Data Processing Agreement

Version 0.1, 9 November 2026.

Our solicitor is reviewing this document. Any change will be published here with a new version date.

Recon is a service of ALPN Digital Ltd.

This Data Processing Agreement (the DPA) is made between:

ALPN Digital Ltd, a company registered in England and Wales with company number 17062799, whose registered office is at Gorsuch Place, Shoreditch Exchange, Senna Building, London, E2 8JF (ALPN); and
[Customer legal name], a company registered in [country] with company number [number], whose registered office is at [address] (the Customer).

This DPA forms part of the Master Services Agreement between ALPN and the Customer (the Agreement). It binds the parties from the date the first Order Form under the Agreement is signed.

Background

A. ALPN provides the Service to the Customer under the Agreement. The Service is a managed sales development service. ALPN's team, using Recon's software and AI, finds and researches prospects, writes and sends email and LinkedIn messages from the Customer's mailboxes in the sender's voice, handles replies in the mode the Customer chooses, and books meetings into the calendars of the Customer's people.

B. Providing the Service involves personal data. Some of it the Customer supplies. Some of it ALPN sources itself. Some of it is ALPN's own account data. The parties have different roles for each kind, and this DPA sets out those roles and the duties that go with them.

1. Definitions and interpretation

1.1 Capitalised terms not defined in this DPA have the meaning given in the Agreement.

1.2 In this DPA:

Data Protection Laws means, in each case as amended or replaced from time to time and to the extent they apply to a party's processing: (a) the UK GDPR and the Data Protection Act 2018; (b) the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR); (c) Regulation (EU) 2016/679 (the EU GDPR); and (d) the national laws of EU member states that implement Directive 2002/58/EC (the ePrivacy Directive).
UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Supervisory Authority have the meanings given in the UK GDPR or, where the EU GDPR applies, the EU GDPR. "Process" and "processed" are read in the same way.
Customer Personal Data means the Personal Data in category (a) of the Data Roles Table in clause 2.
Prospect Data means the Personal Data in category (b) of the Data Roles Table in clause 2.
ALPN Account Data means the Personal Data in category (c) of the Data Roles Table in clause 2.
Sub-processor means a third party that ALPN engages to Process Customer Personal Data on ALPN's behalf.
Sub-processor List means the list of Sub-processors in Annex 4, as updated under clause 7.
Anonymised Insights has the meaning given in clause 16.
Restricted Transfer means a transfer of Personal Data that, under Data Protection Laws, may take place only if appropriate safeguards are in place.
Working Day means a day other than a Saturday, Sunday or public holiday in England.

1.3 If this DPA and the rest of the Agreement conflict on a matter of data protection, this DPA prevails.

1.4 Clause headings do not affect interpretation. "Including" means "including without limitation".

2. Data roles

2.1 The parties agree the roles in the table below (the Data Roles Table). Each party will act in line with the role given to it for each category.

Category	What it covers	Customer's role	ALPN's role	Clauses that apply
(a) Customer-supplied data	The Customer's CRM records; the Customer's users of the Service and its senders; the Customer's do-not-contact list; lists the Customer uploads; replies and threads in the Customer's mailboxes and the senders' LinkedIn accounts; meetings booked into the calendars of the Customer's people	Controller	Processor	Clauses 3 to 13
(b) Prospect data ALPN sources itself	Details of prospects that ALPN finds through data providers (Findymail, LeadMagic, MoltSets and, if live, Apollo), Companies House officer data and public websites, together with the research ALPN builds on them	To confirm: no role if ALPN is sole controller, or joint controller with ALPN for the outreach (see clause 14).	To confirm: ALPN is likely controller, or joint controller with the Customer for the outreach.	Clause 14
(c) ALPN's own account data	Data ALPN holds about the Customer's users to run their accounts, sign-in, billing, support and service messages	Not applicable	Controller	Clause 15

2.2 Boundary between (a) and (b). A prospect may start as Prospect Data and then reply to a message sent from the Customer's mailbox, or be added to the Customer's CRM. From that point:

(a) the reply, the thread and the CRM record are Customer Personal Data, and the Customer is their Controller; and

(b) the record ALPN sourced remains Prospect Data, which ALPN keeps only as far as clause 14 allows, including so that do-not-contact entries and objections continue to be honoured across the Service.

