# Data Processing Agreement URL: https://promu.ai/dpa Last updated: 2026-10-05 > How Promu processes personal data on your behalf, as required by Article 28 of the GDPR. **Data processing agreement.** How Promu processes personal data on your behalf, as required by Article 28 of the GDPR. Last updated 5 October 2026. ## 1. Parties and scope This Data Processing Agreement (“DPA”) is between you, the customer (“Controller”), and Acosh, trading as Promu, registered with the Dutch Chamber of Commerce (KvK) under number 86582992 (“Promu” or “Processor”). It forms part of our [Terms of Service](https://promu.ai/terms) and applies whenever Promu processes personal data on your behalf while providing the Service. Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them in the GDPR. ## 2. Roles For personal data in Your Data, such as your contacts, prospects, email content and replies, you are the controller and Promu is the processor. You are responsible for having a lawful basis for that data and for the instructions you give. For Lead Data and for data about your own account and billing, Promu acts as an independent controller, as described in our [Lead Data Terms](https://promu.ai/lead-data-terms) and [Privacy Policy](https://promu.ai/privacy). ## 3. Instructions Promu processes personal data only on your documented instructions, which are this DPA, the Terms of Service and the way you configure and use the Service. If we believe an instruction breaches the law, we will tell you. ## 4. Confidentiality Everyone at Promu who can access personal data is bound by confidentiality and only has access where their work requires it. ## 5. Security Promu takes appropriate technical and organisational measures to protect personal data, taking into account the risks involved. These include encryption in transit, access controls based on least privilege, separation of customer data, logging of access to production systems and regular reviews of those measures. ## 6. Subprocessors You authorise Promu to use subprocessors, such as hosting and email infrastructure providers, to provide the Service. Promu imposes data protection obligations on each subprocessor that are at least as protective as this DPA and remains responsible for them. The current list of subprocessors is available on request at support@promu.ai. We will tell you at least 30 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we cannot resolve it, you may end the affected part of the Service. ## 7. Location of data Promu stores and processes personal data in the European Union only. We will not transfer it outside the European Economic Area without your prior written agreement and appropriate safeguards, such as the EU Standard Contractual Clauses. ## 8. Helping you meet your obligations Promu will help you, where reasonable, to respond to requests from data subjects, such as requests for access, deletion or objection, and with data protection impact assessments and consultations with supervisory authorities. If a data subject contacts us directly about Your Data, we will forward the request to you. ## 9. Personal data breaches Promu will notify you without undue delay after becoming aware of a personal data breach affecting Your Data, with the information you reasonably need to meet your own notification duties, and will take reasonable steps to limit its impact. ## 10. Deletion and return You can export Your Data while your account is active. When the agreement ends, Promu deletes Your Data within a reasonable period, unless the law requires us to keep it. ## 11. Audits Promu will make available the information you reasonably need to show compliance with Article 28 of the GDPR and will contribute to audits by you or an auditor you appoint, with reasonable notice, at most once a year and subject to confidentiality, unless a supervisory authority requires otherwise. ## 12. Details of the processing - Subject matter and purpose: providing the Service, including finding and researching leads, writing and sending emails, handling replies and syncing with Connected Accounts. - Duration: for as long as you use the Service, plus the deletion period above. - Data subjects: your prospects, contacts and recipients, and your own users. - Categories of personal data: names, business email addresses, job titles, company details, email content and replies, and other data you choose to bring into Promu. - Special categories: none. You must not bring special categories of personal data into Promu. ## 13. Order of precedence If this DPA conflicts with the Terms of Service on the protection of personal data, this DPA applies. Dutch law governs this DPA.