Data Processing Addendum (DPA)

(Lead Intelligence Platform – Magnetise Solutions Limited)

This Data Processing Addendum (“Addendum”) forms part of the Lead Intelligence Licence Agreement (the “Agreement”) between: Magnetise Solutions Limited (trading as Lead Intelligence) (“LI”, “Processor”)
and
Client (“Controller” or “Processor”, as applicable)
‍
This Addendum forms part of, and is incorporated into, the Lead Intelligence Licence Agreement (the “Agreement”) entered into between Lead Intelligence (Magnetise Solutions Ltd) and the Client, and is deemed executed upon execution of the Agreement.

1. Roles of the Parties

1.1 For the purposes of Data Protection Legislation:

• The Client may act as a Controller or Processor, depending on its role in the applicable processing activities (including where acting as an agency, end advertiser, network, or publisher);
• LI acts as Processor, except where expressly stated otherwise.

1.2 The Client acknowledges that it determines (or, where applicable, its End Advertiser determines) the purposes and means of processing, and is therefore responsible for compliance with applicable Data Protection Laws.
‍
1.3 Where the Client acts as a Processor on behalf of a third party (including an End Advertiser), the Client warrants that it is authorised to:

• enter into this Addendum; and
  
• provide instructions to LI on behalf of such third party.

2. Scope of Processing

2.1 Processing may include:

• lead generation and distribution
  
• storage, routing, validation and enrichment of data
  
• campaign management, analytics and optimisation
  

2.2 The categories of Data Subjects, types of Personal Data, and duration and nature of processing shall be as described in the Agreement, applicable Order Form, or the LI Platform Privacy Policy.

3. Processing on Instructions

LI shall process Personal Data only on the Client’s documented instructions, including instructions provided through the Client’s use of the Services (which shall constitute documented instructions), campaign configurations, platform settings, APIs, integrations, or communications with LI (including via email, support channels or verbal instructions), unless required by law.
‍
For the avoidance of doubt, any request by or on behalf of the Client to create, configure, launch or manage a campaign, including where communicated informally, and any subsequent use of the Services, shall constitute documented instructions.

4. Legal Basis & Consent

4.1 The Client warrants that it (and/or its End Advertisers and Sources):

• have established a valid legal basis for processing (including consent where required);
• have provided appropriate privacy disclosures;
• have obtained any necessary permissions for marketing communications.
  

4.2 LI:

• does not independently determine the legal basis for processing;
  
• relies on contractual assurances from the Client and its End Advertisers and Sources.
  

4.3 LI may implement reasonable platform-level controls or requirements to support compliance but does not actively monitor or assume responsibility for the data collection practices of the Client, its End Advertisers or Sources.

5. Data Retention & Anonymisation

5.1 The LI Platform applies standard retention and anonymisation processes as described in the LI Platform Privacy Policy.
‍
5.2 The Client acknowledges and agrees that data retention and anonymisation settings may be configurable within the Platform by authorised users.
‍
5.3 The Client has the ability, through the Platform, to:

• adjust retention periods;
• define anonymisation timelines;
• align data storage with its own legal, regulatory and business requirements.
  

5.4 In particular, the Client may configure a PII existence window, following which personal data elements (including names, phone numbers, email addresses and IP addresses) are permanently anonymised within the LI Platform through automated processes, including overwriting such data with non-identifiable values.
‍
5.5 Accordingly, the Client is responsible for determining, configuring and applying appropriate retention and anonymisation settings in line with its obligations as Controller under applicable Data Protection Laws, taking into account any default or standard retention settings applied within the LI Platform.
‍
5.6 LI shall provide the technical capability to apply retention, anonymisation and deletion processes within the LI Platform in accordance with its functionality.

6. Security Measures

6.1 LI shall implement appropriate technical and organisational measures to protect Personal Data, including those described in the LI Platform Privacy Policy.

6.2 Access to Personal Data shall be restricted to authorised personnel subject to confidentiality obligations.

7. Sub-processors

7.1 The Client acknowledges and agrees that LI may engage and utilise sub-processors as part of the provision and ongoing development of the Services, and that such sub-processors may be added or replaced from time to time.
‍
7.2 LI shall:

• use reasonable care in the selection and appointment of sub-processors and seek to engage reputable providers capable of meeting appropriate data protection and security standards;
• ensure appropriate contractual safeguards are in place;
• remain responsible for the acts and omissions of its sub-processors as if they were its own, in accordance with the Agreement;
• make information on sub-processors available to the Client, including via the Platform Privacy Policy or other appropriate means.

7.3 LI shall notify the Client of any material changes to sub-processors, including by updating the Platform Privacy Policy or by other appropriate means.
‍
7.4 The Client may object to such changes on reasonable data protection grounds by providing written notice within a reasonable period.
‍
7.5 In the event of a valid objection, the parties shall work together in good faith to identify a commercially reasonable solution. Where this is not possible, the Client may elect not to utilise the specific feature, integration or functionality of the Services that relies on the relevant sub-processor.

8. Data Subject Rights

8.1 LI shall provide reasonable assistance to the Client in responding to data subject rights requests.
‍
8.2 The Client remains responsible for handling such requests and determining responses.

9. Personal Data Breaches

9.1 LI shall notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Personal Data.
‍
9.2 LI shall provide reasonable assistance in investigating and mitigating such breach.

10. Audits & Compliance

10.1 LI shall make available information reasonably necessary to demonstrate compliance with this Addendum.

10.2 LI may satisfy audit requirements by providing:

• certifications (such as ISO, SOC, Cyber Essentials or Cyber Essentials Plus, where available and current in accordance with their standard validity periods, and typically reports issued within the preceding 18 months shall be deemed current for these purposes);
• policies, summaries or other third-party assurance reports.

10.3 Where, acting reasonably, the Client can demonstrate that such information does not provide sufficient evidence of compliance with applicable Data Protection Laws, the Client may request an audit. Any such audit shall be subject to LI’s reasonable approval and scheduling, and shall be conducted on reasonable notice, provided that it is:

• proportionate in scope and limited to data protection matters;
• conducted during normal business hours;
• and carried out in a manner that does not unreasonably interfere with LI’s business or compromise the confidentiality, security or privacy of other customers.

10.4 The Client shall bear its own costs in relation to any audit requested under Clause

10.5. LI shall bear its reasonable internal costs of responding to standard audit requests satisfied through documentation. Where the Client requests an audit requiring additional support, access, or resources beyond such documentation, the Client shall reimburse LI for its reasonable costs incurred, subject to prior notice.

11. Deletion or Retention of Data

Personal Data will be deleted or anonymised in accordance with the Agreement and the LI Platform Privacy Policy. Where applicable, deletion will typically occur within a reasonable period following termination, subject to system back-ups, legal or regulatory obligations, and standard retention processes.
‍
The Client acknowledges that Personal Data may be retained for limited periods as part of standard backup processes, compliance requirements, and system integrity.
‍
For the avoidance of doubt, LI shall be entitled to withhold access to or delivery of any data pending payment of any outstanding fees in accordance with the Agreement.

12. International Transfers

12.1 LI shall not transfer Personal Data outside the UK or EEA unless appropriate safeguards are implemented in accordance with applicable Data Protection Laws, including (where applicable) the use of Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or equivalent legally recognised mechanisms.

13. Relationship with the Agreement