This Data Processing Agreement ("DPA") is between the customer that accepts the Terms of Service ("Customer") and MobileValidate LLC, a limited liability company registered in the United States (operating office: 5th floor, Minkara Building, Clemenceau Street, Beirut, Lebanon) ("MobileValidate"). It forms part of the Terms and applies automatically, without signature, whenever MobileValidate processes Customer Personal Data. A countersigned copy is available on request from support@mobilevalidate.com.
1. Definitions
1.1 "Data Protection Laws" means all laws on personal data that apply to the processing under this DPA, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as retained in UK law ("UK GDPR") and the Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws, Lebanese Law No. 81 of 2018, and UAE Federal Decree-Law No. 45 of 2021.
1.2 "Customer Personal Data" means personal data in the Identifiers, metadata and other data that Customer or its users submit to the Service, and in the Results of Customer's Checks, processed by MobileValidate on behalf of Customer.
1.3 "Sub-processor" means a third party engaged by MobileValidate that processes Customer Personal Data.
1.4 "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
1.5 "Controller", "processor", "data subject", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR; "service provider", "sell" and "share" have the meanings given in the CCPA. Other capitalised terms have the meanings given in the Terms.
2. Roles of the parties
2.1 Customer is the controller. Customer determines the purposes of processing Customer Personal Data and decides which Identifiers to submit. Where Customer acts as a processor for a third-party controller, Customer warrants that it is authorised by that controller to give the instructions in this DPA, and MobileValidate acts as Customer's sub-processor.
2.2 MobileValidate is the processor. MobileValidate processes Customer Personal Data only to provide the Service to Customer. This includes checks of whether an Identifier is registered on a platform: Customer determines the purpose and the input, and MobileValidate selects the technical means (routing, partners, caching) only as a service provider to Customer, so it acts as Customer's processor.
2.3 Where MobileValidate is an independent controller. MobileValidate is an independent controller, not a processor, for: (a) its spam-reputation dataset, including when it returns a reputation signal for an Identifier that Customer submits; (b) its suppression list of Identifiers whose holders have objected, which it applies to all customers; (c) account, billing, support and website data about Customer and its users; (d) security, fraud and abuse prevention and sanctions compliance; and (e) aggregated, anonymous statistics. Those activities are described in the Privacy Policy and the data-subject notice.
2.4 CCPA. For the purposes of the CCPA, MobileValidate is Customer's service provider. MobileValidate will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than the business purposes set out in this DPA, or outside the direct business relationship with Customer; will not combine it with personal information it receives from others except as the CCPA permits; will comply with the CCPA and provide the same level of privacy protection it requires; and will notify Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and remediate unauthorised use. MobileValidate certifies that it understands these restrictions.
3. Customer's instructions and responsibilities
3.1 Instructions. The Terms, this DPA, Customer's use of the API and dashboard (including the services requested and the retention settings chosen) and any other written instructions agreed by the parties are Customer's complete instructions. MobileValidate will process Customer Personal Data only on those instructions, unless the law requires otherwise, in which case it will inform Customer before processing unless the law prohibits that. MobileValidate will tell Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or changed.
3.2 Customer's responsibilities. Customer is solely responsible for: the lawfulness of the processing it instructs; having a valid legal basis and giving all notices for every Identifier, including the specific authority that section 5 (item 9) of the Terms requires for account Checks; the accuracy and quality of Customer Personal Data; honouring data subjects' objections; and complying with its own obligations under Data Protection Laws. Customer will not submit special categories of personal data or data relating to criminal convictions, and will not attach metadata containing personal data beyond what the check needs.
4. Confidentiality
MobileValidate ensures that every person it authorises to process Customer Personal Data is bound by an appropriate duty of confidentiality and processes the data only as needed to provide the Service.
5. Security
MobileValidate implements the technical and organisational measures in Annex II, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. MobileValidate may update these measures, provided that the overall level of protection is not reduced.
