Effective date: October 6, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between J&T Solutions Inc., doing business as GTM ("GTM"), and the customer named in that agreement ("Customer") for the provision of the Services. That agreement is either GTM's Terms of Service or a Master Services Agreement (in each case, the "Agreement"). This DPA applies automatically. Customers who need a countersigned copy can request one at support@trygtm.com.
1. Definitions
Terms not defined here have the meanings in the Agreement.
"Applicable Data Protection Law" means all laws on privacy and the processing of personal data that apply to a party's processing of Customer Personal Data under the Agreement, which may include the GDPR, the UK GDPR, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the CCPA and other US state privacy laws, and Canada's PIPEDA, in each case as amended and to the extent they apply. It has the same meaning as "Data Protection Laws" in the Agreement.
"CCPA" means the California Consumer Privacy Act of 2018, as amended, and its regulations.
"Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Supervisory Authority" have the meanings in the GDPR. "Business", "service provider", "sell" and "share" have the meanings in the CCPA. "Controller" includes "business" and "Processor" includes "service provider" where the context requires.
"Customer Personal Data" means Personal Data within Customer Data that GTM Processes on behalf of Customer under the Agreement. It excludes GTM Controller Data.
"GDPR" means Regulation (EU) 2016/679.
"GTM Controller Data" means Personal Data that GTM Processes as a Controller, including GTM Prospect Data as GTM sources, maintains and supplies it; account, billing and relationship data about Customer and its Authorized Users; platform-wide suppression records; and Usage Data.
"Restricted Transfer" means a transfer of Customer Personal Data that Applicable Data Protection Law would prohibit without a transfer mechanism.
"SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, as amended or replaced.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in GTM's or its Subprocessors' possession or control. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, failed log-in attempts and denial-of-service attacks.
"Subprocessor" means a third party GTM engages to Process Customer Personal Data. It does not include GTM personnel, or Third-Party Services that Customer chooses to connect.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, as amended or replaced.
"UK GDPR" means the GDPR as it forms part of UK law.
2. Scope and roles
2.1 Customer as Controller. For Customer Personal Data, Customer is the Controller (or, where Customer acts for its own clients, a Processor acting for them), and GTM is Customer's Processor (or sub-processor). Under the CCPA, Customer is a business and GTM is its service provider.
2.2 Customer's use of GTM Prospect Data. When Customer selects GTM Prospect Data in the Services and uses it for its own outreach, Customer becomes an independent Controller of that data for its own purposes. From then on, the records in Customer's workspace, and all Processing GTM performs on them at Customer's instruction (such as sending messages, tracking replies and syncing to CRMs), are Customer Personal Data under this DPA. GTM remains a separate and independent Controller of the GTM Prospect Data it continues to hold for its own purposes.
2.3 GTM as Controller. GTM Processes GTM Controller Data as an independent Controller under its Privacy Policy. This DPA does not apply to GTM Controller Data, except that Section 11 also covers GTM Prospect Data that GTM discloses to Customer. Where each party is an independent Controller of the same data, each is separately responsible for its own compliance, and the parties are not joint Controllers.
2.4 Agency Customers. If Customer uses Client Workspaces, Customer is responsible for having authority from each client to engage GTM as its sub-processor, for passing on its clients' information and instructions, and for any obligations it owes its clients.
2.5 Details of Processing. Annex I describes the Processing.
3. Customer obligations
3.1 Customer is responsible for:
(a) the lawfulness of Customer Personal Data and of its instructions;
(b) having a lawful basis for all Processing it instructs;
(c) giving all notices and obtaining all consents Applicable Data Protection Law requires, including for outreach to Data Subjects; and
(d) its own compliance with Applicable Data Protection Law and Communications Laws.
3.2 Customer will not submit special categories of Personal Data, criminal-offence data, children's data or other sensitive data to the Services unless the Agreement expressly permits it.
