Data Processing Agreement

Effective date: October 5, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Marketercore Ltd ("Processor", "we", "us") and the customer that has agreed to those Terms ("Controller", "you") for the use of Marketercore (the "Service"). It applies wherever we process personal data on your behalf in providing the Service, and it is written to meet Article 28 of the EU GDPR and the UK GDPR. If this DPA and the Terms conflict, this DPA prevails for the processing of personal data.

1. Definitions

"Personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR. "Customer Personal Data" means personal data that you, your team or your contacts put into the Service, or that the Service collects on your behalf. "Subprocessor" means a third party we engage to process Customer Personal Data.

2. Roles and scope

You are the controller of Customer Personal Data and we are your processor. We process it only to provide, secure and support the Service, and only on your documented instructions, which are these Terms, this DPA and the way you configure and use the Service. If we believe an instruction breaks data protection law, we will tell you.

Subject matter and duration. Providing the Service for as long as you use it, plus the export and deletion period in Section 10.

Nature and purpose. Hosting, storage, organisation, transmission (texts, emails, calls, chat), analysis and AI-assisted processing needed to run the Service's features.

Types of personal data. Contact details (names, email addresses, phone numbers, postal addresses), communications content and metadata, call recordings and transcripts where enabled, appointment, deal, invoice and payment records (never full card numbers), form submissions, notes and any other data you choose to store.

Categories of data subjects. Your customers, leads, contacts and website visitors, and your own team members.

3. Our obligations

We will:

• process Customer Personal Data only on your instructions, unless the law requires otherwise (in which case we will tell you first where we are allowed to);
• make sure everyone authorised to process it is bound by confidentiality;
• implement appropriate technical and organisational measures (Section 6);
• help you, taking into account the nature of the processing, to respond to data subjects exercising their rights;
• help you with security, breach notification, data protection impact assessments and prior consultation, as far as the information available to us allows;
• make available the information reasonably needed to show compliance with this DPA, and allow for audits as set out in Section 9.

4. Your obligations

You are responsible for having a lawful basis for the processing, for the accuracy of Customer Personal Data, for giving data subjects the notices they need and for obtaining any consent required by law (including for marketing messages, automated calls and call recording).

5. Subprocessors

You authorise us to use subprocessors in these categories: cloud hosting and storage, telephony and SMS carriers, email delivery, payment processing, AI and speech-recognition providers, error monitoring and support tools. We require each subprocessor, by written contract, to protect Customer Personal Data to a standard no lower than this DPA, and we remain responsible for their performance. A current list is available on request from support@marketercore.co.uk. We will tell you before adding or replacing a subprocessor, and you may object on reasonable data protection grounds; if we cannot reasonably address the objection, you may stop using the affected part of the Service.

Our current subprocessors are:

• Amazon Web Services (AWS): cloud hosting, storage and backups (United Kingdom, London region);
• Anthropic: AI replies, AI calls and content generation on our AI connection (United States);
• Twilio and Telnyx: texts, phone numbers and calls, when you use our connection (United States);
• Resend and Mailgun: email delivery, when you use our connection (United States and European Union);
• Stripe: payments and billing (United States and Ireland);
• Cloudflare: "I am human" checks on public forms, when switched on (United States).

Where you connect your own accounts with these or other providers (for example your own Twilio, Telnyx, Resend, Mailgun, Stripe or AI key), that provider works for you under its own terms, not as our subprocessor.

6. Security

We protect Customer Personal Data with measures including encryption in transit (TLS), application-level encryption of secrets and sensitive fields (AES-256-GCM), hashed passwords, multi-factor authentication, role-based access control, audit logs, and automatic daily encrypted backups. Our Privacy and Security page describes these measures in more detail and forms part of this DPA.

7. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay, and in any case within 72 hours of becoming aware of it, with the information you reasonably need to meet your own obligations. We will take reasonable steps to contain and investigate the breach and to reduce its effects.

8. International transfers

Where Customer Personal Data is transferred out of the UK, the European Economic Area or Switzerland to a country without an adequacy decision, we will rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference where they apply. For transfers from the UK we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; for transfers from the EEA, the EU Standard Contractual Clauses (or the EU-US Data Privacy Framework where a recipient is certified). We rely on these safeguards for transfers to our subprocessors outside the UK and EEA.

9. Audits

Once a year, or after a personal data breach, you may ask for information to verify our compliance with this DPA. We will answer reasonable written questions and share relevant documentation. Where that is not enough and the law requires it, you may carry out an audit on reasonable notice, during business hours, at your own cost and under confidentiality obligations, in a way that does not compromise other customers' data or the security of the Service.

10. Return and deletion

You can export your data from the Service at any time while your account is active. When your account ends, we will make your data available for export for a reasonable period on request, and then delete Customer Personal Data, including from backups as they expire on their rolling schedule, unless the law requires us to keep it.

11. Liability and governing law

Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by the laws of England and Wales, and disputes are resolved in the courts of England and Wales, unless data protection law requires otherwise.

12. Contact

For questions about this DPA or to exercise any right under it, contact support@marketercore.co.uk. You can contact Marketercore Ltd by email at support@marketercore.co.uk. Our postal address is: 128 City Road, London EC1V 2NX. Company number: 13420440. You can also find more information on marketercore.co.uk.