Amplemarket

GDPR overview

GDPR implementation is concrete and documented. Amplemarket publishes a dedicated GDPR page and a separate CCPA page, and bases its prospecting on legitimate interest rather than consent. It designates itself a controller, participates in the EU-US, UK and Swiss Data Privacy Frameworks under Department of Commerce certification with FTC oversight, and falls back on the 2021/914 Standard Contractual Clauses plus the UK Addendum where no adequacy decision applies. A Data Processing Addendum is published and incorporated into the terms, and a European representative is named in the privacy policy. Data subject requests are answered, and customers get geo-fencing and uploadable exclusion lists, with opt-out prospects added automatically. Notably, the vendor states it obtains no notices or consents on the customer's behalf, and concedes it may qualify as a data broker under the CCPA.

Who owns the data?

The terms split ownership in two. Customers keep full ownership of the Customer Submitted Content they upload. Amplemarket keeps ownership of system performance data, its machine learning algorithms and the aggregated results of that learning, and claims exclusive ownership of Usage Data, meaning everything collected or inferred while delivering the service, including deliverability data. In exchange, the customer grants Amplemarket a worldwide, irrevocable, non-exclusive, perpetual and royalty-free licence to host, process, analyse and improve on that content, with the right to sublicense, assign or transfer it. Feedback given to the vendor may be exploited without restriction or compensation.

Reuse rights

Amplemarket may use submitted content to improve its service, explicitly including verifying and expanding the Service Output Data in its Information Directory, that is, the database served to other customers. It may host, copy, transfer and analyse that content with machine learning, and may publish or distribute it in aggregated, de-identified form for any purpose. It commits not to name the customer publicly or associate them with the content. On the customer side, reuse is deliberately fenced: prospect data may only be processed within a defined Business Scope, for business relationships relevant to the person's professional role, never for consumer-oriented or purely personal messaging. Any use beyond that scope requires an existing direct relationship or proper consent. The customer, not Amplemarket, carries the duty to issue notices and obtain consents.

Data retention & training

Hosting summary

Amplemarket hosts its application on Google Cloud Platform, in containers running on managed services, so it states it does not operate servers or compute instances in production itself. Its GDPR page says services are hosted in United States data centres, under data protection agreements with its vendors, and the terms confirm that transfers from the European Economic Area, the United Kingdom and Switzerland go to systems hosted in the United States. Those transfers are governed by the Data Privacy Framework and, where no adequacy decision applies, by the 2021/914 Standard Contractual Clauses and the UK Addendum. Data is encrypted at rest and in transit, with encryption keys managed through Cloud Key Management and hardware security modules. Security is audited annually against SOC 2 Type II, with third-party penetration testing, GitHub Advanced Security scanning and SonarQube analysis. Internal access is role-restricted and reviewed twice a year. No European data residency option is mentioned anywhere on the site.