3.3 Customer will ensure its instructions comply with Applicable Data Protection Law.
4. GTM obligations as Processor
4.1 Documented instructions. GTM will Process Customer Personal Data only on Customer's documented instructions, unless the law to which GTM is subject requires otherwise, in which case GTM will inform Customer of that legal requirement before Processing unless the law prohibits it. Customer's documented instructions are the Agreement and this DPA, Customer's configuration and use of the Services (including Automated Actions), and other reasonable written instructions consistent with the Agreement. Instructions outside the Agreement's scope require prior written agreement and may involve additional fees.
4.2 Unlawful instructions. GTM will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected Processing until Customer confirms or changes the instruction. GTM is not required to check Customer's instructions for legal compliance.
4.3 CCPA terms. For Customer Personal Data subject to the CCPA, GTM will not:
(a) sell or share it;
(b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any other commercial purpose;
(c) retain, use or disclose it outside the direct business relationship between GTM and Customer; or
(d) combine it with personal information GTM receives from others or collects from its own interactions with consumers, except as the CCPA regulations permit a service provider to do.
GTM will comply with the CCPA obligations that apply to it, provide the level of privacy protection the CCPA requires, and notify Customer if it determines it can no longer meet these obligations. Customer may take reasonable and appropriate steps, on notice, to stop and remediate unauthorized use of Customer Personal Data. GTM certifies that it understands and will comply with these restrictions.
4.4 Permitted GTM uses. GTM may also Process Customer Personal Data to maintain platform-wide suppression lists, to detect and prevent fraud, abuse, spam and security incidents, to create Usage Data and aggregated or de-identified information, and to comply with law, in each case as Applicable Data Protection Law permits. These uses do not extend to data GTM receives from Google APIs or derives from it, including in aggregated or anonymized form, which GTM uses only as Section 16 of the Privacy Policy describes.
4.5 Model training. GTM will not use Customer Personal Data to train or fine-tune AI models made available to other customers, and will not use data it receives from Google APIs, or derives from it, to develop, improve or train any AI or machine learning model.
5. Confidentiality
GTM will ensure that people it authorizes to Process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality, and that access is limited to those who need it to provide, support or secure the Services.
6. Subprocessors
6.1 General authorization. Customer gives GTM general written authorization to engage Subprocessors. The Subprocessors in use are listed on the Subprocessors page, which forms Annex III.
6.2 Subprocessor obligations. GTM will impose written data protection terms on each Subprocessor that provide at least the same level of protection as this DPA, to the extent appropriate to the service it provides, and remains responsible for each Subprocessor's performance of those obligations, subject to the Agreement's limitation of liability.
6.3 Notice of new Subprocessors. GTM will update the Subprocessors page at least 30 days before a new Subprocessor begins Processing Customer Personal Data, and will notify Customers who have asked to receive updates by email. GTM may replace a Subprocessor on shorter notice where an emergency, a security issue or the Subprocessor's sudden unavailability requires it, and will give notice as soon as practicable. GTM does not give advance notice of removing a Subprocessor.
6.4 Objection. Customer may object in writing to a new Subprocessor on reasonable data protection grounds within 15 days after notice. The parties will discuss the objection in good faith, and GTM may offer a change to the Services or Customer's configuration that avoids use of the Subprocessor for Customer Personal Data. If no resolution is reached within 30 days, either party may terminate the part of the Services that cannot be provided without the Subprocessor, and GTM will refund prepaid fees for that part covering the period after termination. This is Customer's sole remedy for an objection. If Customer does not object within 15 days, it is treated as having authorized the new Subprocessor.
6.5 Third-Party Services. Providers of Third-Party Services that Customer chooses to connect, such as its CRM, calendar, mailbox provider or LinkedIn, are not GTM's Subprocessors.
7. Assistance
7.1 Data Subject requests. Taking into account the nature of the Processing, GTM will help Customer by appropriate technical and organizational measures, as far as possible, to respond to Data Subject requests. The Services let Customer access, export, correct and delete Customer Personal Data and add suppressions. If GTM receives a request from a Data Subject that identifies Customer, GTM will forward it to Customer without undue delay and will not respond itself, except to direct the Data Subject to Customer, confirm receipt, or apply a platform-wide suppression, unless the law requires otherwise.
