Data Processing Agreement

Version effective: October 22, 2026

This Data Processing Agreement ("DPA") is between Fondoo ("Fondoo"), and the customer who agrees to the Fondoo Terms of Service ("Customer"). It forms part of the Terms and applies when Fondoo processes Customer Personal Data while providing the hosted Service.

Customers can accept this DPA by accepting the Terms. Customers who need a signed copy can request one at [email protected].

---

1. Definitions

• Data Protection Laws: all privacy and data protection laws that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the CCPA.
• Customer Personal Data: personal data that Customer (or its agents) submits to the Service, or that the Service collects for Customer, such as data about Customer's end customers, subscribers, site visitors, app users and support requesters.
• Personal Data Breach, controller, processor, data subject, processing, supervisory authority: as defined in the GDPR.
• SCCs: the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022).
• Sub-processor: a third party Fondoo engages to process Customer Personal Data.

2. Roles

• Customer is the controller of Customer Personal Data (or a processor acting for its own client, for example an agency). Fondoo is Customer's processor (or sub-processor).
• Under US state privacy laws, Fondoo acts as Customer's service provider or processor. Fondoo will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service, or combine it with other data except as those laws allow.
• Fondoo is the controller of its own account, billing and usage data about Customer, which its Privacy Policy covers.

3. Customer's responsibilities

Customer is responsible for:

• having a lawful basis for the processing and giving the required notices to data subjects;
• the accuracy of Customer Personal Data and the lawfulness of how it was collected;
• instructions given through AI agents and API keys Customer connects, which count as Customer's instructions;
• providers Customer connects itself (see section 7.4);
• not submitting special-category data, HIPAA-protected health information, full payment card numbers or government ID numbers, unless a feature is clearly built for it.

4. Fondoo's obligations

Fondoo will:

1. process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA, and Customer's use and configuration of the Service (including through its agents and API). Fondoo will tell Customer if it believes an instruction breaks Data Protection Laws;
2. ensure anyone authorized to process Customer Personal Data is bound by confidentiality;
3. implement the security measures in Annex 2;
4. follow section 7 on Sub-processors;
5. help Customer respond to data subject requests (section 5);
6. help Customer with security, breach notification, data protection impact assessments and prior consultations, taking into account the nature of processing and the information available to Fondoo;
7. delete or return Customer Personal Data at the end of the Service (section 9);
8. make available the information reasonably needed to show compliance with this DPA and allow audits (section 10).

5. Data subject requests

• The Service includes tools to find, export, correct and delete contact data and to manage unsubscribes and suppression.
• If Fondoo receives a request directly from one of Customer's data subjects, it will pass the request to Customer and won't respond itself except to say it was passed on, unless the law requires otherwise.
• Where the tools aren't enough, Fondoo will provide reasonable help.

6. Personal Data Breaches

Fondoo will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and aims to do so within 72 hours. The notice will include what Fondoo knows at the time (nature of the breach, likely consequences, measures taken), with updates as more becomes known. Notifying Customer is not an admission of fault.

7. Sub-processors

1. General authorization. Customer authorizes Fondoo to use the Sub-processors listed in Annex 3 and on Fondoo's Sub-processors page.
2. Changes. Fondoo will give at least 30 days' notice before adding or replacing a Sub-processor, by email to the account owner or in the dashboard.
3. Objections. Customer may object on reasonable data protection grounds within that notice period. The parties will try in good faith to resolve the objection. If they can't, Customer may cancel the affected sites or the Service, with no further charges after cancellation.
4. Customer-connected providers. Providers Customer connects itself (for example its AI agent or AI key, its own Stripe account, Shopify, WordPress, social networks, support desks or email services) act on Customer's behalf under Customer's own agreements. They are not Fondoo's Sub-processors, and Fondoo is not responsible for them. When Customer's agent reads data through the MCP connection or API, that data goes to the agent's provider at Customer's direction.
5. Flow-down. Fondoo will have a written agreement with each Sub-processor with data protection obligations that are substantially as protective as this DPA, and remains responsible for its Sub-processors' performance as required by Data Protection Laws.

