Data Processing Agreement

This Data Processing Agreement ("DPA") is between the customer that holds a Ballast workspace ("you", the controller) and Ballast (ballast.to) ("we", the processor). It is part of the Terms of Service and applies whenever we process personal data for you. You accept it when you accept the Terms; no signature is needed. For a countersigned copy, write to contact@ballast.to.

It is meant to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. Words like "personal data", "processing", "controller", "processor" and "data subject" mean what they mean in the GDPR. If this DPA and the Terms disagree on personal data, this DPA wins.

We process personal data only on your documented instructions. Those instructions are the Terms, this DPA, and what you or your team do in Ballast: settings, campaigns, imports, API and MCP calls. We tell you if we think an instruction breaks data protection law.

We may also process data when a law of the EU or a member state requires it; we tell you first unless that law forbids it.

As the controller you decide whom to email and why. In particular you:

• have a lawful basis for each lead. For business outreach in the EU this is usually legitimate interest: your message must be relevant to the person's role, and you should record your assessment;
• give leads the information Article 14 GDPR requires, for example a short line in your first email or a link to your own privacy notice;
• respect objections. Ballast suppresses everyone who unsubscribes, replies asking to stop or hard bounces;
• only upload data you are allowed to use, and follow our Acceptable Use Policy.

Anyone who works on Ballast for us is bound to keep your data confidential and only looks at it when needed to run, support or secure the service.

• Data is stored in the EU, on servers with disks and backups encrypted at rest.
• TLS on every connection to Ballast and from Ballast to mail servers and APIs.
• Mailbox passwords and OAuth tokens encrypted with AES-256-GCM, never returned by the API or written to logs.
• User passwords and API keys stored only as hashes. API keys carry the role of the person who created them; connected apps can be disconnected at any time.
• Every query is scoped to one workspace; members get only what their role (owner, admin, member) allows.
• Requests to addresses you supply (webhooks, websites) cannot reach private or internal networks.
• Daily database backups, kept 30 days.
• Access to production is limited to the people running Ballast.

You allow us to use the sub-processors on the sub-processors page. Each one is bound by a written agreement with data protection terms at least as strict as these. We stay responsible for their work.

We tell account owners by email at least 30 days before a new sub-processor starts handling your data, and update the page. If you object for a reasonable data protection reason, tell us within that time. If we can't solve it, you may cancel and we refund the unused part of what you prepaid.

Services you connect yourself (mailbox providers, email verifiers, webhook endpoints, AI assistants, your own AI keys) are not our sub-processors: you choose them and they act under your account.

Your data is hosted in the EU. Some sub-processors process data outside it: OpenAI and Google (AI features) in the United States, and Cloudflare, which serves link clicks from the location nearest the visitor. Those transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (processor to processor), with the UK Addendum for UK data.

Ballast gives you the tools to answer most requests yourself:

• Access and correction: open the lead to see and edit everything stored about them, including emails sent and replies.
• Erasure: delete the lead. Its details, lists, labels, campaign history, emails and replies go; your stats keep only counts with no name or address attached. Add the address to suppressions first so a later import can't email them again. A suppression keeps only the address, which is what you need to honour the objection.
• Objection: suppress the address or domain. Suppression is permanent in the workspace.

If a data subject writes to us about your workspace, we pass the request to you without delay and don't answer it ourselves unless you ask us to. We help with anything the tools don't cover.

If we become aware of a breach affecting your data, we tell the workspace owners without undue delay, and within 48 hours, with what we know: what happened, which data and how many people are affected, what we are doing about it, and whom to contact. We update you as we learn more, and help you with your own notifications to authorities and data subjects.

We give you the information you reasonably need for data protection impact assessments and consultations with authorities, and to show that we meet this DPA.

You can ask us to answer a security questionnaire once a year. If that is not enough, or an authority requires it, an independent auditor bound to confidentiality may audit us with 30 days' notice, at your cost, in a way that does not expose other customers' data.

When your workspace is closed, we delete your personal data within 30 days and it leaves our backups within 30 more, unless the law requires us to keep it. Ask before closing and we send you your leads in CSV first.

Liability under this DPA follows the limits in the Terms of Service, unless data protection law does not allow them. This DPA lasts as long as we process personal data for you.