Data Processing Agreement

1. Definitions

"Customer" means the organisation or individual that has an account with MunchReach. "MunchReach", "we" or "us" means the provider of the MunchReach platform.

"Customer Data" means personal data and other information that the Customer uploads to, connects to, sends through or generates in the platform. "Personal data" means information relating to an identified or identifiable person. "Processing" means any operation performed on personal data. "Subprocessor" means a third party engaged by MunchReach to process personal data on the Customer's behalf.

"Agreement" means the MunchReach Terms of Service. This Data Processing Agreement ("DPA") forms part of it.

2. Scope

This DPA applies whenever MunchReach processes Customer Data on behalf of the Customer while providing the platform, including lead and contact records, Campaign data, Email Messages, Connected Mailbox data, Sending Activity, replies, conversations and Analytics.

It does not apply to data MunchReach processes for its own purposes, such as billing records and account administration, which are covered by the Privacy Policy.

3. Roles of the parties

The Customer is the controller of the Leads and Contacts it uploads, the Recipients it selects, the Connected Mailboxes it authorizes and the Email Messages it sends. The Customer decides what data to process, who to contact and what to say.

MunchReach is the processor for that Customer Data and acts on the Customer's documented instructions. For its own account administration, billing, security, fraud-prevention and support records, MunchReach acts as a controller where applicable.

4. Processing instructions

MunchReach processes personal data only to provide, secure, support and improve the platform, and only as instructed by the Customer through the product interface, the documentation and this DPA.

MunchReach does not sell customer data, does not use recipient data to build its own contact database, and does not use customer content for purposes unrelated to delivering the service.

If MunchReach believes an instruction is unlawful, it will inform the Customer and may pause the affected processing.

5. Personal data processed

Lead and contact records supplied by the Customer, including email addresses, names, company information, job details, lists, suppression status and custom fields the Customer chooses to import or create.

Campaign and Sequence data, including Recipients, templates, personalized content, schedules and Email Messages authored or approved by the Customer.

Connected Mailbox and Sending Account data needed to authenticate connections, send Email Messages and synchronize replies and conversations.

Sending Activity and Analytics, including delivery evidence, opens, clicks, bounces, complaints, unsubscribes, replies, conversation history and campaign performance.

Account data for the Customer's own users: name, email address, role, workspace membership and authentication metadata.

6. Data subjects

The people whose data is processed are the Customer's own users and team members, and the recipients and prospects the Customer chooses to contact through the platform.

7. Security

Access to customer data is restricted to the workspace it belongs to and enforced at the database level, so one workspace cannot read another's records.

Data is transmitted over encrypted connections (TLS) and stored on managed infrastructure that encrypts data at rest. Provider credentials and API keys supplied by the Customer are stored encrypted and are never returned to the browser.

Administrative access is limited to staff who need it for support and operations, and privileged actions are recorded in an audit log.

MunchReach describes only the controls it actually operates. No certification, audit report or compliance attestation is claimed on this page; where a certification is required, contact us before relying on one.

8. Confidentiality

Personnel with access to personal data are bound by confidentiality obligations and only access customer content when needed to operate the service, investigate an incident, or respond to a support request from the Customer.

9. Subprocessors

The Customer authorises MunchReach to engage subprocessors to deliver the service — for example email delivery infrastructure, database hosting and application hosting.

The current list is published on the Subprocessors page and is kept up to date. MunchReach imposes data protection obligations on each subprocessor no less protective than those in this DPA and remains responsible for their performance.

MunchReach will update that page before a new subprocessor begins processing customer personal data. Customers who object may raise the objection through Contact Support.

10. International data transfers

Personal data may be processed in the countries where our subprocessors operate; the location of each is listed on the Subprocessors page.

Where a transfer mechanism such as Standard Contractual Clauses is required for the Customer's jurisdiction, contact MunchReach so the applicable terms can be agreed in writing. This page does not itself incorporate any transfer mechanism.

11. Data breach notification

If MunchReach becomes aware of a security incident that leads to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of customer personal data, it will notify affected Customers without undue delay.

The notification will describe what is known about the incident, the categories of data involved, the measures taken, and the contact point for further information. Confirmed platform-wide incidents are also published on the User Guide & Alerts page.

12. Data subject requests

The Customer can access, export, correct and delete supported Lead and Contact records directly in the platform, which is generally the fastest way to satisfy a request from one of its Recipients.

If a data subject contacts MunchReach directly, we will refer them to the relevant Customer unless legally required to respond, and will assist the Customer in responding where the request concerns data we hold.

Individuals can submit a request through the Remove My Data page.

13. Retention and deletion

Customer personal data is retained while the account is active. Leads and Contacts, Campaigns, Email Messages, conversation data and Connected Mailbox data are deleted or disconnected through the applicable product and support workflows.

At the Customer's choice, and subject to applicable law, MunchReach will delete or return Customer Data at the end of the Service. Data that cannot reasonably be returned through product export may be deleted instead.

After an account is closed, remaining customer data is deleted or anonymised within a reasonable period, except where a record must be kept for billing, tax, fraud prevention or legal reasons.

The Customer can request deletion at any time through Contact Support or the Remove My Data page.

14. Audit rights

On reasonable written request and no more than once a year, MunchReach will provide the information reasonably necessary to demonstrate compliance with this DPA, including a written description of the applicable controls.

On-site audits are available only where required by law and must be agreed in advance, scheduled to avoid disruption, and conducted under confidentiality.

15. Termination

This DPA remains in force for as long as MunchReach processes personal data for the Customer. On termination, MunchReach stops processing except as needed to complete deletion, and deletes the data in accordance with section 13.

16. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Agreement. Nothing in this DPA limits liability that cannot be limited under applicable law.

17. Contact

Questions about this DPA, or a request for a signed copy: support@munchreach.com.

Effective date: 22 August 2026. Last updated: 22 August 2026.