7.2 Assessments. GTM will give Customer reasonable information it needs to complete data protection impact assessments and prior consultations with Supervisory Authorities about its use of the Services, to the extent Customer does not already have access to it.
7.3 Costs. GTM may charge reasonable fees for assistance beyond the Services' self-service features and standard documentation, except where the assistance is needed because GTM breached this DPA.
8. Security
8.1 GTM will implement and maintain the technical and organizational measures in Annex II, designed to protect Customer Personal Data against Security Incidents and to provide a level of security appropriate to the risk.
8.2 GTM may update these measures, provided an update does not materially reduce the overall security of the Services during a paid subscription term.
8.3 Customer is responsible for its own security obligations under the Agreement and for deciding whether the Services' measures meet its needs.
9. Security Incidents
9.1 GTM will notify Customer without undue delay, and in any event within 72 hours, after GTM confirms a Security Incident.
9.2 GTM's notice will describe, to the extent known, the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where information is not available at first, GTM will provide it in phases as it becomes available.
9.3 GTM will take reasonable steps to contain, investigate and mitigate the Security Incident, and will cooperate reasonably so Customer can meet its own notification obligations.
9.4 GTM's notice or response is not an acknowledgment of fault or liability.
9.5 Customer is responsible for any notifications that Applicable Data Protection Law requires Customer to make. GTM will not notify Customer's Data Subjects or regulators about a Security Incident affecting Customer Personal Data without Customer's approval, unless the law requires it.
9.6 GTM will send notices to Customer's account administrators by email, or to another contact Customer designates in writing.
10. Audits
10.1 Information. On written request, no more than once in any 12-month period, GTM will provide information reasonably needed to demonstrate its compliance with this DPA, such as responses to a standard security questionnaire and a summary of its security measures. This information is GTM's Confidential Information.
10.2 Audits. If that information does not reasonably satisfy Customer's obligations under Applicable Data Protection Law, or a Supervisory Authority requires it, or a Security Incident affecting Customer Personal Data has occurred, Customer may conduct an audit on these conditions:
(a) Customer gives at least 30 days' written notice with a proposed scope;
(b) the parties agree the scope, timing and duration in advance;
(c) the audit takes place during normal business hours, no more than once in any 12-month period (except after a Security Incident or at a Supervisory Authority's request), and without unreasonable disruption to GTM's business;
(d) the auditor is Customer or an independent third party that is not a GTM competitor and that signs GTM's confidentiality agreement;
(e) the audit does not include access to other customers' data or to information that would compromise security or confidentiality;
(f) Customer bears its own costs and reimburses GTM's reasonable costs, unless the audit reveals a material breach of this DPA by GTM; and
(g) Customer gives GTM a copy of the audit report, which is GTM's Confidential Information.
10.3 Where the SCCs apply, audits under the SCCs will be carried out in accordance with this Section 10.
11. International transfers
11.1 Location. GTM stores Customer Personal Data in the United States. GTM and its Subprocessors may Process it in the other locations listed on the Subprocessors page.
11.2 EEA transfers. For Restricted Transfers from the EEA, the SCCs are incorporated into this DPA as follows:
(a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor;
(b) the docking clause in Clause 7 applies;
(c) in Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 6.3;
(d) in Clause 11, the optional language does not apply;
(e) in Clause 17, Option 1 applies, and the governing law is the law of Ireland;
(f) in Clause 18(b), disputes will be resolved before the courts of Ireland;
(g) Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA; and
(h) the competent Supervisory Authority is determined under Clause 13.
11.3 GTM Prospect Data. Where GTM, as a Controller, transfers GTM Prospect Data about Data Subjects in the EEA to Customer in a country without an adequacy decision, Module One (controller to controller) of the SCCs applies, completed as in Section 11.2 with the necessary changes.
