Data Processing Addendum (DPA)

Last updated: October 9, 2026. For customers who accepted an earlier version, this DPA takes effect on November 9, 2026.

This Data Processing Addendum ("DPA") forms part of and supplements the Terms of Service or other written agreement between AMF Internet Services Limited trading as Anymail Finder ("Company", "Data Importer") and the customer identified in the applicable order or online sign-up ("Customer", "Data Exporter") that governs Customer's access to and use of Anymail Finder services (the "Agreement"). Capitalized terms not defined in this DPA have the meanings given in the Agreement.

Effective Date: for a Customer who accepted an earlier version of this DPA, November 9, 2026; for any other Customer, the date on which the Customer accepts or signs the Agreement incorporating this DPA.

1. Definitions

2. Roles of the Parties

  1. Roles for Customer Personal Data. For Personal Data that Customer uploads to or instructs Company to process via the Services, Customer acts as controller or, where Customer processes that data on behalf of its own customers, as processor. Company acts as processor where Customer is a controller and as subprocessor where Customer is a processor. Where Customer acts as processor, Customer represents that it is authorised by the relevant controller to appoint Company as a subprocessor and to give the instructions contemplated by this DPA, and references in this DPA to Customer's obligations as controller are read as obligations of Customer or the relevant controller, as applicable.
  2. Company as Controller. Company acts as an independent controller for:
    • Customer Account Data,
    • billing, compliance, security/fraud prevention, service analytics,
    • other processing required by law, and
    • retaining and reusing email addresses and related business contact information found or confirmed as valid through the Services, for its own purposes of maintaining, improving and providing its email finding and verification services to customers.
    This controller processing is governed by Company's Privacy Policyand is not "on behalf of Customer". For clarity, Company does not sell, share or make available to other customers Customer's lists, search history or search inputs as such; those are processed only as processor under Section 2.1. Individual email addresses and related business contact information found or confirmed as valid through the Services may be returned to other customers who search for the same person or company.

3. Processor Obligations

Company shall:

4. Customer Responsibilities

Customer shall:

5. Details of Processing

The subject matter, duration, nature and purpose, types of Personal Data, and categories of data subjects are set out in Annex I.

6. Subprocessors

  1. Authorization. Customer provides general written authorization for Company to engage Subprocessors to support the delivery of the Services.
  2. List & changes. Company's current Subprocessors are listed in Annex III (and may also be reflected on Company's website). Company will notify Customer of any intended changes to Subprocessors and provide an opportunity to object on reasonable data protection grounds within 30 days of notice.
  3. Objections. If Customer reasonably objects and Company cannot provide a commercially reasonable alternative, Customer may suspend the affected processing or terminate the affected Services (without penalty for the terminated portion), and receive a pro-rata refund of pre-paid fees for the terminated portion.
  4. Flow-down. Company will enter written agreements with Subprocessors imposing obligations no less protective than those set out in this DPA. Company remains liable for each Subprocessor's performance.

7. Data Subject Requests

If Company receives a request from a data subject relating to Customer Personal Data, Company will promptly notify Customer (unless prohibited by law) and direct the data subject to contact Customer. Company will assist Customer, taking into account the nature of processing, by appropriate technical and organizational measures, so that Customer can respond to requests to access, rectify, erase, restrict, object, or port Personal Data.

8. Security & Incident Management

  1. Security. Company will implement and maintain the TOMs described in Annex II.
  2. Personal Data Breach. Company will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provide information required by Article 33(3) EU/UK GDPR as it becomes available, including: the nature of the breach, categories/approximate numbers of data subjects and records, likely consequences, and measures taken or proposed to address the breach.
  3. Cooperation. Company will cooperate with Customer and provide reasonable assistance to enable Customer to comply with Articles 33 and 34 (including notifications to supervisory authorities and data subjects, where required).

9. Audits & Information Rights

  1. Reports. Upon written request, Company will make available summary information reasonably necessary to demonstrate compliance (e.g., security overviews/TOMs, penetration test summaries, or third-party attestations if available).
  2. Audits. If such information is insufficient under Data Protection Laws, Customer may conduct (or appoint an independent auditor to conduct) a targeted audit on reasonable prior written notice (normally at least 30 days), no more than once per 12 months unless following a material incident. A shorter notice period may apply where reasonably required by applicable Data Protection Laws, a competent supervisory authority or the circumstances of a personal data breach. Audits shall otherwise be conducted during normal business hours, in a manner that minimizes disruption and respects Company's confidentiality and security policies. Customer bears its own audit costs and reimburses Company for reasonable time/expenses.

10. International Data Transfers

  1. General. Company may process and transfer Personal Data globally to provide the Services, including hosting on AWS (United States) and Hetzner (Germany).
  2. EU SCCs. For Ex-EEA Transfers, the EU SCCs are incorporated by reference and deemed executed between Customer (as Data Exporter) and Company (as Data Importer): Module 2 (Controller-to-Processor) where Customer is a controller, and Module 3 (Processor-to-Processor) where Customer is a processor, with references in Annex I to the parties' roles read accordingly, completed as follows:
    • Clause 7 (Docking): applies.
    • Clause 9 (Subprocessors): Option 2 (general authorization); notice per Section 6.
    • Clause 11: optional language does not apply.
    • Clause 17: Irish law governs the SCCs.
    • Clause 18: Courts of Ireland have jurisdiction.
    • Annex I/II: as set out in Annex I and Annex II to this DPA.
  3. UK Addendum. For Ex-UK Transfers, the UK Addendum is incorporated by reference. For Part 1 of the UK Addendum: (a) Table 1: the Start Date is the Effective Date; Customer is the Exporter, with its party and key contact details as stated in the applicable order, registration or account records; Company is the Importer, AMF Internet Services Limited trading as Anymail Finder, company number 10586048, registered office c/o Finest Ventures Limited, 2 Sheraton Street, London, W1F 8BH, United Kingdom, key contact team@anymailfinder.com; (b) Table 2: the Approved EU SCCs are the Module 2 or Module 3 SCCs, as applicable under Section 10.2, with Clause 7 applying, Clause 9 Option 2 (general authorisation) applying with a 30-day notice period under Section 6, and Clause 11 not applying; (c) Table 3: the Appendix Information is set out in Annexes I, II and III of this DPA; and (d) Table 4: either party may end the UK Addendum as provided in Section 19 of the Approved Addendum. Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses, is incorporated by reference.
  4. Switzerland. For transfers from Switzerland, the EU SCCs apply with the modifications required by the FADP (e.g., FDPIC as competent authority; "Member State" interpreted to include Switzerland).
  5. Supplementary measures. Company will implement supplementary measures as reasonably necessary to ensure an essentially equivalent level of protection (e.g., encryption in transit/at rest, access controls, need-to-know, challenge/notify where lawful of government access).

11. Return and Deletion

Upon termination or expiry of the Services, Customer may elect to have Company return Customer Personal Data (in a commonly used machine-readable format) and/or delete it. If Customer makes no election, Customer instructs Company to retain processor copies of search records and results only for the applicable retention periods stated in Annex I and then delete them, subject to legal retention requirements. Customer-initiated account deletion via the product permanently deletes the account and its processor-side data immediately; backups are overwritten on normal cycles. This Section does not require deletion of personal data separately processed by Company as an independent controller in accordance with Section 2.2 and its Privacy Policy.

12. Government Access Requests

Where legally permitted, Company will notify Customer of any legally binding request for disclosure of Personal Data by a law enforcement authority. Company will challenge unlawful or overbroad requests and will disclose only the minimum required to comply with the request.

13. Liability & Precedence

The parties' liability under this DPA is subject to the limitations/exclusions in the Agreement. If there is a conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict. If there is a conflict between this DPA and the EU SCCs/UK Addendum, the EU SCCs/UK Addendum prevail.

14. Governing Law

This DPA (excluding the EU SCCs and UK Addendum, which are governed per Section 10) is governed by the law specified in the Agreement. If the Agreement does not specify, this DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

15. Amendments

Company may update this DPA to reflect changes in law or Services by providing at least 30 days' notice. If Customer reasonably objects on data protection grounds and the parties cannot resolve, Customer may terminate the affected Services and receive a pro-rata refund of any pre-paid fees for the terminated portion.

16. Signatures

This DPA is deemed executed, in writing for the purposes of Article 28(9) GDPR, upon acceptance of the Agreement or signature of an order that references this DPA. No countersignature is required. Company provides a countersigned copy on request to Customers whose usage is at least 50,000 credits in a calendar month; other Customers may keep a dated copy of this page as their record.

