Version 1.0 | Effective Date: 01 September 2026
The current version of this DPA is published at www.blendb2b.com/legal/dpa
THIS DATA PROCESSING ADDENDUM (the DPA) forms part of each Agreement between Blend and the Customer. It applies without separate signature when the Customer enters into an Agreement that incorporates it by reference, and governs the processing of Personal Data by Blend on behalf of the Customer under that Agreement. Blend and the Customer are each a Party and together the Parties.
1. Definitions and interpretation
1.1 In this DPA, the following terms have the following meanings:
Agreement means any master services agreement, terms of business, order form, statement of work, proposal or other agreement between Blend and the Customer under which Blend provides Services and which incorporates this DPA by reference.
Applicable Data Protection Laws means all laws relating to data protection and privacy that apply to the processing of Personal Data under the Agreement, including, as applicable, the UK GDPR, the Data Protection Act 2018, the EU GDPR and the US State Privacy Laws, in each case as amended or replaced from time to time.
Blend means the Blend entity that is party to the Agreement, being either (i) Blend Marketing Ltd, a company registered in England and Wales with company number 07358192, whose registered office is at East Throp House, Paddock Road, Caversham, Reading RG4 5BY; or (ii) Blend Marketing Inc, a wholly-owned subsidiary of Blend Marketing Ltd, which is a Delaware corporation located at 2100 Westshore Drive, Suite 127, Cumming, GA 30041, USA.
CCPA means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.), and its implementing regulations.
Customer means the entity that is party to the Agreement with Blend.
EEA means the European Economic Area.
EU GDPR means Regulation (EU) 2016/679.
EU SCCs means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, as amended or replaced from time to time.
Personal Data means any personal data or personal information (as those terms are defined in the Applicable Data Protection Laws) that Blend processes on behalf of the Customer under the Agreement, as described in Annex 1.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the Personal Data.
Services means the services that Blend provides to the Customer under the Agreement.
Sub-Processor means any third party (including any affiliate of Blend) engaged by Blend to process Personal Data on behalf of the Customer.
Sub-Processor List means the list of Blend’s Sub-Processors published at www.blendb2b.com/legal/sub-processors, as updated in accordance with clause 5.
UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced from time to time.
UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
US State Privacy Laws means the CCPA and all other comprehensive consumer privacy laws of US states that apply to the processing of Personal Data under the Agreement.
business, business purpose, consumer, controller, data subject, processing, processor, sell, service provider, share, special category data, sensitive personal information and supervisory authority have the meanings given in the Applicable Data Protection Laws. References to a controller include a business, references to a processor include a service provider, and references to a data subject include a consumer.
1.2 Capitalised terms not defined in this DPA have the meanings given in the Agreement. If there is a conflict between this DPA and the rest of the Agreement in relation to the processing of Personal Data, this DPA prevails; in all other respects the Agreement prevails. If there is a conflict between this DPA and any transfer mechanism incorporated under clause 6, that transfer mechanism prevails.
1.3 Where the Customer and Blend have signed a separately negotiated data processing agreement covering the Services, that agreement governs to the extent it conflicts with this DPA.
2. Status of the Parties and scope
2.1 For the purposes of the Applicable Data Protection Laws, the Customer is the controller and Blend is the processor in respect of the Personal Data. Where the Customer acts as a processor on behalf of a third-party controller, the Customer warrants that its instructions and its appointment of Blend are authorised by that controller, Blend acts as the Customer’s sub-processor, and the Customer remains Blend’s sole point of contact.
2.2 The subject-matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are set out in Annex 1. Annex 1 applies to each Agreement only to the extent relevant to the Services provided under that Agreement.
2.3 The Agreement and this DPA, together with the Customer’s configuration and use of the platforms on which Blend provides the Services, are the Customer’s documented instructions to Blend. The Customer may issue further reasonable written instructions consistent with the Agreement and the Applicable Data Protection Laws.
2.4 Each Party shall comply with its obligations under the Applicable Data Protection Laws. Nothing in this DPA relieves the Customer of its own obligations as controller.
