Last updated: 08/11/26
This Data Processing Agreement ("DPA") forms part of the Agreement between Venava Ltd ("Venava", the processor) and the client named in the Order (the "Client", the controller). It applies whenever Venava processes personal data on the Client's behalf. Terms such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR.
1. Roles
1.1 The Client is the controller and Venava is the processor of Client Personal Data, meaning personal data that the Client provides to Venava, or that Venava collects on the Client's instructions, to deliver the services.
1.2 Where Venava sources business contact data itself to build a target list, Venava acts as an independent controller of that data until it is delivered to the Client. Once delivered, the Client is the controller of its copy. Solicitor to confirm.
1.3 Each party will comply with the data protection law that applies to it, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
2. Client responsibilities
The Client confirms that it has a lawful basis for the processing it instructs, has given any required privacy information to the people concerned, and that its instructions comply with data protection law.
3. Venava's obligations
Venava will:
- process Client Personal Data only on the Client's documented instructions, including those in the Agreement and the Order, unless the law requires otherwise (in which case Venava will tell the Client first, unless the law prevents it);
- tell the Client promptly if it believes an instruction breaks data protection law;
- make sure everyone authorised to process Client Personal Data is bound by confidentiality;
- put in place the technical and organisational security measures in Annex 2;
- follow clause 4 when using sub-processors;
- help the Client, taking into account the nature of the processing, to respond to requests from individuals exercising their rights;
- help the Client meet its obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information available to Venava;
- at the end of the services, delete or return Client Personal Data at the Client's choice, unless the law requires Venava to keep it; and
- make available the information reasonably needed to show compliance with this DPA, and allow for and contribute to reasonable audits by the Client or its auditor, on at least 30 days' written notice and no more than once a year unless a breach has occurred.
4. Sub-processors
4.1 The Client gives Venava general authorisation to use the sub-processors listed on our Sub-processors page.
4.2 Venava will give the Client at least 14 days' notice before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, either party may end the affected services.
4.3 Venava will put a written contract in place with each sub-processor that gives at least the same level of protection as this DPA. Venava remains responsible to the Client for its sub-processors.
5. Personal data breaches
Venava will notify the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. Venava will give the Client the information it reasonably needs to meet its own reporting obligations and take reasonable steps to contain the breach.
6. International transfers
Venava will only transfer Client Personal Data outside the UK where a lawful transfer mechanism is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. Liability and duration
7.1 Each party's liability under this DPA is subject to the limits in the Agreement.
7.2 This DPA lasts for as long as Venava processes Client Personal Data.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Delivery of the services set out in the Order |
| Duration | The term of the Order, plus the time needed to return or delete data |
| Nature and purpose | Creating and running marketing campaigns, account-based marketing programmes and event activations, including outreach, invitations, lead capture, follow-up and reporting |
| Categories of individuals | The Client's staff and contacts; prospects, customers and event guests of the Client |
| Types of personal data | Name, job title, company, work email, work phone, LinkedIn profile URL, event attendance and responses, communication history |
| Special category data | None. The Client must not provide special category data |
Annex 2: Security measures
- Access to Client Personal Data limited to people who need it, with multi-factor authentication on all accounts that hold it
- Data encrypted in transit and at rest by our providers
- Client Personal Data kept only in approved tools listed on our Sub-processors page
- Client data kept separate by client within our tools
- Data deleted or returned at the end of each engagement
- Sub-processors chosen for their security standards and bound by written contracts