Data Processing Addendum

Last updated: October 19, 2026

This Data Processing Addendum (the “DPA”) forms part of the agreement for Bantico's services (the “Agreement”) between the customer named in that agreement (the “Customer”) and BANTICO LTD, company number 16551033, 20 Wenlock Road, London N1 7GU, United Kingdom (“Bantico”). Each is a “Party”.

It applies whenever Bantico processes personal data on the Customer's behalf while running its outreach: finding prospects, contacting them on LinkedIn, Reddit, X and email, following up, handling replies, booking calls and reporting results. If this DPA and the Agreement conflict on data protection, this DPA wins.

1. Definitions

1.1. Data Protection Laws means all laws on data protection and privacy that apply to the processing, including the UK GDPR, the UK Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), the UK Privacy and Electronic Communications Regulations, the Swiss Federal Act on Data Protection and, where it applies, the California Consumer Privacy Act.

1.2. Controller, Processor, Personal Data, Personal Data Breach, Processing, Data Subject and Supervisory Authority have the meanings given in the GDPR.

1.3. Customer Personal Data means Personal Data that Bantico processes on the Customer's behalf under the Agreement, such as prospect names, work contact details, public profiles, messages and replies. It does not include the account and billing data described in section 12.

1.4. Sub-processor means a third party Bantico engages to process Customer Personal Data.

1.5. Instructions means the Agreement, this DPA, and any written instructions the Customer sends Bantico, including by email, about who to reach, which channels to use, what to say and what to stop.

1.6. SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

2. Roles and instructions

2.1. Roles. For Customer Personal Data, the Customer is the Controller and Bantico is the Processor. If the Customer acts as a Processor for someone else, Bantico is its Sub-processor and the Customer confirms it has authority to appoint Bantico.

2.2. The Customer decides. The Customer decides who its outreach targets, in which countries, through which channels and for what purpose. The Customer is responsible for having a lawful basis for that outreach and for meeting the notice and marketing rules that apply to it.

2.3. Bantico follows Instructions. Bantico processes Customer Personal Data only on the Customer's Instructions, including for transfers to other countries, unless the law requires otherwise. In that case Bantico tells the Customer first, unless the law forbids it.

2.4. Changes by email. The Customer can change its Instructions at any time by emailing Bantico, for example to change the ideal customer profile, pause a channel or stop contacting a company. Bantico applies the change to all outreach and follow-ups from then on.

2.5. Unlawful instructions. If Bantico believes an Instruction breaks Data Protection Laws, it tells the Customer and may pause that part of the work until it is resolved.

2.6. Sensitive data. The service is not built for special category data, data about children or financial account details. The Customer will not ask Bantico to target people based on such data. If it turns up in a reply, Bantico processes it only as far as needed to handle the conversation.

2.7. Details. Annex 1 describes the processing.

3. Connected accounts and inboxes

3.1. Connected accounts. If the Customer connects a LinkedIn, Reddit or X account, Bantico uses it only to send the Customer's outreach and handle the conversations that come from it. Bantico stays inside each platform's limits and does not copy the account's contacts or other messages for any other purpose.

3.2. Disconnecting. The Customer can disconnect an account at any time. Once disconnected, Bantico no longer uses it.

3.3. Warm inboxes. Email outreach is sent from separate inboxes that Bantico sets up and warms for the Customer. Bantico never sends from the Customer's main company email address.

3.4. Platforms. LinkedIn, Reddit, X and the recipients' email providers process data under their own terms as independent controllers. They are not Bantico's Sub-processors.

4. Confidentiality and security

4.1. People. Only people who need access to run the Customer's outreach can access Customer Personal Data, and they are bound by confidentiality.

4.2. Security. Bantico takes technical and organisational measures appropriate to the risk, as described in Annex 2. Bantico may update them but will not reduce the overall level of protection.

4.3. Customer side. The Customer keeps its own logins and connected accounts secure and tells Bantico promptly if it suspects one has been compromised.

5. Sub-processors

5.1. Authorisation. The Customer gives Bantico general authorisation to use Sub-processors. The current list is in Annex 3.

5.2. Contracts. Bantico has a written contract with each Sub-processor that protects Customer Personal Data at least as well as this DPA. Bantico stays responsible to the Customer for its Sub-processors.