3. Blend’s obligations as processor
3.1 Blend shall:
(a) process the Personal Data only on the documented instructions of the Customer, including with regard to transfers of Personal Data to a third country, unless required to process by law to which Blend is subject, in which case Blend shall inform the Customer of that legal requirement before processing unless the law prohibits it on important grounds of public interest;
(b) inform the Customer if, in its opinion, an instruction infringes the Applicable Data Protection Laws (it being acknowledged that Blend is not obliged to carry out a legal review of the Customer’s instructions);
(c) ensure that persons authorised to process the Personal Data are subject to an appropriate duty of confidentiality;
(d) implement appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as described at a high level in Annex 2;
(e) engage Sub-Processors only in accordance with clause 5;
(f) taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from data subjects exercising their rights under the Applicable Data Protection Laws;
(g) assist the Customer in ensuring compliance with its obligations relating to security of processing, notification of Personal Data Breaches, data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to Blend;
(h) notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Personal Data, and provide such information then available to Blend as the Customer reasonably requires to meet its own obligations under the Applicable Data Protection Laws;
(i) at the choice of the Customer, delete or return all the Personal Data to the Customer after the end of the provision of the Services, and delete existing copies, unless storage of the Personal Data is required by law; and
(j) make available to the Customer information that is reasonably necessary to demonstrate compliance with this clause 3, and allow for and contribute to audits in accordance with clause 7.
3.2 The assistance and cooperation described in clauses 3.1(f), 3.1(g) and 7 shall be provided at the Customer’s reasonable cost, save to the extent the need for such assistance arises directly from Blend’s breach of this DPA.
3.3 Blend shall not use, and shall ensure that its Sub-Processors do not use, the Personal Data or the Customer’s Confidential Information to train, retrain or improve any artificial intelligence model. Blend shall only use artificial intelligence tools that hold ISO 27001 certification or equivalent and are provided under commercial terms that exclude the use of customer data for model training.
3.4 Where Blend holds the Customer’s data in BlendCore, Blend’s internal knowledge platform, it shall delete that data at the end of the provision of the Services or on termination of the Agreement, whichever is earlier, and shall confirm the deletion in writing on request. The hosting region for BlendCore is recorded in the Sub-Processor List. Where the Customer is established in the UK or the EEA, Personal Data held in BlendCore is hosted in a UK or EEA region.
4. US State Privacy Laws
4.1 This clause 4 applies to the extent Blend processes Personal Data that is subject to the US State Privacy Laws. In that case, Blend acts as the Customer’s service provider or processor.
4.2 The Customer discloses Personal Data to Blend only for the limited and specified business purposes set out in the section of Annex 1 headed “Specific business purposes”.
4.3 Blend shall:
(a) not sell or share the Personal Data;
(b) not retain, use or disclose the Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in Annex 1, or as otherwise permitted for service providers by the US State Privacy Laws;
(c) not retain, use or disclose the Personal Data outside the direct business relationship between Blend and the Customer;
(d) not combine the Personal Data with personal information that Blend receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted for service providers by the US State Privacy Laws;
(e) comply with its obligations under the US State Privacy Laws and provide the same level of privacy protection to the Personal Data as the US State Privacy Laws require of the Customer;
(f) notify the Customer promptly if Blend determines that it can no longer meet its obligations under the US State Privacy Laws;
(g) where Blend receives de-identified data from the Customer, not attempt to re-identify it; and
(h) engage subcontractors only in accordance with clause 5, under a written contract that binds them to obligations equivalent to those in this clause 4.
4.4 The Customer may take reasonable and appropriate steps to ensure that Blend uses the Personal Data in a manner consistent with the Customer’s obligations under the US State Privacy Laws, including through the audit rights in clause 7. On notice, the Customer may take reasonable and appropriate steps to stop and remediate any unauthorised use of the Personal Data by Blend.
4.5 Blend certifies that it understands the restrictions in this clause 4 and will comply with them.
5. Sub-Processors
5.1 The Customer grants Blend general written authorisation to engage the Sub-Processors on the Sub-Processor List and to appoint replacement or additional Sub-Processors in accordance with this clause 5. The Sub-Processor List records, for each Sub-Processor, its identity, the processing it performs, its location and the transfer mechanism that applies to it.