6. Sub-processors
6.1 General authorisation. Customer gives MobileValidate a general written authorisation to engage Sub-processors, including its affiliates, hosting and infrastructure providers, and data-verification partners that perform checks.
6.2 List. MobileValidate publishes the categories of Sub-processors in Annex III and on the Trust page. On request, MobileValidate gives Customer, without undue delay, the name, address, contact point, role, processing location and service of each Sub-processor that processes Customer Personal Data, so that Customer can meet its obligations as controller. This information is MobileValidate's confidential information under the Terms; Customer may disclose it to its supervisory authority, auditors and advisers, and as the law requires.
6.3 Changes. MobileValidate will give at least 14 days' notice before adding or replacing a Sub-processor, by e-mail to Customer's account address or in the dashboard (and, for customers who have asked for the named list, by sending the updated list). Customer may object on reasonable data-protection grounds by e-mail within that period. The parties will discuss the objection in good faith. If it is not resolved, Customer's sole and exclusive remedy is to stop using the affected service or to close its account under the Terms.
6.4 Flow-down. MobileValidate imposes on each Sub-processor, by written contract, data-protection obligations that are in substance no less protective than those in this DPA, and remains responsible to Customer for the Sub-processor's performance of them, as Article 28(4) GDPR requires, subject to section 12.
7. Data subject requests
7.1 If MobileValidate receives a request from a data subject about Customer Personal Data, it will pass the request on to Customer where it can identify Customer, and will not answer it itself except to tell the data subject that the request has been passed on. This does not apply to objections handled through MobileValidate's own suppression list, for which MobileValidate is controller.
7.2 Taking into account the nature of the processing, MobileValidate assists Customer by appropriate technical and organisational measures in meeting its obligation to respond to data-subject requests, primarily through the Service's features (for example retention settings and deletion of jobs). Assistance beyond those features is provided at Customer's cost at MobileValidate's then-current rates.
8. Personal data breaches
8.1 MobileValidate will notify Customer of a personal data breach affecting Customer Personal Data without undue delay, and in any case within 72 hours after becoming aware of it, by e-mail to Customer's account address.
8.2 The notification will describe, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where information is not yet available, it will be provided in phases without undue further delay.
8.3 MobileValidate will take reasonable steps to contain and remedy the breach and will cooperate with Customer's reasonable requests. Customer is responsible for any notifications to supervisory authorities and data subjects that the law requires of a controller. A notification under this section is not an admission of fault or liability.
9. Impact assessments and consultation
Taking into account the nature of the processing and the information available to it, MobileValidate will provide reasonable assistance with Customer's data-protection impact assessments and prior consultations with supervisory authorities, primarily by making available the documentation described in section 11. Further assistance is at Customer's cost.
10. Deletion and return
10.1 During the term, Customer Personal Data is deleted automatically according to the retention periods in Annex I and Customer's retention settings, and Customer can delete a finished job at any time.
10.2 When the Service ends, MobileValidate will delete Customer Personal Data at the latest when the retention periods in Annex I expire, unless the law requires it to keep the data. Customer can retrieve Results through the API or dashboard before they are deleted; this is the means of return. Copies in encrypted backups are overwritten in the normal backup cycle and are not restored except to recover the service, in which case deletions are applied again. On request, MobileValidate will confirm deletion in writing.
11. Audits and information
11.1 Documentation. MobileValidate will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA, consisting of: this DPA and its annexes, a description of its security measures, and written answers to a reasonable security and privacy questionnaire.
11.2 Frequency. Customer may request the questionnaire answers, or a remote audit by written questions and document review, once in any 12-month period, and additionally after a personal data breach affecting Customer or where a supervisory authority requires it.
11.3 On-site audits. An on-site inspection takes place only where a supervisory authority with jurisdiction over Customer requires it and the information in 11.1 does not satisfy that requirement. It must be requested with at least 30 days' written notice, conducted during business hours without disrupting operations, limited to the processing of Customer Personal Data, and carried out by Customer or an independent auditor bound by confidentiality who is not a competitor of MobileValidate. It does not include access to other customers' data, to the confidential terms or systems of Sub-processors or partners, or to information whose disclosure would compromise security.
