Data Processing

Depending on the activity, Conversion Engine may act as an independent controller (for example, our own prospecting CRM and website forms) or as a processor / service provider processing personal data on a client's documented instructions (for example, uploading customer or lead lists into approved outreach tools).

AtomicoLabs affiliates may assist as sub-processors under appropriate contractual controls when needed to deliver the engagement.

Typical categories may include business contact data (name, title, work email, LinkedIn URL, company), campaign engagement events, website conversion events, and account credentials or access tokens you authorize us to use. We do not seek to process special-category personal data unless expressly agreed in writing.

Processing supports agreed growth activities such as ICP research, content distribution, paid media, SEO, outbound sequencing, reporting, and optimization — solely for the client's legitimate business purposes defined in the engagement.

When we act as a processor, we process personal data only on documented client instructions unless law requires otherwise. We use vetted sub-processors (for example advertising platforms, ESP/sequencing tools, analytics, and infrastructure providers) and will maintain an up-to-date list upon request.

We apply administrative, technical, and organizational measures appropriate to the risk: access controls, least-privilege practices, encryption in transit where supported, and vendor due diligence. No method of transmission or storage is perfectly secure; we work to protect data using industry-reasonable practices.

Tools used in campaigns may process data in the EU, US, or other regions. Where transfers require safeguards, we rely on appropriate transfer mechanisms (such as SCCs) and configure vendors accordingly where feasible.

Processor data is retained for the engagement duration and a short wind-down period for reporting and dispute resolution, then deleted or returned per client instruction — unless law requires longer retention of specific records we hold as controller.

If we become aware of a personal-data breach affecting processor data, we will notify the client without undue delay and provide information reasonably available to support compliance obligations.

When acting as a processor, we will assist the client — through appropriate technical and organizational measures — in responding to data-subject requests, insofar as feasible for the services.

For DPA requests or processing questions: hello@conversion-engine.com.