5.2 Blend shall give the Customer at least fourteen (14) days’ notice before a new or replacement Sub-Processor begins processing Personal Data, by updating the Sub-Processor List and notifying the Customer by email, either to the contact nominated in the Agreement or to any address the Customer registers through the subscription facility at www.blendb2b.com/legal/sub-processors. The Customer is responsible for keeping its notice contact up to date.
5.3 The Customer may object to a new or replacement Sub-Processor on reasonable data-protection grounds by written notice within the notice period. If the Customer does not object within the notice period, it is deemed to have consented to the new or replacement Sub-Processor. If it does object, the Parties shall discuss the objection in good faith. If the objection cannot be resolved within thirty (30) days, Blend may, at its option and on written notice to the Customer, either (a) provide the affected Services without using that Sub-Processor for the Customer’s Personal Data, subject to any reasonable adjustment to fees or timescales that this requires; or (b) terminate the affected Services without further liability. The Customer’s objection under this clause 5.3 is its sole remedy in relation to a new or replacement Sub-Processor.
5.4 Where Blend must replace a Sub-Processor urgently for reasons of security or service continuity outside its reasonable control, it may do so immediately and shall give notice under clause 5.2 as soon as practicable. The Customer’s objection right under clause 5.3 applies from the date of that notice.
5.5 Blend shall impose on each Sub-Processor, by written contract, data protection obligations that are substantially equivalent to those in this DPA. Blend remains liable to the Customer for a Sub-Processor’s performance of those obligations, subject to clause 8.
6. International transfers
6.1 Blend shall not transfer Personal Data that is subject to the UK GDPR or the EU GDPR outside the UK or the EEA except in accordance with this clause 6. The Customer authorises any transfer to a Sub-Processor on the Sub-Processor List, made under the transfer mechanism recorded against that Sub-Processor.
6.2 Where the Blend entity that is party to the Agreement is located outside the UK and the EEA in a country not recognised as providing an adequate level of protection, and the Customer transfers to it Personal Data that is subject to the EU GDPR or the UK GDPR, the EU SCCs are incorporated into this DPA as follows:
(a) Module Two applies where the Customer is a controller, and Module Three applies where the Customer is a processor;
(b) the Customer is the data exporter and Blend is the data importer;
(c) Clause 7 (docking clause) does not apply;
(d) in Clause 9(a), Option 2 (general written authorisation) applies, with the time period set out in clause 5.2 of this DPA;
(e) the optional wording in Clause 11(a) does not apply;
(f) in Clause 13, the competent supervisory authority is determined in accordance with Clause 13(a) by reference to the Customer;
(g) in Clause 17, Option 1 applies and the governing law is the law of Ireland, and in Clause 18(b) the courts of Ireland have jurisdiction; and
(h) Annex I is completed with the information in Annex 1 of this DPA and the Parties’ details in the Agreement, and Annex II is completed with the information in Annex 2 of this DPA.
6.3 For transfers of Personal Data subject to the UK GDPR, the UK Addendum is incorporated into this DPA and applies to the EU SCCs as completed under clause 6.2. Table 1 is completed with the Parties’ details in the Agreement, Tables 2 and 3 are completed with the information in clause 6.2 and Annexes 1 and 2, and in Table 4 Blend, as data importer, may end the UK Addendum in accordance with its Section 19.
6.4 If a transfer mechanism relied on under this clause 6 ceases to be valid, the Parties shall cooperate in good faith to put in place a valid alternative mechanism without undue delay.
6.5 The Customer, as controller, is responsible for determining that the relevant transfer mechanism provides an adequate level of protection for its processing. Blend shall provide reasonable information to support any transfer assessment the Customer carries out.
7. Records and audit
7.1 Blend shall maintain records of its processing sufficient to demonstrate compliance with clause 3 and shall make such information available to the Customer on reasonable written request.
