/platform dependency rather than falsely record it as deleted. Data retained solely in backups will remain protected and will not be restored for ordinary business use except as required for disaster recovery or legal purposes, subject to the actual capabilities and policies of the relevant infrastructure provider.
Minimal privacy-request and security/audit records may be retained where necessary for accountability, legal compliance, security, dispute resolution, or proof of request handling, subject to an applicable retention schedule.
13. Audits and information
IBL will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, proportionality, and protection of other customers and proprietary systems. Where legally required and reasonable documentation is insufficient, the parties may agree on an audit by an independent qualified auditor under appropriate confidentiality and security restrictions.
No audit right requires IBL to disclose another customer’s data, credentials, security secrets, raw provider payloads, or proprietary provider-routing architecture except to the extent legally required and subject to appropriate safeguards.
14. Processing details
15. Order of precedence
If this DPA conflicts with the Agreement on matters of Personal Data processing, this DPA controls to the extent of the conflict. A negotiated enterprise DPA signed by both parties supersedes this standard DPA.