Glossary
What is a data processing agreement (DPA)?
A data processing agreement, or DPA, is the contract the GDPR requires between a company that decides how personal data is used, the controller, and a supplier that processes the data on its behalf, the processor. It sets out what the supplier may do with the data, how it is protected and which sub processors are used.
Published by Sellinger AI. Numbers and settings checked on 24 October 2026 against the fact register. Report an error.
What must a DPA cover?
- The subject, duration, nature and purpose of the processing.
- The types of personal data and the people concerned.
- That the processor acts only on the controller's instructions.
- Confidentiality and security measures.
- Rules for sub processors.
- Help with data subject requests and breaches.
- Deletion or return of data at the end.
Who is the controller in outreach?
Usually you. When you use a sales tool to contact prospects, you decide whom to contact and why, so you are the controller and the tool is a processor for that data. That is why you need a DPA with every tool that holds your prospect data.
What should you check in a supplier's DPA?
| Check | Why |
|---|---|
| Sub processor list | Shows who else touches the data and where |
| Data location | Matters for transfer rules |
| Breach notice time | You may have your own deadline to report |
| Deletion on exit | Your data should not outlive the contract |
How Sellinger handles it
Sellinger publishes its data processing agreement. Where data sits: database, sign in and file storage on Supabase (Amazon Web Services, Stockholm). Application servers and background workers on Google Cloud (Finland). Web hosting on Vercel. An erasure function takes an email address, phone number or LinkedIn address, anonymizes the matching leads in the workspace and adds the identifiers to the suppression list so the person cannot be imported and contacted again.
Common questions
Do I need a DPA with my sales tools?
Is a DPA the same as a privacy policy?
Where is Sellinger's DPA?
Sources and method
GDPR Article 28 requirements in summary. Sellinger hosting and erasure from the fact register, checked 24 October 2026. This is not legal advice.
Related: Sellinger DPA, GDPR legitimate interest, Security, Privacy policy.
