1. Clause 01

   Permitted use

   Buyer may use the Lead Data solely for Buyer's own B2B marketing and outreach. Buyer shall not append Lead Data to retargeting audiences, enrich Lead Data with consumer personal information, or use Lead Data for automated decision-making or profiling that produces legal or similarly significant effects.

2. Clause 02

   No-resale and no-redistribution

   Buyer may not resell, sublicense, share, or otherwise transfer Lead Data to any third party. Internal use only. Buyer is responsible for ensuring its employees and contractors comply with this Agreement.

3. Clause 03

   Geographic and channel restrictions

   Buyer warrants compliance with all applicable data protection and electronic marketing laws, including the UK General Data Protection Regulation, the EU GDPR, the UK Privacy and Electronic Communications Regulations, the US CAN-SPAM Act, the California Consumer Privacy Act and the California Privacy Rights Act, the US Telephone Consumer Protection Act, Canada's Anti-Spam Legislation, and Australia's Spam Act 2003.

4. Clause 04

   Article 14 source disclosure flow-down

   Buyer must include, on first contact with a data subject, a disclosure identifying Keystone Leads as the source of the contact details and the lawful basis relied upon (legitimate interest, public business record, or opt-in). Keystone Leads provides a templated disclosure with each pack delivery.

5. Clause 05

   Opt-out and suppression handling

   Buyer must (a) include a working opt-out or unsubscribe mechanism in every commercial message, (b) honour opt-outs within the time required by applicable law, (c) maintain a running suppression list of contacts who have opted out, and (d) share that suppression list with Keystone Leads upon request.

6. Clause 06

   Retention limit

   Buyer must delete or de-identify Lead Data within 12 months of delivery or upon completion of the campaign for which the data was purchased, whichever is sooner. Buyer shall certify destruction to Keystone Leads upon request.

7. Clause 07

   Mobile number and TCPA special handling

   Where Lead Data includes mobile numbers flagged as requiring Prior Express Written Consent (PEWC), Buyer warrants that it has obtained PEWC before initiating any automated telephone dialing system (ATDS) call or any SMS or MMS message to such numbers. Buyer indemnifies Keystone Leads for any TCPA claim arising from Buyer's use of mobile numbers in any pack.

8. Clause 08

   Lawful basis documentation

   Buyer must conduct and document its own legitimate interest assessment (or alternative Article 6 GDPR lawful basis) before contacting any data subject, and must retain that documentation for at least three years.

9. Clause 09

   Indemnification

   Buyer shall indemnify, defend, and hold harmless Keystone Leads, its affiliates, and their respective directors, officers, employees, and agents from and against all third-party claims, regulatory fines, and class-action exposure arising from Buyer's use of the Lead Data, including reasonable legal fees and costs.

10. Clause 10

    Audit rights

    Keystone Leads may audit Buyer's compliance with this Agreement on 30 days' written notice, no more than once per calendar year. Buyer shall maintain books and records sufficient to demonstrate compliance for three years from the date of each pack delivery.

11. Clause 11

    Data broker status representation

    Each party represents whether it is a data broker under the laws of California, Vermont, Oregon, or Texas. The responsible party shall register as a data broker and pay all associated fees in each relevant jurisdiction.

12. Clause 12

    Termination for cause

    Material breach of this Agreement terminates Buyer's right to use the Lead Data immediately. Upon termination, Buyer shall destroy all Lead Data in its possession and certify destruction to Keystone Leads within 30 days.

Effective date and updates

This agreement is effective as of 22 June 2026. Material updates will be announced by email to all active buyers at least 30 days before they take effect. The current version is always available at /leads/dpa.

Questions

Email legal@keystonehq.xyz with "DPA Question" in the subject line.