Data processing agreement
Last updated 25 October 2026
This agreement forms part of the terms of service between [Company name] Ltd, trading as Gridline ("we", the processor), and the business that holds a Gridline account ("you", the controller). It meets the requirements of Article 28 of the UK GDPR, and of the EU GDPR where that applies.
1. What we process
| Subject matter | Providing Gridline: storing leads, sending emails from your connected inboxes, reading replies, creating call tasks and keeping audit records. |
|---|---|
| Duration | For as long as you have an account, plus the deletion period in section 8. |
| Nature and purpose | Storage, organisation, sending and receiving of emails, classifying replies, and generating call lists, in each case to run your outreach as you instruct. |
| People concerned | Your leads and contacts, people who reply to your emails, and your own team members. |
| Types of personal data | Names, job titles, business email addresses, phone numbers, company names, websites, notes, the content of emails sent and received, call outcomes, and any custom fields you import. You must not upload special category data (such as health information). |
2. Your instructions
We only process personal data on your documented instructions, which are these terms and how you use the app, unless the law requires otherwise. If we think an instruction breaks data protection law, we'll tell you. You're responsible for having a lawful basis for the data you upload and for the outreach you carry out.
3. Confidentiality
Everyone who can access your data for us is bound by confidentiality.
4. Security
We take appropriate technical and organisational measures to protect your data, including:
- encryption in transit (HTTPS/TLS) and encryption of stored inbox app passwords;
- hashed user passwords and secure, expiring login sessions;
- logical separation of each customer's data;
- restricted access to production systems;
- hosting in an EU data centre with a provider that holds recognised security certifications;
- an audit log of key actions in your account.
5. Sub-processors
You give general permission for us to use the sub-processors below. We'll tell you at least 14 days before adding or replacing one, by email or in the app, so you can object. If you object on reasonable grounds and we can't resolve it, you can end the agreement. We hold each sub-processor to data protection obligations equivalent to these.
| Provider | What they do | Where |
|---|---|---|
| Render Services, Inc. | Hosts the Gridline app and its database | Data stored in Frankfurt, Germany (EU) |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Takes subscription payments and stores card details | EU, UK and USA |
| Netlify, Inc. | Hosts this website | Global network, USA |
| Google LLC (Google Fonts) | Delivers the typeface used on our pages | Global network, USA |
| Anthropic, PBC | Powers Griddy's AI answers, if switched on. Receives your question and a summary of your account's setup, never lead names, email addresses or message content | USA |
| Adzuna | Searches job adverts when you use Growth signals with your own Adzuna key | UK |
6. International transfers
Your account data is hosted in the EU. Where a sub-processor processes data outside the UK or EEA, we make sure an adequacy decision or approved safeguard applies, such as the UK International Data Transfer Agreement or Addendum, or the UK–US data bridge.
7. Helping you
- Individuals' requests: the app lets you find, correct, export and erase a person's data and add them to your Do Not Contact list. If someone contacts us directly about your data, we'll pass the request to you.
- Breaches: we'll tell you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own reporting duties.
- Assessments: we'll give reasonable help with data protection impact assessments and with consultations with the ICO.
8. When the agreement ends
You can export your data while your account is open. When it closes, we delete your personal data within 30 days, and backups roll off within a further 30 days, unless the law requires us to keep something.
9. Audits
We'll provide the information reasonably needed to show we meet this agreement. Where that isn't enough, you can audit us once a year with 30 days' notice, at your cost, in a way that protects other customers' data and our security.
10. Liability
The limits of liability in the terms of service apply to this agreement, except where the law doesn't allow them to.
Contact
Data protection questions: hello@getgridline.net.