This Data Processing Addendum ("DPA") governs the processing of personal data by LuckWood Agency ("LuckWood", "Processor") in connection with the LuckWood Outreach platform ("the Platform"), on behalf of the organization that uses the Platform ("Customer", "Controller"). This DPA supplements the Terms of Service and applies to the extent that LuckWood processes personal data on Customer's behalf while providing the Platform, within the meaning of Article 4(8) and Article 28 of the General Data Protection Regulation (GDPR).
Customer is the Controller for the personal data of the contacts that Customer supplies, imports or has enriched via the Platform ("Contact Data"), and determines the purpose and means of that processing, including the choice of contact list and the legal basis on which contacts are approached. LuckWood processes this Contact Data solely as Processor, on behalf of and on the basis of documented instructions from Customer, as those instructions follow from use of the Platform and this DPA.
LuckWood processes Contact Data for the purpose of delivering the service: sending cold-email sequences from a mailbox connected by Customer, generating AI-personalized opening lines, managing unsubscribe requests, and measuring sending statistics (such as opens, clicks and bounces). The processing continues for as long as the agreement between Customer and LuckWood is in effect, and ends or is transferred in accordance with article 9.
Categories of data subjects: business contacts supplied or imported by Customer (typically professionals at companies Customer wishes to approach). Categories of data: typically name, business email address, job title, company name, and any other fields Customer adds to a contact itself, plus interaction data generated by the Platform (send, open, click and unsubscribe status).
LuckWood processes Contact Data solely for the purposes stated in article 2 and on the basis of Customer's instructions, unless a legal obligation requires LuckWood to process the data differently; in that case LuckWood will inform Customer of this prior to the processing, unless that legislation prohibits such notification on important grounds of public interest. If LuckWood believes that an instruction from Customer conflicts with the GDPR or other applicable data protection legislation, LuckWood will inform Customer of this without delay.
LuckWood ensures that persons authorized to process Contact Data have committed themselves to confidentiality or are bound by an appropriate statutory duty of confidentiality, and that access to Contact Data is limited to persons for whom this is necessary to deliver the Platform.
LuckWood takes appropriate technical and organizational measures to protect Contact Data against loss and against any form of unlawful processing, taking into account the state of the art, the costs of implementation and the nature of the data. These measures include, among others: encryption of stored SMTP/IMAP passwords using AES-256-GCM, encrypted connections (TLS) for data in transit, access restrictions on production systems, and logging of processing activities relevant to security.
Customer grants LuckWood general authorization to engage sub-processors for the processing of Contact Data, provided LuckWood enters into an agreement with each sub-processor that imposes obligations at least equivalent to those in this DPA. LuckWood currently uses the following categories of sub-processors:
LuckWood will inform Customer in advance of any intended change in the sub-processors engaged that expands the processing of Contact Data, so that Customer has the opportunity to object on reasonable grounds related to data protection.
To the extent possible within the Platform's functionality, LuckWood assists Customer in responding to requests from data subjects seeking to exercise their rights under the GDPR (such as access, rectification, erasure or objection). If LuckWood itself receives a request from a data subject relating to Contact Data, that request is forwarded to Customer without substantive handling, unless LuckWood is legally required to respond to it directly.
LuckWood will inform Customer without undue delay, and where possible within 48 hours after LuckWood becomes aware of a personal data breach involving Customer's Contact Data, providing the information available at that time about the nature of the breach, the data likely affected, and the measures already taken or planned. LuckWood cooperates with Customer to enable Customer to comply with its own notification obligations toward the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and data subjects.
After termination of the agreement, LuckWood deletes all Contact Data, or makes it available to Customer for export upon request, unless and to the extent applicable legislation requires LuckWood to retain the data for longer. Regular backups containing Contact Data are deleted in accordance with LuckWood's regular backup rotation schedule.
Upon written request and with due regard for a reasonable notice period, LuckWood makes available to Customer information reasonably necessary to demonstrate LuckWood's compliance with this DPA, and cooperates with audits, including inspections, carried out by Customer or an auditor authorized by Customer, provided that confidentiality toward LuckWood's other customers is safeguarded and the costs of such an audit are reasonably borne by Customer, unless the audit concerns a previously identified shortcoming on LuckWood's part.
To the extent a sub-processor referred to in article 6 processes personal data outside the European Economic Area, LuckWood ensures that such transfer is based on an appropriate transfer mechanism under the GDPR, such as the Standard Contractual Clauses of the European Commission or an applicable adequacy decision.
Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service, to the extent applicable law permits such a limitation for damages arising from a breach of data protection legislation.
This DPA applies for as long as LuckWood processes personal data on Customer's behalf in connection with the Platform. LuckWood may amend this DPA to comply with changed data protection legislation or a changed use of sub-processors; material changes will be announced in advance via the Platform or by email.
LuckWood Agency is operated by Indy Zeinstra, KVK 98973703, Strausspark 11, 2216 EG Voorhout, the Netherlands. Contact: indy@luckwood.nl.
Last updated: August 5, 2026
Other documents: Terms of Service · Acceptable Use Policy