Policies
Data Processing Agreement
Version 1.0, effective 1 November 2026
Published by Emailmovers Limited, company 05046417, registered office 33-35 Exchange Street, Driffield YO25 6LL. ICO registration Z9714386.
This version lives at emailmovers.com/dpa/ and, once a later version replaces it, at emailmovers.com/dpa/v1/.
1. About this agreement
1.1 This agreement is between Emailmovers Limited (“we”, “the processor”) and the organisation that holds the MyDataHub account (“you”, “the controller”).
1.2 It covers personal data that you give us, or let us reach, so that MyDataHub can work for you: suppression lists you upload and CRM systems you connect. Schedule 1 sets out the details.
1.3 You accept it by clicking before we first process such data for you, for example before your first suppression list upload or CRM connection. Your account records the version you accepted and when. This electronic acceptance is a contract in writing for the purposes of UK GDPR Article 28(9).
1.4 It does not cover the records we license to you. For those we are each a separate controller, under the Data Licence and Sharing Agreement. It also does not cover an objection you report to us under that agreement: we use that as a controller, to suppress the person in our own database.
1.5 It forms part of the MyDataHub Terms of Sale. If they differ about our processing of your personal data, this agreement wins.
2. Definitions
2.1 In this agreement:
- data protection law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended, including by the Data (Use and Access) Act 2025;
- your personal data means personal data that we process for you under this agreement, as Schedule 1 describes;
- sub-processor means another processor that we engage to process your personal data;
- personal data breach, processing, controller, processor and data subject have the meanings they have in the UK GDPR.
3. Processing only on your instructions
3.1 We process your personal data only on your documented instructions. Your instructions are this agreement and the settings and actions you choose in MyDataHub, for example uploading a list, applying it to counts and orders, connecting a CRM, running the overlap check before an order, or deleting a list.
3.2 We do not process your personal data for our own purposes. We do not add it to our database, and we do not use it to train or improve any model.
3.3 If the law requires us to process your personal data in another way, we tell you before we do, unless the law forbids it.
3.4 We tell you straight away if we believe an instruction from you breaks data protection law.
4. Confidentiality
4.1 Only staff and contractors who need access to your personal data to run MyDataHub have it. Each is bound by a duty of confidentiality.
5. Security
5.1 We protect your personal data with technical and organisational measures that suit the risk, as UK GDPR Article 32 requires. Schedule 3 lists them.
6. Sub-processors
6.1 You give us general written authorisation to engage the sub-processors listed in Schedule 2.
6.2 We give you at least 30 days’ notice before we add or replace a sub-processor of your personal data, by email to your account’s owner and on our sub-processor page. You may object on reasonable data protection grounds within that time. If we cannot meet your objection, you may stop using the feature concerned, or end the agreement, and we refund credits you paid for and have not used.
6.3 Each sub-processor is bound by a written contract with data protection duties no less protective than this agreement’s. We remain fully liable to you for each sub-processor’s performance of those duties.
7. International transfers
7.1 We do not transfer your personal data outside the UK unless you have authorised it. Schedule 2 shows where each sub-processor processes it.
7.2 If a new sub-processor would need a transfer, we tell you under clause 6.2. We transfer only to a country covered by UK adequacy regulations, or under the ICO’s International Data Transfer Agreement or its Addendum to the EU standard contractual clauses.
8. Helping with people’s rights
8.1 MyDataHub lets you view and delete your suppression lists and disconnect a CRM, which helps you answer requests from people.
8.2 If a person contacts us about your personal data, we tell you within 5 working days and do not answer them ourselves, unless you ask us to or the law requires it.
8.3 We help you, as far as we reasonably can given the nature of the processing, to meet your duties to answer requests from people.
9. Personal data breaches
9.1 We tell you without undue delay, and within 24 hours of becoming aware, of a personal data breach affecting your personal data.
9.2 We give you the information you need to meet your own duties to report the breach and to tell the people affected, as it becomes available: what happened, the kinds and approximate numbers of people and records, the likely consequences, and what we are doing about it.
9.3 We work with you to investigate the breach, limit its effects and put it right.
10. Help with your other duties
10.1 We help you, given the nature of the processing and the information we have, with your duties on security, breach notification, data protection impact assessments and prior consultation with the Information Commission (UK GDPR Articles 32 to 36).