11.4 Costs. Each audit is at Customer's cost, including MobileValidate's reasonable time at its then-current rates. All audit information is MobileValidate's confidential information.
12. Liability
Each party's liability under or in connection with this DPA, including the SCCs and the UK Addendum to the extent the law allows, is subject to the exclusions and limitations of liability in the Terms of Service, which apply in aggregate to all claims under the Terms and this DPA. Nothing in this section limits the rights of data subjects under the SCCs or limits liability where the law forbids it. Customer's obligations to indemnify MobileValidate under the Terms apply to claims arising from Customer Personal Data and Customer's instructions.
13. International transfers
13.1 Where data is processed. MobileValidate's main servers are in the European Union. MobileValidate, its affiliates and some Sub-processors operate from or are located in other countries, including the United States and Lebanon.
13.2 EU SCCs. To the extent that Customer's transfer of Customer Personal Data to MobileValidate is a transfer to a third country subject to the GDPR, the parties enter into, and this DPA incorporates by reference, Module 2 (controller to processor) of the SCCs; where Customer is itself a processor, Module 3 (processor to processor) applies instead. Customer is the data exporter and MobileValidate the data importer. For onward transfers to Sub-processors, MobileValidate uses Module 3 of the SCCs or another valid mechanism. The following options apply:
- Clause 7 (docking clause) applies.
- Clause 9: Option 2 (general written authorisation), with the notice period in section 6.3.
- Clause 11: the optional language does not apply.
- Clause 13: the supervisory authority is the one determined by Clause 13(a) according to Customer's situation; where Customer has no establishment in the EU and no representative, it is the supervisory authority of Ireland.
- Clause 17: the SCCs are governed by the law of Ireland.
- Clause 18: disputes are resolved by the courts of Ireland.
- Annexes I and II of the SCCs are completed by Annexes I and II of this DPA, and Annex III by Annex III.
13.3 UK. For transfers subject to the UK GDPR, the UK Addendum applies and is incorporated by reference: Table 1 is completed with the parties' details in Annex I; Table 2 refers to the SCCs modules and options in section 13.2; Table 3 is completed by Annexes I to III; and in Table 4 the importer may end the UK Addendum as its Section 19 allows.
13.4 Switzerland. For transfers subject to the FADP, the SCCs apply with these amendments: references to the GDPR are to be read as references to the FADP where the FADP applies; the competent supervisory authority is the Federal Data Protection and Information Commissioner; the term "Member State" is not to be interpreted so as to exclude data subjects in Switzerland from suing for their rights in their place of habitual residence.
13.5 Precedence. If there is a conflict between this DPA and the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail.
14. Term and general
This DPA applies for as long as MobileValidate processes Customer Personal Data and ends automatically afterwards, except for provisions that by their nature survive. For the processing of personal data, this DPA prevails over the Terms if they conflict. Otherwise, the governing law and dispute resolution clauses of the Terms apply, except where the SCCs require otherwise.
Annex I: Description of the processing
A. Parties.
- Data exporter / controller: the Customer, as identified in its account. Contact: the account owner's e-mail address. Role: controller (or processor for its own controller). Activities: use of the Service.
- Data importer / processor: MobileValidate LLC, operating office 5th floor, Minkara Building, Clemenceau Street, Beirut, Lebanon. Contact: support@mobilevalidate.com (subject "Privacy"). Role: processor. Activities: providing the Service.
Acceptance of the Terms is the signature and date of this Annex.