7.2 The Customer may, on not less than thirty (30) days’ prior written notice and not more than once in any twelve (12) month period (save where required by a supervisory authority or following a Personal Data Breach), audit Blend’s compliance with this DPA. Audits shall be conducted during business hours, subject to Blend’s reasonable security and confidentiality requirements, and so as to minimise disruption to Blend’s operations. Blend may satisfy an audit request by providing its current ISO 27001 certificate, applicable Statement of Applicability, and relevant independent audit reports or summaries. The Customer shall bear its own and Blend’s reasonable costs of any audit it requests.
8. Liability
8.1 The liability of each Party under or in connection with this DPA is subject to, and counts towards, the exclusions and limitations of liability set out in the Agreement. This DPA does not create any liability beyond, or in addition to, that provided for in the Agreement, except to the extent such liability cannot be excluded or limited under the Applicable Data Protection Laws.
8.2 Blend has no liability for any claim arising from the Customer’s instructions or from the Customer’s failure to comply with its own obligations under the Applicable Data Protection Laws.
9. The Customer’s obligations
9.1 The Customer warrants that it has a valid lawful basis for the processing it instructs, that its instructions comply with the Applicable Data Protection Laws, and that it has provided all notices, obtained all consents and honoured all opt-outs necessary for Blend lawfully to process the Personal Data in accordance with the Agreement, including opt-outs from sale, sharing and targeted advertising for campaigns run through the Customer’s own platforms and advertising accounts.
9.2 The Customer shall not instruct Blend to process special category data, sensitive personal information or payment card data unless the Parties have agreed appropriate additional measures in writing in advance.
10. Updates to this DPA
10.1 Blend may update this DPA from time to time by publishing a new version at www.blendb2b.com/legal/dpa, showing its version number and effective date. Blend shall keep previous versions available at that address and shall send email notice of material updates to any address the Customer registers through the subscription facility referred to in clause 5.2.
10.2 Blend may only update this DPA where the update is required to comply with the Applicable Data Protection Laws or with an order or guidance of a supervisory authority, court or other competent authority, where the update is expressly permitted by this DPA, or where the update:
(a) is commercially reasonable;
(b) does not result in a material reduction of the security of the Personal Data;
(c) does not expand the scope of, or remove any restriction on, Blend’s processing of the Personal Data under clauses 2.3, 3 and 4; and
(d) does not otherwise have a material adverse impact on the Customer’s rights under this DPA.
10.3 Updates to the Sub-Processor List are governed by clause 5 and not by this clause 10. Updates required to comply with the Applicable Data Protection Laws or with an order or guidance of a competent authority, and updates that only correct errors or clarify wording, take effect on publication. Other material updates take effect thirty (30) days after publication.
10.4 Each updated version applies to every Agreement from its effective date without the need for signature or further action by either Party. The version in force at the time of any processing governs that processing.
10.5 This clause 10 does not apply to the text of the EU SCCs or the UK Addendum, which Blend may update only to adopt a successor or amended version issued by the competent authority.
11. Term and general
11.1 This DPA takes effect for the Customer on the effective date of the first Agreement that incorporates it and continues for as long as Blend processes Personal Data on behalf of the Customer. Clauses that by their nature should survive termination shall do so.
11.2 This DPA is governed by the law, and subject to the jurisdiction provisions, of the Agreement. If the Agreement does not specify a governing law, this DPA is governed by the laws of England and Wales where Blend Marketing Ltd is the Blend party, and by the laws of the State of Georgia where Blend Marketing Inc is the Blend party. The EU SCCs and the UK Addendum are governed by their own terms.
11.3 This DPA does not require separate signature. Except as set out in clause 10, any variation of this DPA in relation to a particular Customer must be in writing and signed by or on behalf of each Party.
11.4 If any provision of this DPA is found invalid or unenforceable, the remaining provisions continue in full force, and the affected provision shall be amended to the minimum extent necessary to make it valid and enforceable.
