Data Processing Addendum — Brazil (LGPD)

This Data Processing Addendum ("Addendum") supplements the BounceZero Data Processing Agreement ("Master DPA") and applies where the customer ("Controller", "you") submits for verification email addresses relating to data subjects located in Brazil. It sets out how BounceZero Ltd ("Processor", "we", "us") complies with the Lei Geral de Proteção de Dados ("LGPD", Lei nº 13.709/2018) when acting as an operator on your behalf. In the event of any conflict, the more protective obligation prevails.

1. Introduction

This Addendum forms part of the Master DPA. The terms defined in the Master DPA apply to this Addendum unless stated otherwise. Where this Addendum uses LGPD terminology, "controller" (controlador) means you, and "operator" (operador) means BounceZero.

We process personal data on EU infrastructure (OVH, France). BounceZero does not maintain an establishment in Brazil; this Addendum governs our processing of personal data of Brazilian data subjects on your behalf.

2. Governing Law and Regulator

The processing described in this Addendum is governed, so far as the data subjects are in Brazil, by the LGPD (Lei nº 13.709/2018), in force since 18 September 2020, and by the regulations and guidance of the Autoridade Nacional de Proteção de Dados (ANPD). The ANPD has been operating as a full regulator since 2025, with its enforcement powers and sanctioning regime active. Administrative fines for non-compliance can reach 2% of the revenue of the infringing undertaking in Brazil, capped at BRL 50,000,000 per infraction (LGPD Art. 52).

3. Role and Scope

For the email verification services described in the Master DPA, you act as the controller and we act as the operator under LGPD Art. 37. The subject matter, nature, and purpose of the processing are the same as set out in Section 2 of the Master DPA: syntactic validation, DNS/MX lookup, SMTP probing, catch-all detection, deliverability scoring, and fraud/abuse checks of the email addresses you submit.

We process personal data only on your documented instructions and never for our own benefit, unless required by applicable law (LGPD Art. 6(X)).

4. Data Subject Rights

We will assist you in responding to requests from data subjects (titulares) exercising their rights under LGPD Art. 18, including:

• Confirmation of whether their personal data is being processed.
• Access to the personal data and information about the processing.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymisation, blocking, or deletion of unnecessary or excessive data.
• Portability of the data to another service provider, on your instruction.
• Information about the entities with which you have shared the data.
• Revocation of consent and opposition to processing.

If a data subject contacts us directly, we will forward the request to you without undue delay and comply with your reasonable instructions. You are responsible for the legal basis of the processing, including consent or legitimate interest as applicable (LGPD Art. 7).

5. Breach Notification

We will notify you of any security incident affecting the personal data you submitted, without undue delay and, where feasible, within 72 hours of becoming aware of it, consistent with the Master DPA. You, as controller, are responsible for notifying the ANPD and affected data subjects where the LGPD requires it (Art. 48). We will provide the information needed to support your notification.

6. Cross-Border Transfers

Personal data of Brazilian data subjects is processed on EU infrastructure. The LGPD (Art. 33) permits transfers to countries or jurisdictions that provide an adequate level of data protection; the ANPD has recognised the European Union as providing adequate protection. To the extent any transfer relies on safeguards rather than adequacy, we rely on the Standard Contractual Clauses set out in the Master DPA. A copy is available on request at [email protected].

7. Additional Obligations

• Record of processing: we maintain records of processing activities that allow you to demonstrate compliance with LGPD Art. 37.
• DPIA support: where the LGPD or ANPD guidance requires an impact assessment (Relatório de Impacto à Proteção de Dados), we will provide the information about our processing reasonably needed for you to complete it.
• Data minimisation: only the email addresses and derived metadata necessary for validation are processed (LGPD Art. 6(III)).
• Audit: we will co-operate with reasonable audits conducted by you or your authorised auditor, on reasonable prior written notice.

8. Contact

For enquiries about this Addendum or to exercise rights in respect of the processing described here, contact our Data Protection contact:

You may also refer to the Master DPA and its terms on sub-processors, security measures, retention, and liability at bouncezero.io/dpa.