Data Processing Addendum

1. Scope and instructions

Processing lasts for the Order and the return or deletion period below. Its purpose is delivery of the agreed lead generation, outreach, automation or software services. Processing may include collection, organization, storage, retrieval, communication and deletion of business contact details, professional profiles, correspondence and client CRM records. Data subjects are client personnel, prospects, customers and supplier contacts. Sensitive data is excluded unless separately agreed with appropriate safeguards.

The Order records the parties and contacts, specific purposes, data categories, data subjects, frequency, locations and authorized providers. The client determines lawful purposes and instructions, provides required notices and establishes a lawful basis. Consistra processes only on documented instructions, including for transfers, unless required by law; where lawful we notify the client before such legally required processing. We promptly inform the client if an instruction appears to infringe applicable data protection law.

2. Confidentiality and security

Consistra restricts access to authorized recipients bound by confidentiality and implements measures appropriate to the risk, including transport encryption, access controls, data minimization, secure credential handling, recovery procedures and regular assessment of those measures. The Order’s security schedule records the controls and locations applicable to the engagement before processing starts. We do not use client personal data for our own marketing, sell or share it for advertising, combine it for unrelated purposes, or train or fine-tune AI models without the client’s prior written consent.

3. Assistance and incidents

• We promptly forward data subject requests and assist the client in responding, without responding ourselves except on its instructions or where law requires.
• We notify the client without undue delay after becoming aware of a personal data breach, provide available details of its nature, affected data, likely consequences and mitigation, and provide further details as they become available.
• We assist with security obligations, breach notifications, impact assessments and regulator consultations, taking account of the processing and information available to us.
• We provide information necessary to demonstrate compliance and allow reasonable audits and inspections by the client or its independent auditor, subject to confidentiality and protection of other clients’ data. Regulatory rights are not restricted.

4. Subprocessors and website providers

The client gives general written authorization for the providers identified for its engagement. We bind subprocessors to equivalent data protection obligations and remain responsible for their performance. Before adding or replacing a subprocessor we give at least 30 days’ written notice. The client may object on reasonable data protection grounds during that period. We work to resolve the objection, use an alternative, or allow termination of the affected processing before the change takes effect.

The following website inventory records uses evidenced by our implementation. Provider legal entities, processing locations and contractual safeguards are To be confirmed where indicated. Inclusion does not mean a provider receives client service data: website enquiries and bookings are normally controller activities. A provider is an authorized subprocessor only where the Order identifies that role and the required contractual and transfer safeguards are established.

Provider data locations, downstream recipients and applicable transfer arrangements are recorded in the engagement schedule before client data is shared. This list does not authorize unidentified email, CRM, AI, payment or transcription vendors. Ask [email protected] for the schedule applicable to your Order.

5. International transfers

We make restricted transfers only on documented instructions and with a valid transfer mechanism. Where required, the parties enter into the European Commission’s Standard Contractual Clauses (Decision 2021/914), using Module Two for controller-to-processor transfers or Module Three for processor-to-processor transfers as applicable. For UK restricted transfers, the UK International Data Transfer Addendum applies to the selected SCCs.

Before transfer, the parties complete the applicable SCC annexes and UK tables with the identities, processing description, competent authority, technical and organizational measures and subprocessors; assess transfer risks; and implement necessary supplementary measures. This public DPA does not claim that a completed SCC or UK Addendum already exists for every provider. Mandatory transfer terms prevail over conflicting provisions of the Order or this DPA. Transfers do not start until the applicable schedule and safeguards are in place.

6. Return, deletion and precedence

At the client’s choice, we return or delete client personal data after the engagement, normally within 30 days, and delete copies unless law requires retention. Retained data remains protected and is used only for that legal requirement; backup copies are isolated from ordinary use and removed under the agreed backup retention schedule. We confirm completion on request. The DPA prevails over conflicting general terms concerning processing; mandatory SCC and UK Addendum provisions take priority. Changes to a signed Order or DPA require written agreement.

7. Contact

For this DPA, processing instructions, subprocessor notices and transfer schedules, contact [email protected].