2.3 Each party is responsible for its own compliance with Data Protection Laws in its own role. Nothing in this DPA makes ALPN a Processor of Prospect Data or of ALPN Account Data.

3. ALPN as Processor: instructions

3.1 Clauses 3 to 13 apply only to Customer Personal Data.

3.2 ALPN will Process Customer Personal Data only on the Customer's documented instructions. This includes instructions about Restricted Transfers. The only exception is where the law of the UK (or, where the EU GDPR applies, EU or member state law) requires ALPN to do otherwise. In that case ALPN will tell the Customer before it Processes. It need not do so if that law forbids it on important grounds of public interest.

3.3 The Customer's documented instructions are: (a) the Agreement, including this DPA and each Order Form; (b) the plan, messaging, offers and reply mode the Customer signs off for each Operation; and (c) any further written instructions the Customer gives through the Service or by email that are consistent with the Agreement.

3.4 ALPN will tell the Customer promptly if, in ALPN's opinion, an instruction infringes Data Protection Laws. ALPN may pause the affected processing until the Customer confirms or changes the instruction.

3.5 Annex 1 sets out the subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects.

4. The Customer's obligations

4.1 The Customer:

(a) is responsible for having a lawful basis, and for giving any notices and obtaining any consents that Data Protection Laws require, for the Customer Personal Data it supplies or makes available to ALPN, including its own lists and CRM records;

(b) will make sure its instructions comply with Data Protection Laws;

(c) will not supply special category data, criminal offence data or data about children, unless the parties first agree in writing how that data will be handled; and

(d) will keep its do-not-contact list accurate and up to date in the Service, or tell ALPN of changes promptly.

5. Confidentiality of personnel

5.1 ALPN will make sure that everyone it authorises to Process Customer Personal Data is under a duty of confidentiality, by contract or by law, and Processes it only as needed to provide the Service.

6. Security

6.1 ALPN will put in place and maintain appropriate technical and organisational measures to protect Customer Personal Data, as Article 32 of the UK GDPR (and, where it applies, the EU GDPR) requires. The measures at the date of this DPA, and those that are planned, are in Annex 2.

6.2 ALPN may change the measures from time to time, but will not reduce the overall level of protection.

7. Sub-processors

7.1 General authorisation. The Customer gives ALPN general authorisation to engage Sub-processors. The Sub-processors in use at the date of this DPA are in the Sub-processor List.

7.2 Notice of changes. ALPN will give the Customer at least 30 days' written notice before it adds or replaces a Sub-processor. The notice will name the Sub-processor, say what it will do, and say where it will Process Customer Personal Data. Notice may be given by email to the address the Customer gives for notices under the Agreement.

7.3 Right to object. The Customer may object to a new Sub-processor on reasonable data protection grounds by written notice within the 30-day notice period. If it does, the parties will discuss the objection in good faith. If they cannot resolve it within [30] days of the objection, the Customer may end the part of the Service that depends on that Sub-processor by written notice, with the effect on fees and credits set out in the Agreement.

7.4 Urgent replacement. If ALPN must replace a Sub-processor urgently for reasons of security or continuity of the Service, ALPN may give shorter notice. ALPN will give as much notice as it can and explain the reason. The Customer's right to object under clause 7.3 still applies.

7.5 Flow-down. ALPN will put a written contract in place with each Sub-processor that imposes data protection obligations that give at least the same protection as this DPA, as far as they apply to the services that Sub-processor provides.

