Last updated: April 30, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service or any equivalent written agreement (the "Agreement") between SUBLAKE Holdings LLC ("SUBLAKE", "we", "us", or "Processor") and the customer that has accepted those terms ("Customer" or "Controller") and governs the processing of Customer Personal Data by SUBLAKE on behalf of the Customer under the GDPR, the UK GDPR, and the Swiss FADP.
By accepting the Terms of Service or executing a separate order form, Customer acknowledges and agrees to be bound by this DPA. Customers requiring a counter-signed PDF for their internal records can request one at contact@sublake.com.
This DPA reflects the parties' agreement on the processing of Customer Personal Data in accordance with the requirements of applicable Data Protection Laws. It is entered into pursuant to Article 28 of the GDPR.
In the event of any conflict or inconsistency between this DPA and any other terms of the Agreement, this DPA shall prevail with regard to the parties' data protection obligations.
The following terms have the meanings set out below. Capitalized terms not otherwise defined have the meaning given to them in the Agreement or applicable Data Protection Law:
For the purposes of this DPA, in respect of Customer Personal Data:
Each party shall comply with its respective obligations under Data Protection Laws. The Agreement, the Services Customer enables, and Customer's configurations constitute Customer's complete documented instructions to SUBLAKE for the Processing of Customer Personal Data.
Subject matter & duration: Provision of the SUBLAKE Services for the term of the Agreement.
Nature & purpose: SUBLAKE processes Customer Personal Data to provide the Services as described in the Agreement, including AI-assisted contact extraction, deal detection, message routing, automated replies, analytics, and integration with Customer-authorized third-party channels (Gmail, Outlook, Calendar, Stripe, social platforms, etc.).
Categories of Data Subjects: Customer's end users, contacts, leads, prospects, customers, employees, and any individuals whose data Customer chooses to import or who appear in messages routed through the Services.
Categories of Personal Data: Identity data (name, title), contact data (email, phone, address), professional data (employer, role), communication content (emails, messages, notes), behavioural data (engagement metrics), and any other Personal Data Customer chooses to submit.
SUBLAKE shall implement and maintain appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including:
Customer authorises SUBLAKE to engage Sub-Processors to process Customer Personal Data. SUBLAKE's current Sub-Processors are:
| Sub-Processor | Service | Region |
|---|---|---|
| Supabase, Inc. | Database, authentication, storage | US |
| Vercel, Inc. | Application hosting, CDN, edge runtime | Global |
| Anthropic, PBC | AI extraction and generation (Claude) | US |
| Resend, Inc. | Transactional email delivery | US |
| Loops, Inc. | Marketing email + lifecycle tracking | US |
| Stripe, Inc. | Payment processing | US |
| Functional Software, Inc. (Sentry) | Error monitoring | US |
SUBLAKE shall enter into a written agreement with each Sub-Processor imposing data protection obligations no less protective than those set out in this DPA.
SUBLAKE will provide notice of any intended additions or replacements of Sub-Processors at least 30 days in advance via email to the Customer's designated billing contact and via the SUBLAKE website. Customer may object on reasonable grounds during the notice period.
Where Customer Personal Data of EU, UK, or Swiss data subjects is transferred outside the EEA, UK, or Switzerland to a country not deemed adequate by the European Commission (or equivalent authority), the parties agree that the transfer is governed by the European Commission's 2021 Standard Contractual Clauses (Module Two: Controller-to-Processor), as supplemented by the UK Addendum and the Swiss FADP equivalent terms, which are incorporated by reference into this DPA.
SUBLAKE will implement supplementary measures (encryption, access controls, transparency reporting) consistent with EDPB Recommendations 01/2020 to ensure essentially equivalent protection.
SUBLAKE provides Customer with self-service tooling within the Services to access, export, correct, restrict, or delete Customer Personal Data. Where required by applicable law and not feasible through self-service, SUBLAKE shall, taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests from Data Subjects.
If SUBLAKE receives a request directly from a Data Subject relating to Customer Personal Data, SUBLAKE will redirect the Data Subject to Customer without responding to the substance of the request, unless authorised by Customer or required by law.
SUBLAKE shall notify Customer without undue delay, and in any event no later than 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent known:
SUBLAKE shall make available to Customer, on reasonable request, information necessary to demonstrate compliance with this DPA, including:
On-site audits will be considered on a case-by-case basis for Enterprise customers and may be subject to reasonable confidentiality and scheduling requirements.
On termination of the Agreement, SUBLAKE will, at Customer's choice, delete or return all Customer Personal Data within 30 days, unless storage is required by applicable law. Customer can also self-serve export or deletion at any time during the term via the Services. Backups will be deleted in accordance with the rolling retention schedule, not exceeding 90 days.
Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability section of the Agreement. Nothing in this DPA limits liability where it cannot be limited under applicable law.
This DPA is effective from the date Customer accepts the Agreement and continues until SUBLAKE ceases processing Customer Personal Data. Termination of the Agreement terminates this DPA, subject to surviving obligations regarding return/deletion, confidentiality, audits, and liability.
For data protection inquiries or to request a counter-signed copy of this DPA:
SUBLAKE Holdings LLC
Email: contact@sublake.com
Subject line: DPA inquiry
Website: sublake.com