Skip to content
GTM Studio
Sign inStart free

Data processing agreement

Last updated 2 November 2026. GTM Studio is run by KubeGraf. Questions: legal@kubegraf.io.

This agreement forms part of the terms of service. It applies when KubeGraf processes personal data for a customer under UK GDPR and EU GDPR. The customer is the controller. KubeGraf is the processor.

  1. 1. Subject and duration

    We process personal data to provide GTM Studio for as long as the customer’s workspace exists, and for up to 30 days after it is deleted.

  2. 2. Types of data and people

    • Business contacts of the customer’s prospects: name, job title, company, work email, country, and where the data came from.
    • Messages sent and received through connected mailboxes.
    • The customer’s own users: name, work email and activity in the workspace.

  3. 3. Our obligations

    • Process data only on the customer’s documented instructions, which include the settings and actions in the workspace.
    • Make sure our staff are bound by confidentiality.
    • Keep appropriate security, including per-workspace database isolation, encryption of secrets with a per-workspace key, access logging and backups.
    • Help the customer answer data subject requests, including by keeping suppression lists and deleting contacts on request.
    • Tell the customer without undue delay, and within 48 hours, after becoming aware of a personal data breach.
    • Delete or return data at the end of the service.
    • Make available the information needed to show we meet these obligations, and allow audits on reasonable notice.

  4. 4. Subprocessors

    The customer gives general authorisation for the listed subprocessors. We will give 30 days notice of a new subprocessor, and the customer may object. Data providers, mailboxes and other tools the customer connects with its own keys are the customer’s own vendors, not our subprocessors.

  5. 5. International transfers

    Data is stored in the EU. Where a subprocessor processes data outside the UK or EEA, we rely on adequacy decisions or the standard contractual clauses with the UK addendum.

  6. 6. Built-in safeguards

    The service refuses actions that break the rules in our acceptable use policy, including the country table, suppression checks and the ban on contacting community members. These safeguards help the customer comply but do not replace the customer’s own assessment.

Data processing agreement · GTM Studio