B. Description of the transfer and processing.
| Item | Description |
|---|---|
| Categories of data subjects | People whose phone numbers or e-mail addresses Customer submits, such as Customer's own customers, users, sign-ups, leads, prospects, callers and business contacts |
| Categories of personal data | Phone numbers (normalised to international format) and e-mail addresses; Results (registered / not registered / unknown per service; line type, carrier, original carrier, porting status, network reachability and country; spam-reputation level, score and report classes); timestamps; any metadata Customer attaches |
| Sensitive data | None. Customer must not submit special categories of data. Sensitive network identifiers (such as IMSI, MSC/VLR addresses or cell location) are never returned or stored in readable form. |
| Frequency | Continuous, each time Customer makes a request |
| Nature of the processing | Receipt, normalisation, sealed storage, matching by keyed hash, transmission of the Identifier and check type to the Sub-processor that performs the check, receipt of the answer, structuring, return of the Result to Customer, caching for Customer's account, deletion |
| Purposes | Performing the checks Customer requests; serving Customer's own cache; billing and evidence of charges; handling disputes; security, abuse prevention and applying the suppression list |
| Duration and retention | Real-time lookups 7 days; bulk jobs 30 days by default, configurable by Customer from 1 day to 24 months, or deleted earlier on request; per-account check history (sealed Identifier, answer and time) up to 400 days; API request logs with masked Identifiers 30 days. Billing records retained for accounting contain no Identifiers. |
| Transfers to Sub-processors | Hosting and infrastructure, storage and backups: for the duration above. Data-verification partners: only the Identifier and check type, for the time needed to perform the check, under their own retention commitments. |
C. Competent supervisory authority: as set out in section 13.2.
Annex II: Technical and organisational security measures
- Encryption in transit: all connections to the API, dashboard and website use TLS.
- Sealed storage of Identifiers: phone numbers and e-mail addresses are sealed with public-key encryption as soon as they are stored. The services that receive requests can encrypt but cannot decrypt; decryption keys are held only by the internal component that must run the check. Results are sealed per item.
- Blind indexes: repeat checks and suppressions are matched with keyed HMAC blind indexes of the normalised Identifier, which cannot be reversed or recomputed without the secret key.
- Masking and minimisation in logs and interfaces: logs, the admin panel, job results views and downloads show masked Identifiers. Identifiers are never accepted in URLs or headers, only in request bodies. Checks never return names, photos or profiles.
- Access control for customers: API keys are stored as keyed hashes, shown once, scoped and can be restricted by IP allowlist; all failed key checks get the same answer. Dashboard sign-in uses one-time e-mail codes and optional passkeys (WebAuthn), with step-up confirmation for sensitive actions and short session lifetimes.
- Access control for staff: staff access to administrative functions goes through an identity-aware access gateway with passkeys or hardware security keys; every administrative action is written to an append-only audit log. Database roles follow least privilege.
- Secrets management: platform secrets and partner credentials are kept out of source control and logs, and only the components that need them can read them.
- Retention minimisation: automated deletion jobs apply the retention periods in Annex I; Customer can delete jobs at any time.
- Anti-enumeration and abuse controls: requests that look like sequential number ranges or generated e-mail lists are rejected; rate limits, daily caps and spend caps apply; a per-service kill switch allows a check to be disabled quickly.
- Suppression: the suppression list is applied before every lookup; suppressed Identifiers are never checked.
- Per-account isolation: each customer's cache and results are separate and never served to another customer.
- Webhooks: every delivery is signed and sent only to verified public HTTPS endpoints, with protection against requests to private networks.
- Personnel: confidentiality obligations for everyone with access, and access only as needed for their role.
- Incident response: monitoring and alerting, a breach procedure designed to meet the 72-hour notification commitment, and a published security contact (security@mobilevalidate.com and
/.well-known/security.txt).
MobileValidate does not claim any security certification.
Annex III: Sub-processors
General written authorisation under section 6 applies to Sub-processors in these categories:
- hosting and infrastructure, including network delivery and security;
- storage and backups;
- e-mail delivery and filtering;
- payments;
- the AI model provider used for the support chat;
- data-verification partners that perform individual checks (they receive only the Identifier and the type of check, never Customer's account details).
The named list, with each Sub-processor's location and function, is provided on request under confidentiality.