MarketMapr Data Processing Addendum
Last updated 9 October 2026
1. Scope, parties and roles
This Data Processing Addendum ("DPA") forms part of the agreement between MARKETMAPR LIMITED (company number 15426945) ("MarketMapr", the "Processor") and the Customer identified in the account or order form (the "Controller"), and applies where MarketMapr processes personal data contained in Customer Content on the Customer's behalf in providing the Services, as described in Annex A.
For clarity, this DPA does not apply to: (a) Licensed Data made available to the Customer through the platform, in respect of which each party is an independent controller as set out in the Terms of Service; or (b) account, billing and usage data, for which MarketMapr is a controller as described in its Privacy Policy. In case of conflict between this DPA and the Terms of Service in relation to processing of Customer Content, this DPA prevails.
2. Definitions
"Data Protection Law" means UK GDPR, the Data Protection Act 2018 and, where applicable, EU GDPR; "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in Data Protection Law. "Customer Content" has the meaning given in the Terms of Service (data and content the Customer uploads to the Services). "Subprocessor" means a third party engaged by MarketMapr to process Customer Content.
3. Our obligations as processor
MarketMapr will:
- process Customer Content only on the Customer's documented instructions — these terms, the platform's features as operated by the Customer and its Authorised Users, and any further written instructions agreed between the parties — unless required to process otherwise by law, in which case we will inform the Customer unless the law prevents it; and inform the Customer if, in our opinion, an instruction infringes Data Protection Law;
- ensure persons authorised to process Customer Content are bound by confidentiality obligations;
- implement and maintain appropriate technical and organisational measures to protect Customer Content, taking into account the nature of the processing, as described in Annex C (Article 32);
- taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to data-subject rights requests concerning Customer Content, and assist the Customer in meeting its obligations under Articles 32–36 (security, breach notification, DPIAs and prior consultation), at the Customer's reasonable cost where the request is material;
- notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content, providing information reasonably available to us to support the Customer's own notification obligations;
- at the Customer's choice, delete or return Customer Content at the end of the Services (the Terms of Service provide a 30-day export window after termination, after which Customer Content is deleted), and delete remaining copies unless law requires storage — residual copies in backups are deleted in the ordinary rotation cycle and remain protected until then; and
- make available information reasonably necessary to demonstrate compliance with this DPA, and allow and contribute to audits — in the first instance by providing documentation and completed security questionnaires; an on-site or remote audit may be conducted no more than once in any 12-month period, on at least 30 days' notice, at the Customer's cost, during business hours, without access to other customers' data.
4. Subprocessors
The Customer gives general written authorisation for MarketMapr to engage Subprocessors to provide the Services. The current list is in Annex B. We will give at least 14 days' notice of intended additions or replacements (by updating Annex B and/or by email); the Customer may object on reasonable data-protection grounds within that period, and if the objection cannot be resolved the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees. We will impose data-protection obligations on each Subprocessor materially equivalent to those in this DPA, and remain liable for Subprocessors' performance.
5. International transfers
MarketMapr will not transfer Customer Content outside the UK (or the EEA, where EU GDPR applies) unless the transfer is to a country covered by adequacy regulations or is subject to appropriate safeguards — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — together with any supplementary measures reasonably required. Annex B identifies each Subprocessor's processing location and transfer mechanism.
6. Liability and term
This DPA takes effect when the Customer first uses the Services and continues for as long as MarketMapr processes Customer Content. Each party's liability under this DPA is subject to the exclusions and cap in section 16 of the Terms of Service, except to the extent Data Protection Law does not permit liability to data subjects or supervisory authorities to be limited. Nothing in this DPA relieves either party of its own direct obligations under Data Protection Law.
Annex A — Processing details
| Item | Description |
|---|---|
| Subject matter | Hosting and processing of Customer Content in the MarketMapr platform |
| Duration | The subscription term, plus the post-termination export window and backup rotation |
| Nature and purpose | Storage; display; search and filtering; enrichment and monitoring initiated by the Customer; AI-powered analysis at the Customer's direction; export; integrations the Customer enables |
| Categories of data subjects | Candidates, hiring managers and business contacts whose details the Customer uploads; the Customer's Authorised Users |
| Categories of personal data | Names, job titles, employers, career and education history, skills, contact details, public profile links and photographs, location, notes and tags added by the Customer |
| Special category data | None intended; Customers are instructed not to upload special category data |
Annex B — Subprocessors
| Subprocessor | Service | Location | Transfer mechanism |
|---|---|---|---|
| DigitalOcean | Cloud hosting and infrastructure | UK (London) | Not required (UK) |
| Stripe | Payment processing | US/EU | UK IDTA / SCCs + addendum |
| Mapping and geocoding services | US/EU | UK IDTA / SCCs + addendum | |
| Mailgun | Email delivery | EU (EEA) | UK adequacy regulations (EEA) |
| Anthropic | AI analysis features | US | UK IDTA / SCCs + addendum |
Services that process Customer Content only at the Customer's direction — enrichment services the Customer chooses to run, and third-party products the Customer connects through integrations (such as the Customer's own ATS or CRM) — act on the Customer's instructions as described in section 11 of the Terms of Service and are not Subprocessors under this DPA, and are therefore not listed above.
Annex C — Technical and organisational measures
Measures include: encryption of data in transit (TLS); authentication and role-based access controls, with access to production systems restricted to authorised personnel; logical segregation of each customer's workspace and data; logging and monitoring of production systems; daily backups with a fixed rotation cycle, stored securely; vulnerability management and timely patching; vendor due diligence for subprocessors; confidentiality obligations for personnel; and an incident-response process covering detection, escalation, customer notification and remediation.