# Data Processing Agreement (template)

This is a template published for review by SimpleVerifier's customers. It is not legal advice, and neither party should sign it without having it reviewed by a lawyer. Items in [square brackets] are completed when the agreement is signed. A countersigned copy is available on request from the contact at https://simpleverifier.com/security.

Template version: 1 (24 October 2026)

## 1. Parties

- **Customer** (the "Controller"): [Customer legal name, address, contact].
- **Provider** (the "Processor"): [SimpleVerifier legal entity name, registered address, contact].

This agreement supplements the Terms of Service at https://simpleverifier.com/terms (the "Terms") and applies when the Provider processes personal data on behalf of the Customer.

## 2. Subject matter and duration

The Provider verifies email addresses and phone numbers, finds email addresses, and returns results to the Customer, as described in the Terms. This agreement lasts for as long as the Provider processes personal data for the Customer under the Terms.

## 3. Nature and purpose of processing

- **Purpose:** to provide the verification, finder, enrichment and related features the Customer uses.
- **Categories of data subjects:** the people whose email addresses, phone numbers and names the Customer submits (for example the Customer's leads, subscribers, customers and prospects), and the Customer's own users.
- **Types of personal data:** email addresses, phone numbers, names, company names and domains the Customer submits; verification results; the Customer's account details and usage records.
- **Special categories of data:** none are intended. The Customer must not submit special-category data.

## 4. Processor obligations

The Provider will:

1. Process personal data only on the Customer's documented instructions, which are the Terms, this agreement and the Customer's use of the service. The Provider will tell the Customer if it believes an instruction breaks data protection law.
2. Ensure that people authorised to process the data are bound by confidentiality.
3. Apply the security measures described at https://simpleverifier.com/security, as updated from time to time. The Provider will not reduce the overall level of protection during the term.
4. Delete the Customer's result files and job records 7 days after each list is submitted (on paid plans, a list's risky addresses with their earlier status and reason, and its job record without the results file, are kept for 14 days after the list finishes so the Customer can re-check them), and delete cached mailbox results 14 days after they were created, as described on the security page.
5. At the Customer's request when the agreement ends, delete the Customer's account record, job records and results files within 30 days, unless the law requires the Provider to keep them.
6. Help the Customer, taking into account the nature of the processing, to respond to requests from data subjects, and to meet its obligations on security, breach notification and impact assessments. The Provider may charge for help that goes beyond what is reasonable.
7. Notify the Customer without undue delay after confirming a personal data breach that affects the Customer's data, with the information the Provider then has.
8. Make available the information needed to show compliance with this agreement and allow reasonable audits, no more than once a year and with at least 30 days' written notice. The Provider will first offer written answers and relevant documents. The Provider holds no third-party security certification.

## 5. Subprocessors

The Customer gives general authorisation for the Provider to use the subprocessors listed at https://simpleverifier.com/subprocessors. The Provider will update that page before adding a subprocessor that will process the Customer's personal data. The Customer may object on reasonable data protection grounds by writing to the Provider within 30 days of the change; if the parties cannot resolve the objection, the Customer may end the affected service. The Provider will impose data protection obligations on each subprocessor no less protective than those in this agreement, and remains responsible for their performance.

## 6. International transfers

The Provider and its subprocessors process data in several countries, including the United States. Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the parties will rely on [the European Commission's Standard Contractual Clauses (and the UK addendum where relevant) / another lawful transfer mechanism to be agreed]. The text of the clauses is incorporated by reference and completed with the details in this agreement.

## 7. Customer obligations

The Customer is responsible for having a lawful basis to submit the personal data, for giving any notices required to the people concerned, and for using the service in line with the Terms and applicable law.

## 8. Liability

Liability under this agreement is subject to the limits in the Terms, except where the law does not allow it to be limited.

## 9. Governing law

[Governing law and courts to be agreed when signing.]

## 10. Signatures

| | Customer | Provider |
|---|---|---|
| Name | [ ] | [ ] |
| Title | [ ] | [ ] |
| Date | [ ] | [ ] |
| Signature | [ ] | [ ] |