How we process and protect personal data on behalf of our clients.
Last updated: April 27, 2026
This Data Processing Agreement ("DPA") forms part of the service agreement between Reedy 360 Leads ("Processor," "we," "our") and the Client ("Controller," "you," "your") who engages our lead research services. This DPA sets out the terms under which we process personal data on your behalf and ensures compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR), India's Digital Personal Data Protection Act (DPDP Act), and other relevant legislation.
We process personal data solely for the purpose of delivering the lead research services you have engaged us to perform. The categories of personal data we process include: full names, job titles, business email addresses, business phone numbers, company names, company websites, LinkedIn profile URLs, company size, industry classification, and geographic location. All data is B2B professional contact information sourced from publicly available channels.
As the Processor of your data, we commit to the following obligations:
As the Controller, you are responsible for:
We implement the following technical and organizational measures to protect personal data:
We currently use the following categories of sub-processors to assist in delivering our services:
We will notify you before engaging any new sub-processor and provide you with the opportunity to object. If you object to a new sub-processor on reasonable data protection grounds, we will work with you to find an alternative solution.
If personal data is transferred outside of the European Economic Area (EEA) or the jurisdiction of the Controller, we will ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.
We will assist you in fulfilling your obligations to respond to data subject requests, including requests for access, rectification, erasure, restriction of processing, data portability, and objection to processing. If we receive a request directly from a data subject, we will promptly notify you and will not respond to the request without your instructions, unless legally required to do so.
In the event of a personal data breach, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects.
We retain personal data only for as long as necessary to fulfill the purposes of processing. Upon completion of a project, we retain working files for 30 days for quality assurance purposes. After 30 days, all working files and copies of personal data are permanently deleted from our systems. You may request immediate deletion of working files upon delivery. We will provide written confirmation of deletion upon request.
You have the right to audit our compliance with this DPA. We will make available all information reasonably necessary to demonstrate compliance and will allow for and contribute to audits and inspections conducted by you or an auditor mandated by you. Audits shall be conducted with reasonable notice (at least 14 days) and during normal business hours.
This DPA shall remain in effect for the duration of our service agreement. Upon termination of the service agreement, we will delete or return all personal data as described in Section 11. The obligations of confidentiality and data protection under this DPA shall survive termination.
This DPA shall be governed by and construed in accordance with the laws of India. For clients based in the European Union, the provisions of the GDPR shall apply to the extent they provide additional protections.
For any questions or concerns regarding this Data Processing Agreement, please contact us: