Last updated: 17/10/2026
This agreement forms part of Rivolt's general terms of use and sale (article 11.8) and applies to every Client from the signature of the Commercial Proposal. It sets out how Rivolt processes personal data on the Client's behalf, in accordance with article 28 of the GDPR.
1. Roles
For the personal data of prospects processed in campaigns run on the Client's behalf, the Client is the data controller and Rivolt the processor. For data about the Client's account and representatives, Rivolt is the data controller, as described in the privacy policy.
2. Rivolt's obligations as processor
Rivolt undertakes to:
- process the data only on the Client's documented instructions, set out in the Commercial Proposal and in written exchanges with the Client;
- tell the Client without delay if, in its view, an instruction breaches data protection law;
- ensure that everyone authorised to process the data is bound by confidentiality;
- implement the technical and organisational measures required by article 32 of the GDPR, described in the security page;
- help the Client answer requests from data subjects, and pass on without delay any request it receives directly;
- assist the Client with security, breach notification and, where relevant, impact assessments (articles 32 to 36 of the GDPR);
- make available the information needed to demonstrate compliance with this agreement, and allow reasonable audits by the Client or an auditor it appoints, with prior notice;
- at the end of the Contract and at the Client's choice, return or delete the data and existing copies, unless the law requires them to be kept.
3. Business prospecting
Rivolt runs prospecting in line with article L.34-5 of the French Postal and Electronic Communications Code and CNIL guidance: people are contacted because of their professional role, for offers related to it; every message offers a way to object; and every objection is added to a suppression list that applies across all campaigns.
Where the Client supplies its own files or targets, it guarantees that it has a legal basis, has informed the people concerned as required and respects their right to object.
4. Data breaches
Rivolt notifies the Client of any personal data breach as soon as possible after becoming aware of it, and in any event within 48 hours, with the information the Client needs to notify the CNIL within the 72 hours set by article 33 of the GDPR.
5. Sub-processors
The Client authorises Rivolt to use the sub-processors listed in appendix 2. Rivolt updates that list before a new sub-processor processes any personal data, and the Client may object on reasonable grounds within 30 days of the update. Each sub-processor is bound by data protection obligations equivalent to those of this agreement. Transfers outside the European Union are governed by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Appendix 1. Description of the processing
Data subjects
Professionals working at the companies the Client targets, and people who reply to campaigns.
Categories of data
Name, job title, company, professional email address, public professional profile, public signals about the company, and the content of replies. No special category of data within the meaning of article 9 of the GDPR.
Purpose
Running B2B prospecting campaigns for the Client and handling the replies.
Operations
Collection from public sources and data providers, enrichment, storage, sending of messages, reply handling, reporting, deletion.
Duration
The term of the Contract, then return or deletion at the Client's choice. The suppression list is kept as long as needed to honour objections.
Appendix 2. Sub-processors
The up-to-date list of sub-processors, with the date of its last change