7.6 Responsibility. ALPN remains liable to the Customer for the performance of each Sub-processor's data protection obligations, subject to the limits in the Agreement.

7.7 The Customer's own tools. Tools the Customer connects to the Service under its own contract with the vendor (for example its CRM) are not Sub-processors of ALPN. The Customer is responsible for its contract with those vendors. They are listed for information in section (c) of the Sub-processor List.

8. International transfers

8.1 ALPN will not make a Restricted Transfer of Customer Personal Data, or allow a Sub-processor to make one, unless a transfer mechanism recognised by Data Protection Laws is in place. Annex 3 sets out the mechanisms the parties rely on.

8.2 Where the parties rely on a transfer mechanism that needs to be signed or incorporated, it is incorporated into this DPA by reference as described in Annex 3.

9. Data subject rights

9.1 Taking into account the nature of the Processing, ALPN will help the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests from Data Subjects to exercise their rights under Data Protection Laws.

9.2 If ALPN receives a request directly from a Data Subject about Customer Personal Data, ALPN will tell the Customer within [5] Working Days and will not respond to the request except to say that it has been passed to the Customer, unless the Customer instructs otherwise or the law requires it.

9.3 A request to stop receiving messages is an objection. ALPN will add the person to the do-not-contact list in the Service straight away, and will tell the Customer through the Service. Clause 14.2(e) sets the same rule for Prospect Data.

10. Personal Data Breaches

10.1 ALPN will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

10.2 The notice will give, as far as ALPN then knows: (a) the nature of the breach, including the categories and approximate numbers of Data Subjects and records concerned; (b) a contact point for more information; (c) the likely consequences; and (d) the measures taken or proposed to deal with the breach and reduce its effects. Where ALPN does not know all of this at first, it will give the information in phases as it becomes available.

10.3 ALPN will take reasonable steps to contain, investigate and reduce the effects of the breach, and will co-operate with the Customer.

10.4 The Customer decides whether to notify a Supervisory Authority or Data Subjects about a breach of Customer Personal Data. ALPN will not do so on the Customer's behalf unless the Customer asks it to or the law requires it.

10.5 A notice under this clause 10 is not an admission of fault or liability.

11. Other assistance

11.1 Taking into account the nature of the Processing and the information available to it, ALPN will give the Customer reasonable help with its obligations under Articles 32 to 36 of the UK GDPR (and, where it applies, the EU GDPR), namely security, breach notification, data protection impact assessments and prior consultation with a Supervisory Authority.

11.2 ALPN may charge for help under clause 11.1 at reasonable rates agreed in advance, except where the help is needed because of ALPN's breach of this DPA.

12. Export and deletion

12.1 Export at any time. The Customer may export its Customer Personal Data at any time during the term, through the Service or by asking ALPN. ALPN will provide the export in a commonly used, machine-readable format.

12.2 Export at the end. When the Agreement ends, the Customer may ask for a full export. ALPN will provide it if the request arrives before the deletion date in clause 12.3.

12.3 Deletion. ALPN will delete Customer Personal Data 30 days after the Agreement ends, unless the Customer asks otherwise in writing before then, or the law requires ALPN to keep it. ALPN will confirm deletion in writing on request.

12.4 Backups. Copies in backups held by ALPN's database provider will be deleted when those backups expire in the normal cycle. Until then they will remain protected under this DPA and will not be used. [Backup retention period to confirm.]

12.5 What may be kept. Deletion under clause 12.3 does not apply to: (a) Anonymised Insights, which are not Personal Data; (b) the minimum details needed to keep honouring do-not-contact entries and objections, which ALPN holds under clause 14; and (c) records the law requires ALPN to keep.

13. Information and audits

13.1 ALPN will make available to the Customer all information reasonably needed to show compliance with Article 28 of the UK GDPR (and, where it applies, the EU GDPR) and this DPA.

13.2 Questionnaire. Once in any 12-month period, the Customer may send ALPN a reasonable written security and data protection questionnaire. ALPN will answer it fully and accurately within [30] days.

