Data Protection Addendum

This Data Protection Addendum applies where a client instructs Benson Revenue to process personal data on the client's behalf in connection with a project. It is intended to form an agreement under Article 28 GDPR when incorporated into the parties' contract.

1. Parties and roles

The client is the controller of the personal data it provides or makes accessible for the project. Jérôme Alexander Bensinger, trading as Benson Revenue, is the processor to the extent Benson Revenue processes that data solely on the client's documented instructions.

2. Subject matter and duration

The processing supports the lead reactivation services described in the applicable proposal. Processing begins when Benson Revenue first receives access to the relevant personal data and continues for the project period plus the agreed deletion period.

Unless otherwise agreed, Benson Revenue deletes or returns project personal data within 30 days after the project ends. The client may request an export or return before deletion where reasonably possible. Data may be retained longer only where the client instructs Benson Revenue to do so, where the parties agree another period or where retention is required by law.

3. Nature and purpose of processing

Processing may include receiving, accessing, viewing, organising, filtering, segmenting, storing, updating, using for agreed email outreach, recording responses, transferring booking-related information to the client's systems and deleting project data. The purpose is to identify and re-engage suitable past leads and direct interested contacts to the client's booking process.

4. Categories of data subjects

Data subjects may include the client's past leads, prospects, customers and business contacts contained in the data set supplied for the project.

5. Types of personal data

Depending on the client's source data, the processing may include names, email addresses, telephone numbers, previous inquiry information, service interest, prior booking or service information, CRM status and notes, communication status, appointment details and related campaign metadata.

The client must not provide special categories of personal data under Article 9 GDPR, criminal-conviction data or other highly sensitive information unless Benson Revenue has expressly agreed in writing before the data is provided and the parties have documented an appropriate lawful basis and safeguards.

6. Documented instructions

Benson Revenue processes personal data only on documented instructions from the client, including the instructions contained in the proposal, this DPA and written project communications. If Benson Revenue believes an instruction violates applicable data protection law, it will inform the client and may suspend the affected processing until the issue is resolved.

7. Confidentiality

Personal data is accessible only to persons who need access for the project and who are subject to an appropriate confidentiality obligation. At present, Benson Revenue is operated by its owner and no other internal person is authorised to access client lead data unless the client is informed and the required safeguards are in place.

8. Security measures

Benson Revenue maintains proportionate technical and organisational measures appropriate to the nature of the processing. Current measures include access restricted to authorised accounts, multi-factor authentication on business accounts where supported, password or PIN protection for business devices, regular backups of relevant business data, use of established cloud service providers, encrypted network connections where supported and prompt removal of access that is no longer required.

The client is responsible for securely granting and revoking CRM or system access and for maintaining the security of its own systems.

9. Sub-processors

The client authorises Benson Revenue to use the following sub-processor for project data where required by the agreed workflow:

Benson Revenue will ensure that required data protection obligations are imposed on sub-processors. Benson Revenue may add or replace a sub-processor where reasonably necessary for service delivery and will provide appropriate notice where required by law or the parties' agreement.

10. International transfers

Benson Revenue will not intentionally transfer client personal data to a third country without a lawful transfer mechanism where one is required. Where a sub-processor processes data outside the EEA, the applicable provider terms may rely on an adequacy decision, the EU-US Data Privacy Framework, Standard Contractual Clauses or another lawful safeguard.

11. Assistance with data subject rights

Taking into account the nature of the processing, Benson Revenue will provide reasonable assistance to the client in responding to requests from data subjects for access, correction, deletion, restriction, portability or objection where the request relates to data processed by Benson Revenue. If Benson Revenue receives a request directly relating to client-controlled data, it will normally forward the request to the client without responding on the client's behalf unless instructed or legally required to do so.

12. Security incidents

Benson Revenue will notify the client without undue delay after becoming aware of a personal data breach affecting client-controlled project data and will provide information reasonably available to support the client's legal assessment and notification duties.

13. Compliance assistance

Taking into account the nature of the processing and information available to Benson Revenue, Benson Revenue will provide reasonable assistance with the client's obligations concerning processing security, breach assessment, data protection impact assessments and consultations with supervisory authorities where those obligations relate to Benson Revenue's processing.

14. Deletion and return

At the end of the services, the client may request return or export of project personal data where reasonably possible. Benson Revenue will then delete remaining copies within the agreed period, normally 30 days, except where applicable law requires retention. Residual copies in routine backups may remain until overwritten under the normal backup cycle and will remain protected during that period.

15. Audit information

Benson Revenue will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and will reasonably cooperate with proportionate audits or inspections required by applicable data protection law. Audits must, where possible, avoid unnecessary disruption and protect the confidential information of Benson Revenue and other clients.

16. Client obligations

The client is responsible for ensuring that its collection and use of lead data is lawful, for providing required privacy notices and for having a lawful basis to instruct Benson Revenue to carry out the agreed outreach. The client must keep its instructions accurate and provide suppression, opt-out and restriction information needed for lawful processing.

17. Order of precedence

If this DPA conflicts with the main service agreement on a matter concerning personal data processing, this DPA controls for that matter. Mandatory data protection law always takes precedence.