8. International transfers

1. Fondoo is based in the United States and processes Customer Personal Data mainly in the United States.
2. EU/EEA transfers. Where the processing involves a transfer of personal data from the EU or EEA to a country without an adequacy decision, the SCCs are incorporated by reference and apply as follows:
   • Module Two (controller to processor) where Customer is a controller; Module Three (processor to processor) where Customer is a processor;
   • Clause 7 (docking clause) applies;
   • Clause 9(a): Option 2 (general written authorization), with the notice period in section 7.2 of this DPA;
   • Clause 11(a): the optional language does not apply;
   • Clause 13: the supervisory authority is the one competent for Customer, or as determined under Clause 13;
   • Clauses 17 and 18: the law and courts of Ireland;
   • Annex I is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by Annex 3.
3. UK transfers. The UK Addendum applies, completed with the information in this DPA. Table 4: either party may end the Addendum as set out in its Section 19.
4. Swiss transfers. The SCCs apply with these changes: the competent authority is the Swiss Federal Data Protection and Information Commissioner; references to the GDPR include the Swiss FADP; and "Member State" includes Switzerland so Swiss data subjects can enforce their rights there.
5. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

9. Deletion and return

• Customer can export its data at any time using the Service's export tools.
• After the Service ends, Customer has 30 days to export. Fondoo then deletes Customer Personal Data within the following 30 days, and deleted data ages out of backups within 14 days days, unless the law requires Fondoo to keep it.
• Fondoo may keep minimal suppression records (for example, addresses that unsubscribed or complained) where needed to keep honoring them.

10. Audits

• Fondoo does not hold third-party security certifications. On request (no more than once a year, unless a breach or a supervisory authority requires more), Fondoo will answer a reasonable written security questionnaire and provide relevant documentation.
• If that isn't enough to show compliance, Customer may conduct an audit on at least 30 days' written notice, during business hours, at Customer's cost, by an auditor bound by confidentiality, in a way that doesn't disrupt the Service or expose other customers' data.

11. Liability and precedence

• Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the SCCs don't allow that.
• If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. The SCCs prevail over both.
• This DPA lasts as long as Fondoo processes Customer Personal Data.

---

Annex 1: Description of the processing

Data exporter: Customer (contact details as in its Fondoo account). Role: controller or processor. Data importer: Fondoo, [email protected]. Role: processor.

Annex 2: Security measures

Fondoo is a small business and aims to apply the following measures. They may change over time, but not in a way that materially reduces overall protection.

Access and accounts

• Access to production systems and Customer Personal Data limited to the owner and any personnel who need it, under confidentiality obligations.
• Passwords stored hashed. Two-factor authentication available, and workspaces can require it.
• Scoped API keys; an agent creating a new API key needs owner approval; keys can be revoked at any time.
• Session management and the ability to end sessions.

Agent safeguards

• Preview (dry-run) for write actions.
• Human approval for actions that delete data, spend money or email a list; spending caps set only by humans.
• Agents can't refund, pay out or move money.
• An audit log of every agent and API action, available for export.

Data protection

• Encryption in transit (TLS) for traffic to the Service.
• Encryption at rest provided by our hosting and database providers.
• Third-party connection keys encrypted at rest and never returned in full.
• Logical separation of each customer's workspace data.

Infrastructure and operations

• Hosting on established cloud providers (see Annex 3).
• Web application firewall, rate limiting and bot protection through Cloudflare.
• Error monitoring and alerting.
• Regular backups and periodic restore tests.
• Dependency updates and a security review before launch and after major changes.
• Incident response runbooks.

Email and abuse

• Automatic suppression of bounced, complained and unsubscribed addresses.
• Double opt-in for newsletters and one-click unsubscribe.
• Posting caps and abuse monitoring.

Deletion

• Export and deletion tools for contact data; deletion of workspace data after the Service ends, as in section 9.

Annex 3: Sub-processors

The current list is on the Sub-processors page. At the effective date of this DPA it is: