Roles
For the addresses you upload, you are the controller and VerifyingPro LLC is the processor. We process that data only on your documented instructions — which, in normal use, means the verification you request through the application or API.
What is processed
| Subject matter | Verification of email addresses supplied by you |
|---|---|
| Duration | Until results are downloaded, or 14 days, whichever comes first |
| Nature and purpose | Automated checking of syntax, domain records and mailbox acceptance |
| Personal data | Email addresses, and any other columns present in an uploaded file |
| Data subjects | The people those addresses belong to — typically your contacts |
Our obligations
We will:
- process personal data only on your instructions, unless the law requires otherwise
- keep it confidential and bind our staff to the same
- apply the security measures described below
- help you respond to data subject requests
- delete it in line with the retention periods you can see in the application
- make available the information you need to show compliance
Security measures
- TLS on all connections
- credentials and processing code stored outside the public web root
- passwords hashed with bcrypt; session tokens stored only as SHA-256 hashes
- access to production limited to named administrators
- an append-only audit log of privileged actions
Sub-processors
We use a hosting provider, a payment processor and an email provider. Each is bound to equivalent obligations. We will give you at least 30 days' notice before adding or replacing one, and you may object.
International transfers
Processing takes place in the European Union. Any transfer outside it relies on Standard Contractual Clauses.
Breach notification
We will tell you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data, with enough detail for you to meet your own obligations.
Deletion and return
Uploaded lists are deleted when results are downloaded and automatically after 14 days. On account closure everything is removed within 30 days. You can export results as CSV at any time before then.
Audit
On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will answer questions needed to demonstrate compliance with this agreement.
Signing a copy
A countersigned DPA is available on request and provided as standard on the Bureau tier. Write to legal@verifyprollc.com.