Data Processing Agreement
Last updated: 5 August 2026
This agreement forms part of the Terms and applies automatically. A countersigned PDF is available on request via legal@bybloomlabs.com.
01 Roles
Bloom DevLabs Corp. acts as processor; you, the customer, are the controller. This DPA applies automatically to every customer under GDPR Article 28.
02 Scope of processing
We process personal data only to provide the service: receiving and sending messages, qualifying contacts, booking appointments and running campaigns you configure.
03 Sub-processors
You authorise the sub-processors listed at /subprocessors/. We give 14 days' notice before adding a new one, and you may object on reasonable data-protection grounds.
04 Security
We apply the technical and organisational measures described at /security/, including EU data residency, encryption in transit, access control and daily backups.
05 International transfers
Where a sub-processor operates outside the EU, transfers rely on Standard Contractual Clauses.
06 Data subject requests
We assist you in responding to access, correction, erasure and portability requests, and support obligations under GDPR and RA 10173.
07 Return and deletion
On termination, you have a 30-day export window, after which personal data is deleted; backups are purged within 90 days.
08 Audit
We provide the information reasonably necessary to demonstrate compliance and support audits on reasonable notice.