Processor agreement

Verwerkersovereenkomst · Version 1.0 · 31 July 2026 · Forms part of the Terms & conditions (art. 9). A countersigned copy is available on request via info@getcoldstart.nl.

1. Parties and scope

This agreement is between the Customer (the controller) and Coldstart, Schiedam, the Netherlands, KvK 42125737 (the processor), and governs all personal data Coldstart processes on the Customer's behalf under the main agreement. It implements Article 28(3) GDPR. Where this agreement and the Terms conflict on data protection, this agreement prevails.

2. What we process, and why

Subject matter and purpose: identifying companies that plausibly need what the Customer sells, and drafting opening emails to them. Nature: collection of publicly available business information, automated analysis, storage, and display to the Customer. Categories of data: business contact data of people at identified companies (name, role, business email address, public statements). Data subjects: employees and representatives of the identified companies. Duration: the term of the main agreement plus the deletion window in clause 8.

3. Instructions

We process this data only on the Customer's documented instructions — the configuration of the Customer's account (niche, keywords, sources) counts as such an instruction — and never for our own purposes. We inform the Customer immediately if we believe an instruction violates the GDPR.

4. Confidentiality and personnel

Access is limited to persons who need it to provide the Service (currently: the founder), who are bound to confidentiality.

5. Security (art. 32 GDPR)

Measures in place: EU-only hosting and backups (Hetzner, Germany); TLS for all data in transit; tenant isolation enforced at the database layer; rate-limited authentication with modern password policy; encrypted backups rotating out after 14 days; production access restricted by SSH key. We adapt these measures as risk and the state of the art evolve, never below this level.

6. Sub-processors

The Customer authorizes the sub-processors listed in the privacy policy (section 6): Hetzner (hosting, DE), Resend (email delivery, EU region), Stripe (payments), Google Gemini API (analysis of public post text), Twilio (WhatsApp notifications, only when enabled), and Adzuna (job-market queries, receives no personal data). We announce changes to this list at least 14 days ahead by email; the Customer may object on reasonable grounds, in which case we find an alternative or the Customer may cancel the affected part of the Service. Sub-processors are bound by written terms no weaker than this agreement.

7. Assistance

We assist the Customer, taking into account the nature of the processing, with data-subject requests (access, correction, deletion, objection) and with the Customer's own art. 32–36 obligations (security, breach notification, DPIAs). Requests reaching us directly are forwarded to the Customer without undue delay. Companies or persons who object are additionally placed on Coldstart's global exclusion list, so they are not processed again for any customer.

8. Personal data breaches

We inform the Customer without undue delay — at the latest within 48 hours of becoming aware — of any personal data breach affecting the Customer's data, with the information the Customer needs for its own notification duties, and we cooperate in limiting the damage.

9. Deletion and return

On termination of the main agreement we delete the Customer's personal data within 60 days, unless law requires longer retention. Up to 30 days after termination the Customer can request an export (the in-app CSV export remains the fastest route while the account is active).

10. Audits

We make available the information reasonably necessary to demonstrate compliance with this agreement, and we allow audits — at most once per year, announced 30 days ahead, during business hours, at the Customer's cost — by the Customer or an auditor it mandates who is not a competitor of Coldstart.

11. Location of processing

Processing takes place within the EU/EEA. Where a sub-processor processes data outside the EEA (e.g. Stripe, Google, Twilio under their global infrastructure), it does so under the European Commission's Standard Contractual Clauses or an adequacy decision.

12. Liability and duration

The liability arrangement of the Terms (art. 12) applies to this agreement. This agreement takes effect with the main agreement and ends when the processing under clause 9 is complete.