Data Processing Agreement (DPA)

Last updated: February 2026

This Data Processing Agreement ("DPA") is part of the agreement between Keyplay, Inc. ("Keyplay") and the user of Keyplay's services ("User").

What We Process

Keyplay is a B2B account enrichment platform. We process company-level data, including:

We do not process consumer personal data or sensitive personal data.

All data is processed in the United States on Google Cloud Platform (US-West).

We process data only as necessary to provide our services and in accordance with Customer instructions.
All Keyplay personnel are bound by confidentiality obligations.
We maintain appropriate technical and organizational security measures, including:
- TLS 1.3 encryption in transit
- AES-256 encryption at rest
- Access controls limiting database access to authorized personnel
We are SOC 2 Type II certified. Reports are available at:
https://trust.delve.co/keyplay
Upon termination of our agreement, Customer data is deleted unless retention is required by law.

We use third-party sub-processors to deliver parts of our service. A current list is available by emailing security@keyplay.io.

We will notify Customers prior to adding new sub-processors and ensure they meet equivalent data protection standards.

If we become aware of a security breach affecting Customer data, we will notify the Customer within 72 hours.

For data transferred from the EEA, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

Where the California Consumer Privacy Act (CCPA) applies, Keyplay acts as a Service Provider. We do not sell or share personal information.

If we receive a data subject request directly, we will redirect the request to the Customer and provide reasonable assistance as needed.