BuyerRecon – Data Processing Agreement (Summary)

Effective Date: 24 March 2026

This is a summary of the key terms of the Data Processing Agreement (“DPA”) between Keigen Technologies UK Limited (Processor) and the Customer (Controller). It is provided for convenience only, and the full DPA is incorporated into the Terms of Service by reference.

Status of This Summary

This document is a summary of the key terms of the Data Processing Agreement (“DPA”) between Keigen Technologies UK Limited (Processor) and the Customer (Controller). It is provided for convenience only and does not replace the full DPA. The full DPA is available upon request or through the contracting process, is incorporated into the Terms of Service by reference, and prevails in the event of any conflict with this summary.

Unless the parties execute a separate written DPA, Customer’s acceptance of the Terms of Service or an Order Form incorporating those Terms constitutes acceptance of the applicable DPA.

1. Roles

In relation to personal data processed by BuyerRecon on behalf of a customer in connection with that customer’s website or systems, the customer is the controller and Keigen is the processor, unless otherwise agreed in writing.

Keigen may also process limited personal data as an independent controller for its own business purposes, including account administration, billing, security, abuse prevention, service integrity, and legal compliance.

2. Scope of Processing

• Data subjects: website visitors to Customer’s website, Customer’s employees and contacts.
• Data categories: IP addresses, online identifiers, company identifiers, page-view data, session data, CRM data shared by Customer.
• Processing activities: organisation-level visitor resolution, intent scoring, data enrichment, analytics, lead qualification.

3. Sub-Processors

Keigen uses the sub-processors listed on our Sub-Processors page. Where we intend to add a new sub-processor that materially affects data protection, we will provide at least 30 days’ notice. Customer may object on reasonable data protection grounds; if the objection cannot be resolved, Customer may terminate the affected Service.

4. International Transfers

Where personal data is transferred outside the UK and EEA, Keigen uses adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or other valid safeguards under applicable law, together with appropriate supplementary measures where required.

5. Security

Keigen implements technical and organisational measures including: encryption (TLS 1.2+, AES-256 at rest), access controls, audit logging, vulnerability management, incident response procedures, and regular security assessments.

6. Breach Notification

Keigen shall notify Customer without undue delay and within 72 hours of becoming aware of a personal data breach, providing sufficient detail for Customer to fulfil its own notification obligations.

7. Data Subject Rights

Keigen assists Customer in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) within the timeframes required by applicable law.

8. Audit

Customer may audit Keigen’s compliance with the DPA upon reasonable notice, not more than once per year, subject to confidentiality obligations.

9. Limitation of Liability

Any liability arising out of or in connection with the DPA is subject to the limitation-of-liability provisions set out in the Terms of Service, and the aggregate liability of each party under the Terms of Service and the DPA is combined, not cumulative.

10. Data Return and Deletion

Upon termination or expiration of the relevant Agreement, Customer has a 30-day period to export its Personal Data. Following that export period, Keigen will permanently delete Personal Data processed on behalf of Customer within a further 30 days (that is, within 60 days of termination), except where retention is strictly required by applicable law.