Data Processing Addendum
Effective October 16, 2026
This addendum ("DPA") is part of the Terms of Service between you ("Customer", the controller) and ValidationCheck ("ValidationCheck", the processor). It applies when we process personal data contained in Customer Data on your behalf, and is designed to meet Article 28 of the GDPR and the UK GDPR. It takes effect when you accept the Terms; no signature is needed. If you need a countersigned copy, email support@validationcheck.net.
1. Processing details
| Subject matter and purpose | Validating and assessing the risk of email addresses, phone numbers, IP addresses, and domains you submit, and returning the results. |
|---|---|
| Nature | Collection, storage, lookup against reference data and third-party sources, transmission of results, deletion. |
| Data subjects | People whose contact details or IP addresses you submit: typically your users, leads, and customers. |
| Personal data | Email addresses, phone numbers, IP addresses, domains, and results derived from them (for example carrier, line type, approximate location). |
| Special categories | None intended. Don't submit special-category data. |
| Duration | The term of the agreement. Inputs and results are deleted after 30 days, or immediately with 0-day retention turned on in Settings. |
2. Our obligations
- Process personal data only on your documented instructions, which are the Terms, this DPA, and your use of the Service, unless the law requires otherwise (in which case we'll tell you, unless the law forbids it).
- Make sure everyone authorized to process it is bound by confidentiality.
- Apply the security measures in section 4.
- Use subprocessors only as described in section 3.
- Help you respond to data subject requests and with security, breach notification, impact assessments, and prior consultation, taking into account the nature of the processing.
- Notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your obligations.
- At the end of the agreement, delete your personal data (it's deleted on a rolling 30-day basis anyway) unless the law requires us to keep it.
- Make available the information needed to show compliance with this DPA, and allow audits by you or an auditor you appoint, on reasonable notice, at most once a year unless required by a regulator or after a breach.
3. Subprocessors
You authorize the subprocessors on our Subprocessors page. We'll give at least 30 days' notice (by email to account owners and on that page) before adding or replacing one. You can object on reasonable data protection grounds; if we can't address the objection, you may terminate the affected Service and get a pro-rata refund of prepaid fees. We impose data protection terms on each subprocessor that are at least as protective as this DPA and remain responsible for them.
4. Security measures
- Encryption in transit (TLS 1.2+) and at rest; API keys stored as SHA-256 hashes; secrets encrypted with AES-GCM.
- Data minimization: lookups are retained for 30 days at most, with an option for 0-day retention.
- Per-organization isolation of balances, caches, and history; least-privilege access for our staff, protected by single sign-on and two-factor authentication, with access logging.
- Role-based access for your team, optional per-key IP allowlists and scopes, and an audit log of key, billing, and team changes.
- Infrastructure on Cloudflare's network with DDoS protection; dependency and code review before release.
5. International transfers
Where personal data is transferred outside the EEA, UK, or Switzerland to a country without an adequacy decision, the EU Standard Contractual Clauses (module 2, controller to processor, and module 3 for onward transfers) and the UK International Data Transfer Addendum are incorporated into this DPA by reference.
6. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where the law doesn't allow those limits. If this DPA conflicts with the Terms on data protection, this DPA wins; if it conflicts with the Standard Contractual Clauses, the Clauses win.