5.3. Changes. Bantico tells the Customer by email before a new Sub-processor starts processing Customer Personal Data. The Customer can object on reasonable data protection grounds. Bantico will try to resolve the objection; if it cannot, the Customer may stop the affected part of the service under the Agreement.

6. Breaches

6.1. Notice. Bantico tells the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice includes what is known about the breach, its likely effects, what Bantico is doing about it and a contact person. More information follows as it becomes available.

6.2. Response. Bantico takes reasonable steps to contain and fix the breach and to limit harm to the people affected.

6.3. No admission. Notifying a breach is not an admission of fault.

7. International transfers

7.1. Location. Bantico's main database is in Frankfurt, Germany (EU). Some Sub-processors may process data outside the UK or the EEA.

7.2. Safeguards. Bantico transfers Customer Personal Data outside the UK or the EEA only where the destination has an adequacy decision or an appropriate safeguard is in place.

7.3. SCCs. Where a transfer needs them, the SCCs are incorporated into this DPA by reference: Module 2 where the Customer is a Controller and Module 3 where it is a Processor. Clause 7 (docking) applies; under Clause 9 Option 2 (general authorisation) applies with the notice in section 5.3; the option in Clause 11 does not apply; for Clauses 17 and 18 the law and courts of Ireland apply. Annexes 1, 2 and 3 of this DPA complete the SCC annexes.

7.4. UK transfers. For transfers under UK data protection law, the UK Addendum is incorporated by reference. Its Table 1 is completed with the Parties' details above, Tables 2 and 3 with the SCC choices and Annexes in this DPA, and under Table 4 either Party may end it.

7.5. Swiss transfers. For transfers under Swiss law, the SCCs apply with the changes Swiss law requires, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

7.6. Authority requests. If a public authority asks Bantico for Customer Personal Data, Bantico tells the Customer where the law allows, challenges requests it considers unlawful and discloses only what it must.

8. Requests from individuals

8.1. Forwarding. If someone asks Bantico to access, correct, delete or stop using their data and it concerns the Customer's outreach, Bantico tells the Customer and helps it respond.

8.2. Stopping outreach. If someone asks not to be contacted again, Bantico stops contacting them for that Customer straight away and keeps only what is needed to make sure they are not contacted again.

9. Help and audits

9.1. Help. Bantico gives the Customer reasonable help with data protection impact assessments and with questions from Supervisory Authorities about the processing.

9.2. Information. Bantico gives the Customer the information needed to show it meets this DPA.

9.3. Audits. The Customer may audit Bantico's compliance with this DPA once a year, or more often if a Supervisory Authority requires it or after a Personal Data Breach. The Customer gives at least 30 days' notice, and the audit takes place during business hours, is kept confidential and avoids disrupting the service. Bantico may first answer by providing documents and written answers.

10. US privacy laws

Where the CCPA applies, Bantico acts as a service provider. It does not sell or share Customer Personal Data, does not use it for any purpose other than providing the service, and does not combine it with personal data from other sources except as the law permits.

11. Return and deletion

When the Agreement ends, Bantico returns Customer Personal Data on request and then deletes it, unless the law requires Bantico to keep part of it. Copies in backups are deleted as the backups expire and are not used in the meantime.

12. Bantico as a controller

Bantico is an independent Controller for its own account and billing data, such as the Customer's contact details, invoices, payments, support emails and security logs. This is covered by Bantico's Privacy Policy, not by this DPA. Bantico does not use Customer Personal Data for its own purposes, does not sell it and does not share one customer's leads or messages with another.

13. Term and general

13.1. This DPA lasts as long as Bantico processes Customer Personal Data under the Agreement.

13.2. If documents conflict, this order applies: the SCCs and UK Addendum, then this DPA, then the Agreement.

13.3. The liability terms of the Agreement apply to this DPA, as far as Data Protection Laws allow.

13.4. Except for section 7, this DPA is governed by the law of England and Wales.

Annex 1: Details of processing

Annex 2: Security measures

Annex 3: Sub-processors

Stripe handles Bantico's billing as part of the account data in section 12 and does not receive Customer Personal Data.

Contact

Questions about this DPA: privacy@bantico.com

BANTICO LTD
Company No. 16551033
20 Wenlock Road, London N1 7GU
United Kingdom