13.3 Inspection. The Customer, or an independent auditor it appoints who is bound by confidentiality, may also inspect ALPN's relevant processes and records. It may do so only where:

(a) ALPN's answers under clause 13.2 do not reasonably show compliance;

(b) there has been a Personal Data Breach affecting Customer Personal Data; or

The Customer must give at least [30] days' written notice of an inspection, unless a Supervisory Authority requires less. The inspection takes place during business hours and without undue disruption. The Customer pays its cost.

13.4 Inspections do not extend to Sub-processors' premises. ALPN will instead pass on the information its Sub-processors make available.

14. Prospect Data: allocation of duties

Drafting note: the controller position for Prospect Data is to be confirmed with the solicitor. This clause allocates duties so that it works whether ALPN is sole controller or joint controller with the Customer. If the parties are joint controllers, this clause is intended to be their arrangement under Article 26 of the UK GDPR (and, where it applies, the EU GDPR).

14.1 Who decides what. The Customer decides who it wants to reach and the offer for each Operation. ALPN decides which data providers and public sources to use, what data to collect, and how the research is done.

14.2 ALPN's duties. For Prospect Data, ALPN will:

(a) Legitimate interests assessment: carry out, record and keep up to date a legitimate interests assessment for sourcing Prospect Data and for the outreach, and share a summary with the Customer on request;

(b) Transparency: make sure each first message to a prospect includes, in its footer, a short notice or a link to a privacy notice that says who is contacting them, where their details came from, and how to object, and keep that privacy notice published and accurate;

(c) Targeting rules: apply targeting rules that follow PECR and Data Protection Laws, including by excluding individual subscribers (such as sole traders and some partnerships) unless they have given prior consent, and by applying the ePrivacy rules of the country concerned for EU prospects;

(d) Opt-out: include a simple way to opt out in every message;

(e) Objections and do-not-contact: check the do-not-contact list before anyone is added to an Operation, add anyone who objects or opts out to it straight away, tell the Customer through the Service, and honour that entry across the whole Service;

(f) Data subject requests: be the contact point for prospects who want to exercise their rights over Prospect Data, at hello@get-recon.com, and deal with those requests;

(g) Accuracy and minimisation: collect only what is needed for the outreach and correct or delete inaccurate data when it learns of it; and

(h) Retention: keep Prospect Data only for as long as it needs it for the Service [retention period to confirm], except the minimum details needed to keep honouring do-not-contact entries and objections.

14.3 The Customer's duties. For Prospect Data, the Customer will:

(a) give ALPN accurate information about its offers and claims, and sign off the messaging before launch;

(b) pass to ALPN within [2] Working Days any objection, opt-out or rights request about Prospect Data that reaches the Customer directly;

(d) not ask ALPN to contact anyone the Customer knows has objected to contact from it.

14.4 Essence of the arrangement. If the parties are joint controllers, ALPN will make the essence of this clause 14 available to Data Subjects through its privacy notice.

14.5 Breaches. If either party becomes aware of a Personal Data Breach affecting Prospect Data processed for the Customer's Operations, it will tell the other party without undue delay and the parties will co-operate on any notification.

14.6 Co-operation. Each party will give the other reasonable help to meet its obligations for Prospect Data, including on requests from a Supervisory Authority.

15. ALPN Account Data

15.1 ALPN is the Controller of ALPN Account Data. ALPN Processes it under its own privacy notice to run accounts, provide sign-in and support, send service messages, bill, and keep the Service secure.

16. Anonymised service improvement

This clause 16 is separate from the rest of this DPA. The Customer may opt out of it in the Order Form.

16.1 What ALPN may do. ALPN may create aggregated, anonymised learnings from data processed in the Service (Anonymised Insights), and use them to improve the Service for all its customers. Examples are which message lengths, subject line structures, timings and sectors tend to produce replies and meetings.

