GDPR and SDRclose

How SDRclose fits into your GDPR compliance

SDRclose is an outbound email platform. You choose the prospects, decide what is said to them and send from mailboxes you own. Under the GDPR that makes you the decision maker for the outreach, and it makes SDRclose the service that processes prospect data on your instructions.

Our part of the arrangement has four pieces. We process prospect data only as your configuration and the Data Processing Addendum direct. We disclose the categories of provider that data can reach and commit to notice before that list changes. We protect the data with the measures described on our Security page. And we build the tooling that makes opt-outs, deletion and retention straightforward to operate.

Your part is to have a lawful basis for each market you send into, to tell recipients how you obtained their details, and to act on objections and requests. The sections below walk through both sides. This page is general information about how the product works, not legal advice for your organization.

Roles: controller and processor

Prospect data. For the people you research and contact, you are the controller and SDRclose is the processor. Prospect data includes the contact records you mine or import, research notes, generated and hand-written drafts, sent messages, replies and engagement events. Your instructions to us are the filters, sequences, templates, approvals and settings you configure in the app, together with the terms of the Data Processing Addendum.

Account data. For your own information as a customer, SDRclose is the controller. Account data includes your name, sign-in email, profile picture where you sign in with Google or Microsoft, billing records, usage, notifications and operational logs. The Privacy Policy describes that processing.

Our own outreach. SDRclose runs outbound for its own product. For prospects contacted in that program, BiopharmaWatch LLC is the controller, and the same unsubscribe and request routes described on this page apply.

The distinction matters because the obligations sit in different places. Transparency to recipients, lawful basis and responding to a prospect's rights request are controller duties and rest with you. Security, sub-processor management, breach notification and assistance with requests are processor duties and rest with us.

The lawful basis for your outreach is yours

Using SDRclose does not supply a lawful basis for contacting anyone. You need one before a sequence starts, and you need to be able to show it.

For business-to-business outreach in the EEA and the UK the usual route is legitimate interests under Article 6(1)(f). That requires a balancing test, documented before sending, that considers whether the message is relevant to the recipient's role, whether they would reasonably expect it, how you obtained their details, and how easily they can object. Keep the record. Supervisory authorities ask for it.

Article 14 transparency applies when details did not come from the recipient. Say where the information came from and how to object, in the message or at first contact, and link to your own privacy notice.

Electronic marketing rules are national and differ across the EEA and the UK. Some markets require prior consent even for business-to-business email. You are responsible for confirming the rules of each market you send into and for documenting your lawful basis for that market. Where the position is unclear, take qualified advice for the country you are emailing into rather than the country you are based in. These commitments are also part of the Acceptable Use Policy.

The product is built to support the compliant version of this activity. Cold first touches carry no marketing links and do not propose meeting times. Every message sent through the platform carries an opt-out route, described under Data subject rights and the tools in the app below.

Where prospect data flows

Sending runs through your own connected mailboxes over standard mail protocols. There is no shared sending pool, and your prospects' addresses are not combined with any other customer's data.

Beyond hosting, prospect data reaches a third party only when you use a feature that needs one. We work with seven categories of sub-processor: infrastructure and hosting provider; payment processor; language-model and research providers; prospect data provider; scheduling and calendar provider; transactional email provider; professional advisers. The payment processor and the transactional email provider handle account data, not prospect data. Professional advisers see personal data only where a legal or accounting matter requires it.

The features that send prospect data outside our infrastructure, and what each sends, are:

• Lead mining sends your search filters to the prospect data provider and receives contact records back.
• Smart research sends a prospect's name, title and company to the research provider and receives notes drawn from public web sources.
• Generated copy, including generated replies, sends the prospect's details, research notes, the thread being answered and your writing instructions to the language-model provider.
• Auto-booking sends the prospect's name and email address to the scheduling and calendar provider when a meeting is offered or booked.

International transfers

BiopharmaWatch LLC is a United States company, and the providers listed above may process data outside the EEA and the UK. You should treat use of the platform as a restricted transfer and assess it as one.

The Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses in the controller-to-processor module for transfers from the EEA, the UK International Data Transfer Addendum for transfers from the UK, and the adaptations needed for transfers from Switzerland. Onward transfers to sub-processors are made under written terms that impose equivalent protections.

For your transfer impact assessment we provide, on request through the contact form, the named sub-processor schedule, the transfer mechanism each provider relies on and a description of the technical measures applied to data in transit and at rest. SDRclose does not currently offer a choice of hosting region.

