Legal · Annex to the Terms · Version 1.0
Data Processing Addendum
Effective 13 November 2026 · English (prevailing language)
This Data Processing Addendum (the DPA) is an annex to the SignalHunt Terms & Conditions and forms part of them. It is entered into by Nicolas Schmidt, operating as SignalHunt ([email protected]) and the Client that accepts the Terms. Capitalised words have the meaning given in the Terms.
1. Roles
- SignalHunt is the controller of the prospect database it builds for the Service.
- SignalHunt is a processor when it processes lists or other personal data the Client provides.
- The Client is the controller of its CRM and of its subsequent use of delivered leads.
Each party shall comply with applicable data-protection law (including, where they actually apply, Law 25.326 and the AAIP, PIPEDA, LGPD, LFPDPPP, Law 1581, Law 21.719, and the EU or UK GDPR). The Client’s instructions to us as processor must be lawful. We will not use sensitive / special-category data (health, religion, political opinions, sexual orientation and similar) in targeting.
2. Confidentiality
Each party shall treat personal data and the other party’s non-public business information as confidential, limit access to personnel and subprocessors who need it for the Service, and ensure they are bound by confidentiality duties no less protective than this DPA.
3. Security measures
We will apply reasonable technical and organisational measures appropriate to the risk, including TLS in transit, access control and least-privilege production access, two-factor authentication on the sending workspace (see the Terms), and logging of security-relevant events. No method is perfectly secure. The Client is responsible for the security of accounts and systems it controls.
4. Sub-processors
The Client authorises us to use the following sub-processors (and their own infrastructure providers) to perform the Service. We will remain responsible for their performance as it relates to this DPA. We will give notice of a material addition or replacement; the Client may object on reasonable grounds related to data protection. If we cannot reasonably accommodate the objection, either party may cancel the Service under the Terms.
| Sub-processor | Role | Notes |
|---|---|---|
| Instantly | Email sending, sequences and warmup | Sending platform. Processes data in the United States. |
| Cloudflare | Hosting, CDN, DNS, security, and application data (including acceptance and suppression logs) | Processes data in the United States and on its global network. |
| xAI (Grok) | Qualification scoring and drafting of personalized outreach hooks | In use. We send professional company information (company name, public website text, hiring signals and role titles). We do not send the prospect’s email address or Client-uploaded lists in that prompt. Processes data in the United States. |
| Google Workspace | Collaboration tools | Only if and when used. |
| Enrichment provider then engaged (for example Hunter) | Professional contact enrichment | Only if and when used, under that provider’s terms. A new provider will be notified under this section before we send them data. |
5. Incident notice (72 hours)
If we become aware of a personal-data breach that affects Client data, leads delivered to the Client, or personal data in the prospect database we control that relates to that Client’s campaigns, we will notify the Client without undue delay and in any event within seventy-two (72) hours of becoming aware of it, at the email on the Client’s account, with the facts then known, the likely consequences, and the measures taken or proposed. We will update that notice as we learn more and reasonably cooperate with the Client’s own notification duties.
6. Data-subject requests
We will reasonably assist the Client with requests from individuals (access, erasure, objection, opt-out and similar) that relate to data we process for that Client. We will respond without undue delay and in any event within the time required by applicable law. Individuals may also write to us at [email protected]; see the Prospect Privacy Policy.
7. Deletion or return (Client data: 30 days; our prospect database: 12 months)
When the Service ends (including after the cancellation notice period in the Terms), we will, at the Client’s written choice, return or delete (a) the data the Client provided to us and (b) the leads and workspace data held for that Client, within thirty (30) days, except for: (i) a suppression / opt-out record we must keep so we do not contact that person again; (ii) backups that rotate out on their normal cycle; and (iii) records we must retain under applicable law (for example tax invoices). Those exceptions are kept only for the necessary purpose and period. Prospect records in SignalHunt’s own database, of which SignalHunt is the controller, are retained under the Prospect Privacy Policy (a default of twelve months after the last unanswered outreach, earlier on a valid erasure, objection or opt-out) and are not automatically erased solely because one Client’s Service ends, unless they exist only for that Client.
8. International transfers
Sub-processors may process data outside the Client’s country, including in the United States (Instantly, Cloudflare and xAI process data in the United States). Where Argentine Law 25.326 requires a transfer mechanism, we will use contractual clauses consistent with AAIP Disposition 60-E/2016 (model clauses) or any successor. Where the EU or UK GDPR actually applies, we will use the European Commission’s Standard Contractual Clauses (SCC) and, where applicable, the UK International Data Transfer Addendum (IDTA), or rely on an adequacy decision. We remain responsible for our sub-processors as set out in section 4.
9. Term
This DPA lasts for as long as we process personal data under the Terms and survives for as long as we retain any such data under section 7. Liability under this DPA is subject to the liability clause of the Terms, including the twelve-month cap and the exclusions for fraud and gross negligence.
End of DPA, version 1.0. Go to the acceptance page.