Data Processing Agreement
Last updated: 25 October 2026
This agreement is part of our Terms of service. It applies automatically whenever you upload personal data to ListBouncer, so there's nothing to sign. If your company needs a countersigned copy, email support@listbouncer.com.
1. Who does what
You (the customer) are the controller of the email addresses you upload. ListBouncer is your processor. We only process those addresses to verify them and give you the results, following your instructions, which are the Terms, this agreement and whatever you do in the dashboard.
2. What we process
Data: email addresses, plus first and last names and the signup source (a column like Source or Form) if your file has them. Your browser strips every other column before the upload reaches us. People: whoever is on your list, usually your subscribers, customers or leads. Purpose: checking whether each address can receive mail and reporting the result to you. How long: until you delete the report or close your account (see section 7).
3. Our commitments
We won't use your lists for anything else. We never sell them, share them, add them to our own lists or use them to train anything. Only people who need access to run the service have it, and they're bound to keep it confidential. We'll tell you if we believe an instruction from you breaks data protection law.
4. Security
All traffic to and between our services is encrypted in transit (TLS). The database is encrypted at rest. Your original CSV file is never stored: the browser sends us only the addresses, and they're saved as result rows. The checking servers are firewalled and only accept requests that carry our private key. Admin access is limited and protected by strong authentication.
5. Sub-processors
You agree that we can use the sub-processors listed on our Sub-processors page (listbouncer.com/subprocessors). Each is bound by data protection terms at least as protective as these. We'll update that page at least 14 days before adding or replacing one that handles your lists. If you object on reasonable data protection grounds and we can't resolve it, you can close your account and we'll refund your unused credits.
6. Transfers outside the EU and UK
Some sub-processors are in the United States, and ListBouncer is run from outside the EU. Where a transfer needs a safeguard, the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 for onward transfers) and the UK Addendum are incorporated into this agreement by reference. Our US sub-processors rely on the transfer terms in their own data processing agreements.
7. Deleting your data
You can delete any report from your dashboard at any time, which removes its address rows straight away. When you delete your account from Settings, your lists, results and sign-in are deleted straight away. You can also ask us by email at support@listbouncer.com and we'll do it within 7 days. Backups held by our database provider roll off within 30 days. We keep billing records (amounts and dates, no list data) as tax law requires.
8. Helping you
If someone on your list asks to exercise their rights and you need our help, we'll assist. If we get a request directly, we'll pass it to you. We'll give you the information you reasonably need for a data protection impact assessment or to show you're complying, and answer reasonable written questions about how we handle your data.
9. Breaches
If we become aware of a breach affecting your data, we'll tell you without undue delay and within 72 hours, with what we know, what we're doing about it and who to contact.
10. Contact
Data protection questions: support@listbouncer.com.