Data Processing Agreement
Last updated: 22 October 2026.
Parties
- The Customer, the company that has an Answrd account and accepted the Answrd Terms of Service (the "Controller").
- Profitbl SARL-S, a société à responsabilité limitée simplifiée under Luxembourg law, registered office 6 Place des Villes Jumelées, L-5627 Mondorf-les-Bains, Luxembourg, R.C.S. Luxembourg B276593, VAT LU34835913 (the "Processor").
This Data Processing Agreement ("DPA") forms part of the Answrd Terms of Service. It applies when the Processor processes personal data for the Controller. It meets Article 28 of the GDPR (Regulation (EU) 2016/679).
1. Words used
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR. "Customer Personal Data" means the personal data in Lists uploaded by the Controller and the Results produced from them.
2. Roles and scope
- The Controller decides why and how Customer Personal Data is processed. The Processor processes it only to provide the Service.
- Annex 1 describes the processing.
- This DPA does not cover the Processor's own processing as a controller, described in clause 11.
3. Instructions
- The Processor processes Customer Personal Data only on the Controller's documented instructions. The Terms of Service, this DPA and the Controller's use of the portal (uploading a List) are the instructions.
- If the law requires other processing, the Processor will tell the Controller first, unless the law forbids it.
- The Processor will tell the Controller at once if it thinks an instruction breaks data protection law.
4. Confidentiality
Everyone who can access Customer Personal Data, including verifiers, is bound by a written duty of confidentiality in their employment or service contract.
5. Security
The Processor applies the measures in Annex 2. It may update them, as long as the level of protection does not go down.
6. Sub-processors
- The Controller gives general authorisation for the Processor to use sub-processors. The current list is in Annex 3 and at /subprocessors.
- The Processor will tell the Controller by email at least 30 days before adding or replacing a sub-processor.
- The Controller may object on reasonable data protection grounds within that period. If the parties cannot agree, the Controller may close its account and receive a refund of unused paid Credits.
- The Processor puts the same data protection duties in a written contract with each sub-processor. The Processor stays responsible for its sub-processors.
7. Transfers outside the EEA
The Processor only transfers Customer Personal Data outside the EEA where Chapter V of the GDPR is met, by an adequacy decision (including the EU-US Data Privacy Framework) or the Standard Contractual Clauses. Annex 3 shows the safeguard for each sub-processor.
8. Help to the Controller
- Data subject requests. If a data subject contacts the Processor about Customer Personal Data, the Processor passes the request to the Controller within 5 business days and helps the Controller answer it. Where a person asks not to be called, the Processor also adds the number to its do-not-call list (see clause 11).
- Other duties. The Processor gives reasonable help with security (Art. 32), breach notices (Art. 33 and 34), data protection impact assessments and prior consultation (Art. 35 and 36). Help is free within reason. For large requests, the Processor may charge its reasonable costs, agreed in advance.
9. Personal data breaches
The Processor tells the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice includes what is known at the time: what happened, the data and people affected, likely effects, and the steps taken. The Processor adds more information as it learns it.
10. End of processing
- When the account closes, or when the Controller asks, the Processor deletes Customer Personal Data, unless the law requires it to keep it. Before deletion, the Controller can download its Results from the portal.
- Deletion happens within 30 days of the account closing or the request. Backups are overwritten on their normal cycle, within 30 days.
- Internal call data (call logs and notes in the calling system) for numbers the Processor did not already hold is deleted or anonymised within 30 days after the Results are delivered. Call recordings are deleted within 90 days.
11. Processor acting as controller
The Processor processes some data for its own purposes, as a controller, and not on the Controller's behalf:
- Do-not-call list. If a person asks not to be called, the Processor keeps their number on its own do-not-call list and will not call it again for any customer. Numbers on this list are not dialled and not charged.
- Phone validity data. The Processor keeps a record that a number did or did not reach a named person, with the date and result. Some of this comes from Profitbl's own sales outreach work.
- Reuse of a prior Result. Where the Processor has already checked the same number for the same person in the last 12 months, it may return that prior Result instead of calling again.
The Processor is the controller for this processing and is responsible for it under the GDPR. It is described in the Answrd Privacy Policy.
12. Information and audits
- The Processor gives the Controller the information needed to show it meets Article 28.
- The Processor may first answer a written questionnaire. If that is not enough, the Controller may audit once a year, with 30 days' written notice, during business hours, at its own cost, and under confidentiality. An independent auditor bound by confidentiality may do the audit.
13. Controller duties
The Controller confirms that:
- it has a lawful basis for the processing and for having the numbers checked;
- it has given data subjects the information required by Articles 13 and 14 GDPR;
- Lists contain business contacts only, and no special category data;
- its instructions comply with data protection law.
14. Liability, term and law
- The liability terms of the Terms of Service apply to this DPA, to the extent the GDPR allows.
- This DPA lasts as long as the Processor processes Customer Personal Data.
- This DPA is governed by Luxembourg law. The courts of Luxembourg City have jurisdiction.
Annex 1. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Checking that business phone numbers reach the named person, and returning a Result for each number |
| Duration | For as long as the Customer uses the Service, plus the deletion period in clause 10 |
| Nature of the processing | Storing Lists in the portal. Network (HLR) lookup to see if a number exists. Calls by a human verifier, up to 5 attempts per number. Call recording for quality and proof. Recording the call outcome. Assigning a Result. Making the Results file available for download |
| Purpose | To give the Customer a Result for each number: P1, P2, P3, Bad or Invalid number |
| Data subjects | Business contacts of the Customer: people at prospect companies, in their work role |
| Categories of personal data | First name, last name, job title, company, phone number. Call outcome and Result. What is heard on the call or the voicemail greeting (for example, the person's name). Call recordings. Call logs (date, time, duration, attempts) |
| Special category data | None. The Customer must not upload any |
| Frequency | Continuous, for each List uploaded |
| Retention | See clause 10 |
| Place of processing | Calls are made from the EU. Other locations: see Annex 3 |
Annex 2. Security measures
| Area | Measure |
|---|---|
| Access control | Sign-in with work email and password, or one-time email link. Staff and verifiers get only the access they need |
| Customer separation | Database row-level security rules: each Customer sees only its own Lists, Results, Credits and invoices |
| Encryption | Data encrypted in transit (TLS) and at rest by the database provider |
| Verifier controls | Verifiers see only the name, job title, company and number needed for the call. Verifiers are bound by confidentiality |
| Logging | Account and credit activity is logged in the database |
| Backups | Daily backups by the database provider, overwritten within 30 days |
| Incident handling | Breaches go to the privacy contact (hello@answrd.co), who handles notice under clause 9 |
| Supplier checks | Sub-processors are chosen for their security and bound by a written data processing agreement |
| Deletion | Deletion on account closure and on request, under clause 10 |
| Certifications | Profitbl holds no security certification. Several sub-processors hold their own (for example SOC 2 or ISO 27001) |
Annex 3. Sub-processors
See the current list at /subprocessors. It forms part of this DPA.