Data Processing Addendum (DPA)

Scope and roles

When you use Outlivo to send outbound campaigns, you are the Data Controller of the contact details and content of those emails, and Outlivo acts as the Data Processor.

We process recipient personal data (such as email address, first name, last name, and custom metadata fields) solely on your instructions and to provide, support, and troubleshoot the campaign features you configure.

Processor obligations

• Instructions: We will process personal data only in accordance with your documented instructions, including the campaign delivery settings you specify.
• Confidentiality: We ensure that all personnel authorized to access or process customer data are bound by strict confidentiality obligations.
• Security: We implement appropriate technical and organizational measures to safeguard recipient data against unauthorized access, loss, or alteration.
• Assistance: We will provide reasonable assistance to help you fulfill your obligations to respond to data subject requests under GDPR, CCPA, or other applicable laws.

Subprocessors

You grant us general authorization to engage subprocessors to provide database storage, application hosting, and operational notifications.

Our active subprocessors are listed on our dedicated Subprocessors page. We will notify users of any changes to our subprocessors, and all subprocessors are bound by data protection obligations no less restrictive than those in this DPA.

Gmail API and data separation

Because campaign sending is routed through your own connected Google accounts using the Gmail API, the delivery systems and mailbox infrastructure are managed directly by Google under your agreement with them.

Outlivo does not transfer or share your Gmail API credentials or recipient records for advertisements or profiling. All processing conforms strictly to Google's Limited Use rules.

Data transfers and breaches

• International Transfers: Where transfers of personal data cross regional borders, we apply standard contractual clauses or equivalent legal mechanisms approved by competent authorities.
• Breach Notification: In the event of a confirmed security incident affecting personal data processed on your behalf, we will notify you within 72 hours of verification and assist in mitigating any impact.

Deletion and termination

Upon deletion of your account or termination of the service, we will delete or anonymize all recipient data and campaign histories in our production databases within 30 days, unless applicable law requires longer retention.