11.4 UK transfers. For Restricted Transfers subject to the UK GDPR, the SCCs apply as amended by the UK Addendum. Table 1 is completed with the parties' details in Annex I, Table 2 by reference to the modules and options in Section 11.2, and Table 3 by Annexes I to III of this DPA. In Table 4, neither party may end the UK Addendum as permitted by its Section 19.
11.5 Swiss transfers. For Restricted Transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with these changes: references to the GDPR mean that Act, the competent authority is the Swiss Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland so that Swiss Data Subjects can enforce their rights there.
11.6 Alternative mechanisms. If GTM adopts another lawful transfer mechanism, that mechanism applies instead of the SCCs to the extent it covers the transfer. If a mechanism is invalidated, the parties will work together in good faith to put an alternative in place.
11.7 Conflict. If the SCCs or UK Addendum conflict with this DPA or the Agreement, the SCCs or UK Addendum control for the Restricted Transfer concerned.
12. Government and legal requests
12.1 If a government authority or other third party requests access to Customer Personal Data, GTM will, unless legally prohibited, direct the requester to Customer, promptly notify Customer, and give Customer reasonable help to challenge the request.
12.2 GTM will not disclose Customer Personal Data unless legally required to do so. Where legally permitted and reasonable, GTM will challenge requests it considers overbroad or unlawful, and will disclose only the minimum data the request requires.
13. Return and deletion
13.1 Customer can export and delete Customer Personal Data using the Services during the subscription.
13.2 After the Agreement ends, Customer may export Customer Personal Data for 30 days. GTM will then delete Customer Personal Data within 90 days. Copies in backups are deleted as backups expire in the ordinary course. GTM will confirm deletion in writing on request.
13.3 GTM may retain Customer Personal Data where the law requires it, in backups until they expire, and to the minimum extent needed to keep platform-wide suppression and opt-out records. Retained data remains protected under this DPA and is Processed only for the purposes that require its retention.
14. Records and cooperation
14.1 GTM will keep records of its Processing activities for Customer as Applicable Data Protection Law requires of Processors, and make them available to Supervisory Authorities on request.
14.2 Each party will comply with the Applicable Data Protection Law that applies to it in its role under this DPA.
14.3 If a change in Applicable Data Protection Law requires a change to this DPA, GTM may amend this DPA to the extent needed to comply, without reducing the overall protection for Customer Personal Data.
15. General
15.1 Liability. Each party's liability arising out of or relating to this DPA, including under the SCCs where the law permits, is subject to the exclusions and limitations of liability in the Agreement. Nothing in this DPA limits a party's liability to Data Subjects under the SCCs where that liability cannot be limited.
15.2 Order of precedence. If this DPA conflicts with the Agreement, this DPA controls for the Processing of Customer Personal Data. Section 11.7 governs conflicts with the SCCs.
15.3 Term. This DPA remains in effect for as long as GTM Processes Customer Personal Data.
15.4 Governing law. This DPA is governed by the law that governs the Agreement, except where the SCCs or Applicable Data Protection Law require otherwise.
15.5 Updates. GTM may update this DPA as Section 14.3 permits, or in ways that do not reduce Customer's protection. A countersigned DPA changes only by written amendment signed by both parties, except under Section 14.3.
Annex I: Details of processing
A. Parties
Data exporter. Customer, as identified in the Agreement. Role: Controller, or Processor for its clients. Activities: use of the Services. Contact: Customer's account administrators, or the contact Customer designates.
Data importer. J&T Solutions Inc., d/b/a GTM, 251 Little Falls Drive, Wilmington, DE 19808, United States. Contact: support@trygtm.com. Role: Processor for Customer Personal Data, and Controller for transfers under Section 11.3. Activities: provision of the Services under the Agreement.
B. Description of processing
Categories of Data Subjects. Customer's prospects, leads and message recipients, and people who reply to them; Customer's customers, contacts and business partners whose data Customer uploads or connects; Customer's Authorized Users, employees and contractors; Customer's clients and their personnel (for Agency Customers); and meeting attendees and people appearing in Connected Account data.