Data subject rights and the tools in the app

Your own rights as a customer. Two controls sit in Settings > Privacy & Data. Download my data produces a JSON export of your profile, leads, drafts, sent mail, sequences and activity, with the password hash excluded and mailbox credentials redacted. Delete my account removes the account and its data from the live service after you confirm your password. It is irreversible. Residual copies fall out of routine backups within 30 days, and suppression records are retained as explained below. For correction, restriction or any other request about account data, use the contact form; we respond within one month, extendable by two months for complex requests, as set out in the Privacy Policy.

Requests from your prospects. When a prospect exercises a right against you, you answer as controller, and the app gives you the means to do so. Use CSV export and the conversation view to assemble what you hold about a person for an access request. Use per-lead delete for erasure. Add the address to the suppression list for an objection to direct marketing, which is absolute under Article 21(3) and must be honored. Where a prospect contacts SDRclose directly, we identify the sender from the message, refer the request to you without undue delay and help you answer it, as described in section 8 of the Data Processing Addendum and on the Privacy Center page.

Tooling that runs on every send. Outbound messages carry a one-click List-Unsubscribe header and an opt-out link. A recipient who uses either is added to the permanent suppression list and leaves every sequence at once. Reply detection classifies incoming mail, so a written unsubscribe request, a hard bounce or a reply removes the prospect from the sequence without anyone having to notice it first.

Opt-out and suppression records

When a recipient opts out, the address is added to a permanent do-not-contact list that spans every sequence and every connected mailbox in your account. A prospect imported again from a fresh list is blocked before a message is drafted.

Suppression records are retained after the account that sent the original message is deleted. Article 17(3)(b) permits retention where processing is necessary to comply with a legal obligation, and honoring an objection to direct marketing is such an obligation. If the record were deleted with the account, the same person could be contacted again and the objection they made would stop working.

What is kept is the suppression record itself, which is the minimum needed for the block to keep operating. It is not used for any other purpose. Recipients can also submit an address for permanent suppression through the Privacy Center.

Retention controls

By default, prospect data is retained for as long as your account is active and is removed from the live service when you delete a lead, a sequence or the account. Backups roll off within 30 days of deletion. Section 11 of the Data Processing Addendum sets out deletion and return at the end of the agreement.

For storage limitation under Article 5(1)(e), the app includes an optional data retention sweeper in Settings > Privacy & Data. It is off by default, and nothing is purged until you switch it on and choose a period between 7 and 730 days.

• Runs daily once enabled.
• Purges the bodies and subjects of replies, sent mail and finished drafts older than the period you set, together with old notifications and activity log entries.
• Keeps leads, meetings, delivery and outcome statistics and the suppression list, so reporting and opt-out enforcement continue to work.
• Cannot be undone. Purged content is not recoverable, so set the period to match your documented retention schedule.

Security measures

The technical and organizational measures that protect prospect data are described on the Security page and in the security annex of the Data Processing Addendum. In summary: all traffic is encrypted in transit; mailbox credentials and access tokens are encrypted at rest; passwords are stored only as salted hashes; sign-up requires email verification; authentication is protected by rate limiting and lockout; production data stores are not exposed to the public internet; every endpoint validates its input; personal data is masked in operational logs; backups are encrypted and taken routinely; payment card data never touches our systems; and account deletion requires re-authentication.

We notify you of a personal data breach affecting customer data without undue delay and, where feasible, within 72 hours after we confirm it, with the detail described in section 10 of the Data Processing Addendum, so that you can meet your own notification deadlines under Articles 33 and 34.

We do not currently hold third-party certifications. We answer security questionnaires and share our security documentation with prospective customers on request, under NDA where appropriate.

Paperwork: DPA, sub-processor schedule and questionnaires

Data Processing Addendum. Our Data Processing Addendum is published online and forms part of the Terms of Service whenever we process prospect data on your behalf. No separate signature is needed for it to bind both parties. Where your procurement process requires a countersigned copy, request one through the contact form and we will return it in writing.

Sub-processor schedule. The Sub-processors page lists categories. The named schedule, with the purpose, data processed and transfer mechanism for each provider, is provided on request and attached to the addendum as a schedule for customers who need it in their vendor file.

Questionnaires and assessments. Send vendor security or privacy questionnaires through the contact form. The SDRclose team completes them in writing during business hours and can walk your assessor through the answers by written message. If your assessment depends on a specific certification, raise it before you sign up so that you know where you stand.

Where these documents differ, a signed order form or enterprise agreement takes precedence, followed by the Data Processing Addendum, the Terms of Service, the Acceptable Use Policy, and then the Privacy Policy and Cookie Policy, which are notices rather than contracts.