Respona

GDPR overview

Respona publishes a standalone Data Processing Addendum, last updated 12 September 2025, covering the GDPR, UK GDPR, the Swiss DPA, the ePrivacy Directive, CCPA/CPRA, VCDPA, LGPD, the Australian Privacy Act 1988, the New Zealand Privacy Act 2020 and Philippine RA 10173. Restricted transfers rely on the European Commission's Standard Contractual Clauses, the UK Addendum or IDTA, and adequacy decisions. The privacy policy sets out access, rectification, erasure, restriction, portability, objection, withdrawal of consent and the right to complain to a supervisory authority, and the DPA adds breach notification and audit cooperation through SOC reports or third-party attestations. Two gaps stand out: no Article 27 EU representative and no Data Protection Officer are named anywhere, and there is no dedicated privacy address, requests going to the Privacy Office at the general support mailbox. Respona never claims to be GDPR compliant in those words.

Who owns the data?

Respona splits the roles. It is controller for account, billing and marketing data, and processor for the prospect data you upload, which stays yours and which you remain legally responsible for having collected lawfully. The privacy policy confirms that "Users may delete Prospect Data at any time", and the DPA commits Respona to deleting or returning customer data when the contract ends, unless the law requires otherwise. Two things never become yours: Respona keeps all rights to its AI models and underlying technology, and ownership of placement deliverables follows the order form. Absent a clause there, Respona retains the rights and grants you a limited licence.

Reuse rights

Respona processes personal data to deliver the service, manage accounts, handle billing, provide support, send marketing communications, secure the platform and meet legal obligations, relying on consent, legitimate interest, performance of the contract or legal obligation depending on the purpose. It states that it does not sell personal data and does not pass it to third parties for their own marketing. Automated processing covers classification, routing, anomaly detection and the generation of suggested outreach content, with no fully automated decision producing legal or similarly significant effects. On training, the policy is explicit: "AI-driven features do not train on identifiable prospect data uploaded by Users. When machine-learning optimization is used, it relies exclusively on aggregated, anonymized, or synthetic data that cannot be linked back to an identifiable individual." Data obtained through Google APIs is additionally bound by the Google API Services User Data Policy, Limited Use requirements included. The prospect data you upload stays yours to use and to delete at any time, without asking permission.

Data retention & training

Hosting summary

Respona names no hosting provider and no hosting country anywhere on its site. What the privacy policy does say is that using the service implies consent to your personal data being transferred, processed and stored in countries other than your own, "including the United States", and that cloud hosting, analytics, email infrastructure and support providers may sit outside your jurisdiction. The security annex to the DPA is far more concrete about safeguards than about geography: TLS encryption in transit, encryption at rest for production databases, warehouses and backups, physical access controls, fire detection, tested backups and continuity plans. Respona states that its hosting providers hold ISO 27001, SOC 1 and SOC 2 certifications and that it reviews their audit reports. One point is an inference rather than a statement: the site is served behind Cloudflare on an anycast address, which describes delivery infrastructure, not where customer data is stored. In short, United States jurisdiction is the reasonable reading, the contractual safeguards are documented, but the physical location of the data is never disclosed.