Categories of Personal Data. Identity and professional information (name, job title, employer, seniority, department, work location, professional profile URL and headline); business contact information (email address, phone number, and postal address where provided); communications (message content, subject lines, replies, threads, connection requests and notes); engagement and delivery data (sends, deliveries, bounces, complaints, replies, opt-outs and meeting bookings); research and derived data (company information, public professional activity, AI-generated research, scores, classifications and drafts); CRM and calendar data Customer allows the Services to access; Authorized User data (name, email address, role and activity logs); and any other Personal Data Customer chooses to submit.
Sensitive data. None intended. See Section 3.2.
Frequency. Continuous, for the duration of the Agreement.
Nature of the Processing. Collection, recording, organization, structuring, storage, enrichment, verification, analysis (including by AI models), adaptation, retrieval, consultation, use, transmission (including sending messages by email, professional networks, SMS and other channels), synchronization with Connected Accounts, erasure and destruction.
Purposes. To provide the Services under the Agreement, including sourcing, qualification, message drafting, sending, reply handling, meeting booking and CRM updates; to provide support; to secure the Services and prevent abuse; to maintain suppression lists; and to comply with law.
Retention. For the duration of the Agreement and then as Section 13 describes. Records derived from GTM Prospect Data are kept for up to 24 months from collection.
Subprocessor transfers. As described on the Subprocessors page.
C. Competent Supervisory Authority
Where Customer is established in an EU Member State, the Supervisory Authority of that Member State. Where Customer is not established in the EU but is subject to the GDPR under its Article 3(2), the Supervisory Authority of the Member State where Customer's representative is established or, if none, where the relevant Data Subjects are located. For UK transfers, the Information Commissioner's Office.
Annex II: Technical and organizational measures
GTM maintains the following measures, as updated under Section 8.2.
Separation of customer data. Customer data is logically separated by workspace, and database row-level security policies restrict each customer's users to their own workspaces.
Access control. Access to customer data is checked on each request against the requesting user's membership and permissions, so removing a user removes their access. Customers control user roles within their workspaces. GTM limits its personnel's access to customer data to what is needed to provide, support and secure the Services, and the Services indicate when GTM staff are assisting in a customer workspace.
Authentication. Users sign in through a managed authentication provider. API and tool access uses scoped, revocable credentials.
Encryption. Data is encrypted in transit over public networks using TLS. Data at rest in the primary database is encrypted by the database hosting provider.
Credentials. Passwords entered to connect a professional-network account are passed to the connection provider in a single request and are not stored, logged or returned by GTM. Server credentials are kept out of source code and out of browser code.
Logging and monitoring. Operational telemetry is limited to operational attributes and excludes message bodies, prompts, credentials and full URLs. Workspaces keep an activity record of changes to people, connections and writing style.
Application security. GTM applies a content security policy to its web application, rate-limits sensitive endpoints, validates external input, and manages database changes through version-controlled migrations.
Data minimization and retention. GTM records the source and collection date of each sourced field, and calculates the retention of sourced contact records from the collection date in a way that cannot be extended by later updates.
Outreach safeguards. Suppression lists are checked before contact data is revealed and before sending, and suppression records are exempt from ordinary deletion. An email cannot be recorded as sent without a recorded suppression verdict. A reply stops pending sequence steps for that contact. Opt-out language is detected before any AI classification.
Reliability. Long-running AI agent jobs record their progress and are not automatically replayed after a failure, to avoid duplicate actions or costs.
Infrastructure. GTM uses cloud providers for hosting and does not operate its own data centers. GTM relies on those providers for physical and environmental security.
Data Subject rights. The Services provide export, deletion and suppression tools, and GTM tracks privacy requests against a one-month response deadline.
Subprocessors. GTM imposes data protection terms on Subprocessors as Section 6.2 describes.
Annex III: Subprocessors
The current list of Subprocessors, with the service each provides, the purpose of processing, the data involved and the processing location, is published on the Subprocessors page and incorporated into this DPA.