Annex 1 — Details of Processing
This Annex describes the processing Blend may carry out across its Services. For any Agreement, it applies only to the extent relevant to the Services provided under that Agreement.
|
Controller / business |
The Customer, as identified in the Agreement. |
|
Processor / service provider |
Blend, as identified in the Agreement. |
|
Subject-matter |
The processing of Personal Data by Blend on behalf of the Customer in connection with the Services, which may include growth strategy and advisory; brand, messaging and website strategy; website design, development, migration and support; CRM and marketing automation implementation, configuration, migration and administration (including HubSpot); demand generation, account-based marketing and campaign delivery; content creation; sales enablement and revenue operations; and analytics, reporting and attribution. Processing takes place within the Customer’s own platforms (such as its CRM, marketing automation, website and advertising accounts), which the Customer owns or licenses and which are the Customer’s own processors rather than Blend’s Sub-Processors, and within Blend’s own systems used to deliver the Services, including those listed in Blend’s Sub-Processors. |
|
Duration and frequency |
Continuous for the term of the Agreement and the provision of the Services (including any discovery, build, campaign and managed-service periods) and any agreed transition period, until return or deletion of the Personal Data in accordance with clause 3.1(i) and clause 3.4. |
|
Nature of processing |
Collection, recording, organisation, structuring, storage, retrieval, consultation, use, configuration, migration, segmentation, analysis, enrichment, transmission, disclosure (to the extent necessary to deliver campaigns through the Customer’s own platforms), combination as instructed by the Customer, and erasure of Personal Data, carried out by automated and manual means. |
|
Specific business purposes |
Blend processes the Personal Data only for the following purposes, to the extent required by the Services in the Agreement: (a) designing, building, migrating, configuring, maintaining and supporting the Customer’s website, CRM, marketing automation and related platforms; (b) planning, building, executing and optimising the Customer’s marketing, demand generation, account-based marketing and sales campaigns through the Customer’s own platforms and accounts; (c) creating content and creative assets for the Customer; (d) analysing website, campaign and pipeline performance and reporting it to the Customer; (e) migrating, cleansing, de-duplicating, segmenting and enriching the Customer’s records on the Customer’s instructions; (f) configuring user access for, and providing training and support to, the Customer’s personnel; (g) communicating with the Customer’s personnel and contacts, and recording, transcribing and summarising meetings, to manage and deliver the Services; (h) maintaining the security and integrity of the systems used to deliver the Services, and identifying and repairing errors; and (i) complying with laws that apply to Blend. Blend does not process the Personal Data for any purpose of its own. |
|
Types of Personal Data |
Special category data, sensitive personal information and payment card data: none, unless the Parties agree appropriate additional measures in writing in advance. |
|
Categories of data subjects |
|
|
Sub-Processors and transfers |
As set out in the Sub-Processor List and clause 6. |
|
Competent supervisory authority |
As determined under clause 6.2(f), where the EU SCCs apply; otherwise the authority with jurisdiction over the Customer. |
Annex 2 — Technical and Organisational Measures
Blend maintains technical and organisational measures appropriate to the risk, operated within its ISO 27001:2022-certified Information Security Management System. The measures address the following areas. Specific control detail is available for the Customer’s confidential review on reasonable request. Blend may update these measures from time to time, provided the overall level of security is not reduced.
|
Security governance |
ISO 27001:2022-certified ISMS with documented information security policies and risk management. |
|
Access control |
Role-based access on a least-privilege basis; multi-factor authentication for administrative and remote access; periodic access reviews. |
|
Encryption |
Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest on Blend-controlled systems. |
|
Confidentiality and personnel |
Confidentiality obligations binding on personnel and recurring security-awareness training. |
|
Logging and monitoring |
Logging and monitoring of access to and processing of Personal Data, with alerting for anomalous activity. |
|
Resilience |
Backup, business continuity and recovery arrangements, tested periodically. |
|
Incident management |
Documented breach detection and notification procedures supporting the obligation in clause 3.1(h). |
|
Supplier assurance |
Due diligence on, and contractual flow-down of equivalent obligations to, Sub-Processors. |
|
Return / deletion |
Procedures for secure return or destruction of Personal Data at the end of the Services. |