Legal

Data Processing Agreement

Outrun’s data processing terms for customers, under Article 28 UK GDPR.

Draft. Last updated 23 October 2026

Parties and scope

This Data Processing Agreement (“DPA”) forms part of the Outrun terms (the “Agreement”) between PRWN LTD, trading as Outrun, a company registered in England and Wales (company number 16554885), registered office 12 The Oaks, Sunderland, SR2 8EX, United Kingdom (“Outrun”, the processor), and the customer that accepts it (the “Customer”, the controller). It applies when Outrun processes Customer Personal Data on the Customer’s behalf, and it is intended to meet Article 28(3) of the UK GDPR.

Business contact data that Outrun includes in digests is collected and processed by Outrun as an independent controller, as explained in the privacy notice. Once the Customer receives it, the Customer is an independent controller of any data it uses. That data is not Customer Personal Data under this DPA.

Definitions

  • Data Protection Law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, and, where they apply, the EU GDPR and other data protection laws.
  • Customer Personal Data: personal data that the Customer or its users provide to Outrun, or that Outrun processes on the Customer’s instructions, to provide the service.
  • Subprocessor: any processor Outrun engages to process Customer Personal Data.
  • Terms such as controller, processor, data subject, personal data breach and processing have the meanings given in the UK GDPR.

Details of the processing

  • Subject matter and duration: providing the Outrun service under the Agreement, for its term and until deletion under the Return and deletion section.
  • Nature and purpose: hosting, storing, matching, organising and transmitting data to deliver digests, apply the Customer’s ideal customer profile, exclusion and suppression lists, and send or post digests through integrations the Customer connects.
  • Categories of data subjects: the Customer’s users and team members, and people in contact or exclusion lists or CRM records that the Customer provides or connects.
  • Types of personal data: names, work email addresses, job titles, employer, account settings and feedback, and the business contact fields in lists or records the Customer provides. No special category data is intended to be processed.

Outrun’s obligations

Outrun will:

  • process Customer Personal Data only on the Customer’s documented instructions, including those in the Agreement and given through the service, unless the law requires otherwise, in which case it will tell the Customer first unless the law forbids that (Article 28(3)(a));
  • tell the Customer promptly if it believes an instruction breaks Data Protection Law;
  • ensure that people authorised to process Customer Personal Data are bound by confidentiality (Article 28(3)(b));
  • apply the security measures in the Security section (Articles 28(3)(c) and 32);
  • use subprocessors only as set out in the Subprocessors section (Articles 28(2) and 28(4));
  • taking into account the nature of the processing, help the Customer respond to data subject requests (Article 28(3)(e));
  • help the Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36), taking into account the information available to Outrun (Article 28(3)(f));
  • delete or return Customer Personal Data at the end of the service (Article 28(3)(g)); and
  • make available the information needed to show compliance with Article 28 and allow for and contribute to audits (Article 28(3)(h)).

Customer obligations

The Customer is responsible for having a lawful basis for the Customer Personal Data it provides and for the instructions it gives, and for its own use of digests, including PECR rules on electronic marketing and honouring objections.

Subprocessors

The Customer gives general written authorisation for Outrun to engage subprocessors. The current list is at outrun.so/subprocessors. Outrun will give the Customer at least 14 days’ notice of a new subprocessor, by email to the account owner or by updating that page if the Customer has asked to be told of changes, and the Customer may object on reasonable data protection grounds. If the parties can’t resolve the objection, the Customer may end the affected service and receive a refund of prepaid fees for the unused period. Outrun will put written terms in place with each subprocessor that give at least the same protection as this DPA, and remains liable for its subprocessors’ performance.

International transfers

Outrun may transfer Customer Personal Data outside the UK only where Data Protection Law allows it: to a country covered by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified recipients), or under the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018, with a transfer risk assessment where required. Where the EU GDPR applies to the Customer, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), module two or three as appropriate, apply to restricted transfers and are incorporated by reference.

Security

Outrun maintains appropriate technical and organisational measures, including encryption in transit, encryption at rest provided by its hosting providers, role-based access controls and least-privilege access to production systems, row-level security in its database, logging of administrative access, regular backups, and secure development practices. Outrun may update these measures if the overall level of protection is not reduced.

Personal data breaches

Outrun will notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information Article 33(3) requires, as far as it is available, and Outrun will take reasonable steps to contain and remedy the breach.

Audits

On written request, and no more than once a year unless a regulator requires it or there has been a breach, Outrun will provide information reasonably necessary to show compliance with this DPA, such as written answers to security questionnaires. Where that is not enough, the Customer may carry out an audit on 30 days’ notice, during business hours, at its own cost and under confidentiality.

Return and deletion

When the Agreement ends, Outrun will, on the Customer’s request, delete or anonymise Customer Personal Data, or return it first if the Customer asks within 30 days of the end, and will reply to the request within one month, unless the law requires Outrun to keep it. Backups are overwritten in the normal backup cycle.

General

If this DPA conflicts with the Agreement, this DPA prevails for data protection matters. If it conflicts with the IDTA, the Addendum or the Standard Contractual Clauses, those prevail. Liability under this DPA is subject to the limits in the Agreement, unless the law forbids that. This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

To sign a countersigned copy, email hello@outrun.so.