Data Processing Addendum

Harry The Marketer · Last updated 6 August 2026

The short version: for the prospect data you upload, you are the controller and we are your processor. We process it only on your instructions, keep it confidential, use the sub-processors listed publicly, help you answer data-subject requests, notify you of breaches without undue delay, and delete it when you leave.

This Addendum forms part of the Terms of Service between you (“Controller”) and Elnakeeb Pty Ltd (“Processor”) and applies whenever we process personal data on your behalf. Customers who need a countersigned copy, or the Standard Contractual Clauses executed separately, should contact privacy@harrythemarketer.com.

1. Scope of processing

Subject matter	Providing the lead-generation and outreach platform
Duration	The term of your subscription, plus the deletion window in §7
Nature and purpose	Storage, enrichment, email composition and delivery, reply retrieval and classification, reporting
Types of personal data	Business contact details (name, work email, employer, job title), notes you add, email correspondence with those contacts, engagement events
Categories of data subject	Your prospects and contacts; your own team members

You must not upload special-category data, payment card numbers, health data, or government identifiers. The platform is not designed for them.

2. Our obligations

Process personal data only on your documented instructions, including the instruction inherent in your use of the product
Ensure people authorised to process it are bound by confidentiality
Implement appropriate technical and organisational measures (see Security)
Assist you, so far as reasonably possible, with data-subject requests, impact assessments, and regulator consultations
Make available the information needed to demonstrate compliance and allow audits on reasonable notice, no more than once a year unless a regulator requires otherwise

3. Your obligations

Ensure you have a lawful basis to process and to contact every person you upload
Provide any notice and obtain any consent your law requires
Keep your instructions lawful; we will tell you if an instruction appears to breach data-protection law

4. Sub-processors

You give general authorisation for the sub-processors listed at /sub-processors. We will give notice before adding a new one, and you may object on reasonable data-protection grounds — if we cannot resolve the objection you may terminate the affected service and receive a pro-rata refund. Each sub-processor is bound by terms no less protective than these.

5. International transfers

Where personal data is transferred out of the UK, EEA, or another restricted jurisdiction, we rely on an adequacy decision or the Standard Contractual Clauses with any required supplementary measures.

6. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information available to us, and will keep you updated as we investigate.

7. Return and deletion

You can export or delete your data at any time from the product. On termination we delete workspace content within 30 days, other than copies in encrypted backups which age out on the backup cycle, and anything we must retain by law.

8. Precedence

If this Addendum conflicts with the Terms of Service on the processing of personal data, this Addendum prevails.