11. Deletion and return
11.1 When you delete a suppression list, disconnect a CRM or close your account, or this agreement ends, we delete the personal data concerned within 10 working days. Copies in backups are overwritten in their normal cycle, within 35 days, and are never restored for use.
11.2 If you ask before we delete it, we return a copy of an uploaded list to you in CSV.
11.3 We confirm deletion in writing if you ask.
11.4 We keep your personal data longer only where the law requires it, and then only for that purpose.
12. Information and audits
12.1 On request, we give you the information you reasonably need to show that we meet UK GDPR Article 28.
12.2 If that information is not enough, you, or an independent auditor you appoint who is bound by confidentiality, may audit our processing of your personal data. Give us 30 days’ written notice. Audits take place no more than once in any 12 months, unless a personal data breach or the Information Commission requires one, and during working hours. You pay your own costs of an audit.
13. Your duties
13.1 You confirm that you have a lawful basis to give us your personal data and to instruct this processing, and that you have given the people concerned the privacy information the law requires.
13.2 Upload only what MyDataHub needs: email addresses, domains or company numbers for a suppression list. Do not upload special category data, data about criminal offences, or data about children.
13.3 Make sure your instructions keep to data protection law.
14. Liability
14.1 The liability terms in the MyDataHub Terms of Sale apply to this agreement, including the limit for data protection claims.
15. How long this agreement lasts
15.1 This agreement lasts as long as we process your personal data. Clauses 11 and 12 continue until we have deleted it.
16. Changes to this agreement
16.1 We may change this agreement. For a material change, we email the account holders of every account at least 30 days before it takes effect.
16.2 Each version has its own URL. Earlier versions stay at stable archive URLs.
16.3 A new version applies from its effective date. If you do not accept it, you may stop using the features it covers, and we delete your personal data under clause 11.
17. Law and courts
17.1 English law governs this agreement and any dispute about it, including a non-contractual dispute.
17.2 The courts of England and Wales have exclusive jurisdiction.
Schedule 1: details of the processing
| Item | Details |
|---|---|
| Subject matter | Running MyDataHub features that use your own data |
| Duration | While you keep a suppression list in MyDataHub or a CRM connected, and then until deletion under clause 11 |
| Nature | Storing, matching, comparing, applying and deleting |
| Purpose | To leave people on your suppression lists out of your counts and orders; to find records you already hold before an order (the overlap check), so you are not charged for them; and to send records you order to your CRM |
| Kinds of personal data | Business email addresses, and any other details in a list you upload; email addresses read from your CRM for the overlap check |
| People concerned | Your customers, prospects and contacts, and people who have asked you not to market to them |
| Special category data | None |
| Suppression lists | Kept as a named list in your account, applied to every later count and order at no charge, until you delete it. Email addresses, domains, telephone numbers and company numbers are kept only as one-way coded (SHA-256 hashed) values, never as you entered them. Job title terms are kept as words, as they are matched as words |
| CRM overlap check | Read-only access. We read email addresses only, compare one-way coded (hashed) values in memory, and keep nothing after the order |
Schedule 2: sub-processors of your personal data
| Sub-processor | What it does | Where | Transfer |
|---|---|---|---|
| Google Cloud | Hosts MyDataHub and its data | London, United Kingdom | None |
No other supplier processes your uploaded suppression lists or the data we read from your CRM. We give you 30 days’ notice before adding one, under clause 6.2.
Schedule 3: security measures
- MyDataHub, its database, its backups and its stored files are hosted in Google Cloud’s London region.
- Data is encrypted in transit, and the database accepts encrypted connections only. Data is encrypted at rest with keys we control in Google Cloud’s key service, and backups use a separate key.
- The database has a private network address only and cannot be reached from the internet. Our services sign in to it with their own service accounts, so no database password exists.
- Access to production systems is limited to named staff who need it. Staff sign in with company Google accounts with 2-step verification, and staff pages sit behind Google’s Identity-Aware Proxy.
- Customers sign in by a link sent to their work email address. A spend needs a sign-in within the last 15 minutes.
- Each organisation’s data is kept separate from every other organisation’s.
- Download links last minutes, work once and are tied to an account.
- The database is backed up daily, backups are kept for 35 days, and it can be restored to any point in the last 7 days.
- We keep logs of access to systems that hold personal data.