16.2 What Anonymised Insights never contain. Anonymised Insights never contain names, email addresses, message content, or any other information that identifies, or could reasonably be used to identify, a person or the Customer.

16.3 ALPN's role. To the extent that creating Anonymised Insights involves Processing Customer Personal Data, ALPN does so as a Controller for that step alone, on the basis of its legitimate interests. Once data is anonymised it is no longer Personal Data.

16.4 Opt-out. The Customer may opt out by ticking the box in its Order Form. It may also opt out later by written notice to ALPN. If its Agreement does not include this clause 16, the Customer is treated as having opted out from the start. From the date of the opt-out:

(a) ALPN will not use the Customer's data to create Anonymised Insights; and

(b) cross-customer learning is switched off for the Customer: the Customer's data does not feed learnings shared with other customers, [and ALPN does not apply learnings drawn from other customers to the Customer's Operations].

16.5 Insights already made. Anonymised Insights created before an opt-out cannot be traced back to the Customer and do not need to be deleted.

16.6 Severability. This clause 16 is severable. If any part of it is found invalid or unenforceable, or the parties remove it, the rest of this DPA and the Agreement continue in full force, and ALPN will treat the Customer as having opted out under clause 16.4.

17. Liability

17.1 Each party's liability under or in connection with this DPA is subject to the limits and exclusions of liability in the Agreement, except where the Agreement or Data Protection Laws say otherwise.

17.2 Nothing in this DPA limits either party's liability to Data Subjects or to a Supervisory Authority where Data Protection Laws do not allow it to be limited.

18. Term, changes and general

18.1 This DPA continues for as long as ALPN Processes Personal Data in connection with the Agreement, and clauses 12, 14 and 16 survive its end as far as needed.

18.2 ALPN may update this DPA to reflect changes in Data Protection Laws or in the Service, by giving notice under the change provisions of the Agreement. ALPN will not make a change that reduces the protection given to Customer Personal Data without the Customer's written agreement.

18.3 If a change in Data Protection Laws makes any part of this DPA non-compliant, the parties will negotiate in good faith to amend it.

18.4 This DPA is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising from it, except where Annex 3 requires a transfer mechanism to be governed by other law.

Annex 1: Details of the Processing

This Annex covers Customer Personal Data (category (a)), where ALPN is the Processor. Part B gives details of Prospect Data for information.

Part A: Customer Personal Data

Item	Details
Subject matter	Providing the Service under the Agreement.
Duration	The term of the Agreement, plus up to 30 days after it ends (clause 12), plus any backup expiry period.
Nature of the Processing	Collecting data through connections the Customer authorises (CRM, mailboxes, calendars, LinkedIn accounts of senders) and through uploads; storing, organising and matching it; analysing it with AI models to draft messages, check quality, classify replies and score fit; sending messages and replies from the Customer's mailboxes and the senders' accounts; booking meetings; reporting in the live portal; exporting and deleting.
Purpose	To provide the Service to the Customer, including checking the do-not-contact list, handling replies in the reply mode the Customer chooses (Co-pilot or Autopilot), and reporting.
Categories of Data Subjects	The Customer's users of the Service and its senders; contacts, customers and prospects in the Customer's CRM and uploaded lists; people on the Customer's do-not-contact list; people who reply to messages sent for the Customer; people who book or attend meetings with the Customer's people.
Types of Personal Data	Names, job titles, employer, business contact details (work email, phone, LinkedIn profile URL); CRM records (contacts, companies, deals, notes, activity); message content, replies and threads; meeting details and calendar information on the times when a person is free or busy; sender details (name, email address, signature, writing style notes); user sign-in and usage data.
Special category data	None intended. The Customer must not supply it without prior written agreement (clause 4.1(c)).
Frequency	Continuous during the term.
Retention	As in clause 12.

