Data Processing Addendum
Effective 2026-10-13
This Data Processing Addendum (“DPA”) is entered into between Tuuma, LLC (“Provider”) and the client identified on the applicable Order Form (“Customer”), is executed by execution of that Order Form, and applies to personal data within Client Data (“Personal Data”) that Provider processes for Customer under the Agreement. For Personal Data, this DPA controls over the Agreement.
1. Details of processing
| Roles | Customer is the business/controller; Provider is the service provider/processor |
| Subject matter and purpose | Performance of the Services described in the applicable Order Form and SOW(s): typically marketing operations, analytics, and build work performed in Customer’s systems |
| Nature of processing | Access, organization, analysis, segmentation, and communication support within Customer’s systems; no independent use |
| Data subjects | Customer’s prospects, candidates, customers, and site visitors |
| Categories of Personal Data | Contact details, professional information, and marketing engagement data, as applicable to the Services. No special categories are intended; Provider will notify Customer if any are encountered |
| Duration | The term of the Agreement, plus export and deletion per Section 5 |
| Security contact (Provider) | security@tuuma.com |
2. Provider obligations
Provider will: (a) process Personal Data only on Customer’s documented instructions, the Agreement, and this DPA, and only as necessary to perform the Services; (b) not sell or share Personal Data, or retain, use, or disclose it for any purpose other than performing the Services or as permitted by applicable law, including outside the direct business relationship between the parties; (c) not combine Personal Data with personal information received from other sources, except as permitted by applicable law to perform the Services; (d) ensure persons processing Personal Data are bound by confidentiality; (e) assist Customer in responding to consumer and data-subject requests, and notify Customer promptly of any such request received directly; (f) notify Customer promptly if Provider determines it can no longer meet its obligations under this DPA, in which case Customer may take reasonable steps to stop and remediate unauthorized use of Personal Data; and (g) permit Customer to take reasonable and appropriate steps, on reasonable notice, to verify that Provider uses Personal Data consistently with Customer’s obligations under applicable law. Provider certifies that it understands and will comply with the restrictions in this Section.
3. Security and incidents
Provider maintains reasonable administrative, technical, and organizational safeguards appropriate to the data processed, per MSA § 6.4. “Security Incident” means unauthorized access to, or loss, alteration, or unauthorized disclosure of, Personal Data in Provider’s possession or control. Provider will notify Customer within 72 hours of becoming aware of a Security Incident and will cooperate on investigation and remediation.
4. Subprocessors
Customer authorizes the subprocessors listed below. Provider will give Customer at least 10 business days’ written notice before adding or replacing a subprocessor; Customer may object on reasonable data-protection grounds, and the parties will work in good faith to resolve the objection before Personal Data flows to the new subprocessor. Provider binds each subprocessor by written agreement to data-protection obligations at least as protective as this DPA, remains responsible for its subprocessors, and engages its AI providers on commercial terms under which customer content is not used to train models.
| Subprocessor | Processing task |
|---|---|
| Anthropic, PBC (US) | AI-assisted drafting and analysis |
| OpenAI (US) | AI-assisted drafting and analysis |
| Google LLC (US) | Business email and documents (Google Workspace); cloud services and marketing APIs (Google Cloud) |
| GitHub, Inc. (US) | Code and work-product storage |
| Vercel, Inc. (US) | Hosting of Provider tooling |
| Railway Corporation (US) | Hosting of client-dedicated services |
| Databricks, Inc. (US), for Neon | Client-dedicated databases |
| Slack Technologies, LLC (US) | Notifications to Provider’s team about Customer work |
| FullEnrich Corp (US) | Contact enrichment, where an SOW calls for it |
Tools operated under Customer’s own accounts and contracts (for example Customer’s CRM, analytics, and advertising platforms) are Customer’s vendors, not Provider subprocessors, and are not listed here.
5. Deletion, transfers, term
Export and deletion of Personal Data follow MSA § 6.5. No transfers of Personal Data outside the United States are contemplated; if a restricted international transfer becomes necessary, the parties will first execute the applicable standard contractual clauses or equivalent mechanism. This DPA terminates with the Agreement, except obligations that by nature survive. Governing law and venue follow MSA § 15.1.
Dated copy, effective 2026-10-13. The current version lives at tuuma.com/legal/dpa.