Annex I - Details of Processing (Art. 28(3); SCC Annex I)

  1. Parties:
    • Data Exporter:
      Customer (and Customer Affiliates, where applicable)
      Address: As per order/registration
      Contact: As per order/registration
      Role: Controller, or Processor where Customer processes the data on behalf of its own customers (Section 2.1)
    • Data Importer:
      AMF Internet Services Limited (Anymail Finder)
      Company number: 10586048. Registered office: c/o Finest Ventures Limited, 2 Sheraton Street, London, W1F 8BH, United Kingdom
      Contact: team@anymailfinder.com
      Role: Processor, or Subprocessor where Customer is a Processor (Section 2.1)
  2. Description of Processing:
    • Subject matter: Processing of Customer Personal Data submitted by Customer or processed on Customer's documented instructions to provide email finding, verification and related support.
    • Duration: Term of the Agreement plus deletion/return period in Section 11.
    • Nature & Purpose: Hosting, transmission, finding and validation/verification of business email addresses on Customer instruction; storage of Customer's processor-side search records and results; and support to the extent it involves Customer Personal Data.
    • Categories of Data Subjects: Leads, prospects, contacts and other individuals whose Personal Data Customer submits or instructs Company to process through the Services.
    • Categories of Personal Data: Names; business contact details (including email, role/title, company and domain); metadata required to verify email deliverability (e.g., domain status, SMTP checks); and other Personal Data submitted by Customer for finding or verification. Customer Account Data and data processed by Company as an independent controller under Section 2.2 are excluded.
    • Special Categories: Not intended; Customer shall not submit special category data or children's data.
    • Frequency: Continuous/episodic during the term.
    • Transfers: See Section 10 (AWS US; Hetzner DE).
    • Retention: processor copies of Customer search records and results are retained as described in Section 11 and the product controls (currently 1 year for bulk search records, 2 years for single search records made through the web application or browser extension, and 2 weeks for search records made through the API, or until account deletion); logs up to 14 days. This does not govern personal data separately processed by Company as an independent controller under Section 2.2.
  3. Competent Supervisory Authority:
    For EU SCCs: the supervisory authority determined in accordance with Clause 13 of the EU SCCs, based on the circumstances of the Data Exporter.

Annex II - Technical & Organisational Measures (Art. 32; SCC Annex II)

Information security program. Company maintains a risk-based security program that includes:

  1. Governance & access control
    • Role-based access; least privilege; approval workflows.
    • MFA enforced for internal systems; SSO for employees where supported.
    • Employee confidentiality obligations and security/privacy training.
  2. Encryption
    • TLS for data in transit; encryption at rest for production data stores.
    • Key management via cloud provider services with restricted access.
  3. Network & infrastructure security
    • Segmented environments; firewalls and security groups; hardened images.
    • Vulnerability management and periodic security reviews.
    • Continuous monitoring and alerting for anomalies.
  4. Application security
    • Code review and automated checks in a CI pipeline before deployment.
    • Secrets management; automated CI/CD deployment.
  5. Logging & monitoring
    • Centralized logs for security and operations; restricted access; retention up to 14 days for API/system/access logs.
  6. Data management
    • Data minimization; configurable retention for processor copies of Customer search records and results (currently 1 year for bulk search records, 2 years for single search records made through the web application or browser extension, and 2 weeks for search records made through the API), subject to Section 11. This does not apply to personal data separately processed by Company as an independent controller under Section 2.2.
    • Customer-initiated deletion features (per-search delete; account deletion).
    • Regular backups, overwritten on normal cycles.
  7. Physical security
    • Data centers provided by AWS (US) and Hetzner (DE) with industry-standard physical controls.
  8. Business continuity & incident response
    • Documented incident response plan with escalation; lessons-learned reviews.
    • Breach notification without undue delay and cooperation per Section 8.
    • High-level BCP/DR procedures aligned with cloud provider resilience.
  9. Third parties
    • Vendor due diligence; DPAs with Subprocessors; periodic reviews; least-privilege API/service access.

Annex III - Authorized Subprocessors (current as of the Effective Date)

Company may update this list in accordance with Section 6.

Annex IV - International Transfer Mechanics (Summary)

EU SCCs (2021/914):

UK Transfers:

Switzerland: