Data Processing Terms

Roles and responsibilities

In relation to the business contact data supplied under an order, Vytrix Data acts as an independent data controller for the purposes of collecting, holding and supplying that data. The customer becomes a separate data controller for the purposes of any marketing, outreach or other use they make of the supplied records.

Vytrix Data is not a data processor acting on the customer's instructions in relation to the supplied records. Each party is independently responsible for its own compliance with applicable data protection law.

What Vytrix Data warrants

Vytrix Data warrants that, at the time of delivery:

• Records have been sourced from publicly available or legitimately licensed sources.
• A legitimate-interest assessment has been completed for EU and UK contact records.
• Active suppression checks have been run against our global suppression list.
• Records have been verified for deliverability to at least the confidence floor stated in the order.
• No special-category personal data, consumer (non-business) records, or records of individuals under 18 are knowingly included.

Customer obligations

The customer agrees to:

• Establish and document their own lawful basis before using the data for any marketing or outreach activity.
• Comply with all applicable laws in the jurisdiction(s) where outreach is conducted, including but not limited to GDPR, UK-GDPR, CAN-SPAM, CASL and the DPDP Act.
• Include a clear opt-out mechanism in all marketing communications sent using Vytrix-supplied contacts.
• Honour opt-out and suppression requests received by the customer and share suppression updates with Vytrix Data within 30 days.
• Not re-sell, sub-licence or otherwise distribute the supplied records to any third party without prior written consent from Vytrix Data.
• Delete all supplied records at the end of the licence period or within 30 days of a written request from Vytrix Data.

Permitted use

Supplied records may be used solely for B2B sales outreach, marketing, market research, CRM enrichment, account intelligence and related legitimate commercial purposes, as described in the order. Use for consumer marketing, political campaigning, credit scoring, insurance underwriting, employment screening or any other purpose not described in the order is not permitted.

Data subject rights

Data subjects may exercise their rights (access, erasure, suppression, rectification) directly with Vytrix Data via privacy@vytrixdata.com. The customer must also operate a route for data subjects to make rights requests to them as a controller and must inform Vytrix Data of any erasure or suppression request received within 14 days.

Security

Both parties shall implement appropriate technical and organisational measures to protect supplied records against unauthorised access, disclosure, loss or destruction. The customer shall notify Vytrix Data within 72 hours of becoming aware of any security incident involving supplied data.

Limitation of liability

Vytrix Data's liability for any claim arising under these terms shall not exceed the total fees paid by the customer in the three months preceding the event giving rise to the claim. Vytrix Data shall not be liable for the customer's own use of supplied data, any regulatory penalties arising from the customer's outreach activities, or any indirect or consequential loss.

Governing law

These terms are governed by the laws of India. Any dispute shall be subject to the exclusive jurisdiction of the courts of Hyderabad, Telangana, India, unless otherwise agreed in writing for a specific customer jurisdiction.

Enterprise DPA

Enterprise customers requiring a bespoke Data Processing Addendum, DPIA-ready documentation, or sub-processor lists can request these from their account contact or via legal@vytrixdata.com. These are provided under NDA.

Request a DPA →