Part B: Prospect Data (for information; ALPN is not a Processor of this data)

Item	Details
Sources	Data providers (Findymail, LeadMagic, MoltSets and, if live, Apollo), Companies House officer data, public websites and public business listings.
Categories of Data Subjects	Business contacts at organisations that match the Customer's chosen targets.
Types of Personal Data	Name, job title, employer, work email address, LinkedIn profile URL, and research about the person's role and organisation drawn from public sources.
Purpose	Business-to-business outreach about the Customer's offers in each Operation.

Annex 2: Security measures

This Annex lists only measures that are in place at the date of this DPA, or that are planned and labelled as planned. ALPN does not hold ISO 27001, SOC 2 or Cyber Essentials certification. ALPN is working towards Cyber Essentials.

In place

Separation between customers. Each customer's data is tagged with its own client identifier, and the Service is designed so that database queries are filtered by that identifier, to keep one customer's data apart from another's.
Encryption in transit. Data travels between users, the Service and Sub-processors over encrypted connections (TLS).
Encryption at rest. Data is encrypted at rest using the default encryption of ALPN's hosting and database providers.
Access control. Users sign in to the Service. Access is role-based: what a user can see and do depends on their role and the customer account they belong to. ALPN staff access is limited to people who need it to run the Service.
Backups. ALPN's database provider takes backups of the main database.
Hosting region. The main database and the server-side systems are hosted in Frankfurt, Germany (see the Sub-processor List).
Staff confidentiality. Everyone at ALPN who can access Customer Personal Data is bound by a duty of confidentiality (clause 5).
Do-not-contact check. The do-not-contact list is checked before anyone is added to an Operation, and opt-outs are honoured across the Service.

Planned (not yet in place)

Audit logging. A log of significant actions by users and staff. Planned.
Key hashing and rotation. Hashing of stored access keys and a routine for rotating them. Planned.
Cyber Essentials. ALPN is working towards Cyber Essentials certification.

ALPN will update this Annex when a planned measure goes live.

Annex 3: International transfers

Where ALPN is. ALPN is established in the UK.
Transfers from the Customer to ALPN. Where the EU GDPR applies to the Customer and the Customer transfers Customer Personal Data to ALPN in the UK, the parties rely on the European Commission's adequacy decision for the UK, while it remains in force. [To confirm that the decision is in force at signature, and the fallback if it lapses.]
Transfers by ALPN to Sub-processors. Where ALPN or a Sub-processor makes a Restricted Transfer of Customer Personal Data, ALPN will rely on one of the following, as appropriate for each Sub-processor:

(a) UK adequacy regulations covering the destination country (or, for the EU GDPR, a European Commission adequacy decision);

(b) for transfers subject to the UK GDPR, the International Data Transfer Agreement (IDTA) issued by the Information Commissioner, or the International Data Transfer Addendum to the EU Standard Contractual Clauses (the UK Addendum);

(c) for transfers subject to the EU GDPR, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the EU SCCs), Module 3 (processor to processor) for transfers by ALPN to a Sub-processor, or Module 2 (controller to processor) where ALPN acts for the Customer in that capacity; or

(d) a certification of the recipient under a recognised framework (for example the UK Extension to the EU-US Data Privacy Framework), only where the recipient holds it.

Status. The mechanism for each Sub-processor is to confirm per vendor. ALPN will record the mechanism against each Sub-processor in the Sub-processor List once confirmed. Where a transfer impact assessment is needed, ALPN will carry it out and make a summary available on request.
Incorporation. Where the parties rely on the IDTA, the UK Addendum or the EU SCCs between themselves, those terms are incorporated by reference with the options to be completed in a schedule [to confirm with the solicitor].

Annex 4: Sub-processors

The Sub-processor List is the document "Sub-processor list" (/legal/sub-processors) in this contract pack, as updated under clause 7. It has four sections:

(a) Sub-processors that receive personal data;

(b) providers that receive no personal data from ALPN;

(d) planned Sub-processors, which ALPN will not use until it has given notice under clause 7.