Cat Media Data Processing Statement

Introduction

This Data Processing Statement outlines the practices employed by Cat Media Ltd ("Cat Media," "we", "us", "our") when acting as a data processor for our clients, who are the data controllers. This statement applies when we process personal data on behalf of our clients, which may involve extracting data from various client-controlled tools and platforms, including HubSpot, Microsoft, Google, ZoomInfo, and others.

If you have additional questions or require more information about our Data Processing Statement, do not hesitate to contact us.

Definitions

Data Controller: The entity which determines the purposes and means of the processing of personal data.
Data Processor: Cat Media Ltd, which processes personal data on behalf of the data controller.
Personal Data: Any information relating to an identified or identifiable natural person.

Processor

A "processor" is an individual or organization that processes personal data on behalf of a controller. Cat Media Ltd acts as a designated processor, handling data processing activities as instructed by our clients, who are the data controllers. In these circumstances, we do not determine the purposes for which or the manner in which personal data is processed. This role is strictly limited to managing data in accordance with the directions provided by our clients and in compliance with our agreement. Our responsibilities and activities as processors are governed by specified instructions from our clients, adhering to legal standards set forth in data protection laws such as the UK-GDPR and the EU GDPR.

1. Data Collection

We process personal data as directed by our clients and strictly for the purpose of providing agreed services, which may include CRM management, data analytics, marketing support, and other related services. The specific types of personal data processed and the processing activities involved are set out in the applicable service agreement, statement of work, data processing agreement, or documented client instructions.

When we process personal data to provide our services. These activities include:

Formatting and Importing Lists into CRM: To manage customer relationships effectively.
Data Deduplication: To ensure the accuracy and uniqueness of data.
Support Services: To assist our customers with their queries and service-related issues.
AI Algorithm Usage: Leveraging advanced AI-powered tools by Microsoft Azure Cognitive Services for analytics, data quality, and agreed service delivery.
Enterprise AI-enabled data quality and CRM analysis: Where required to provide agreed services, Cat Media may use secure business, enterprise, private, or contractually controlled AI-enabled systems for data quality analysis, deduplication, standardisation, matching, enrichment, CRM analysis, workflow design, and implementation support. Cat Media does not use free, personal, public, or unmanaged consumer AI accounts to process client personal data or confidential information for service delivery.

How do we collect your data?

We receive personal data directly from our clients, who are responsible for obtaining the data in compliance with applicable data protection laws. Cat Media is granted access to records that may identify individuals by name, email address, and company and include other personal data, all of which are to be treated as confidential. For instance, as HubSpot Solution Partners, our services might include accessing and extracting data via exports, API calls, or webhooks from our clients’ HubSpot accounts under the client's explicit instructions throughout the duration of the contracted work. We do not use or process the data for any purpose other than fulfilling our contractual obligations as explicitly defined by our client.

Use of AI-enabled tools

Cat Media may use AI-enabled tools as part of agreed service delivery, including data quality, deduplication, standardisation, matching, enrichment, CRM analysis, workflow design, implementation support, and related consultancy services.

Cat Media does not use free, personal, public, or unmanaged consumer AI accounts to process client personal data or confidential information for service delivery.

Cat Media’s proprietary and managed tools are hosted and operated within Cat Media’s Microsoft environment. These tools may use Microsoft Azure AI services, Microsoft Foundry / Azure AI Foundry, Azure OpenAI models, and other Microsoft enterprise services.

Cat Media may also use approved commercial AI services, including OpenAI business services, the OpenAI API, Anthropic/Claude commercial services, and AI features available within client-owned platforms such as HubSpot AI/Breeze, where appropriate for agreed service delivery.

Where AI features are used within a client-owned platform, such as HubSpot AI/Breeze, Cat Media acts under the client’s documented instructions and the client’s platform configuration, permissions, AI settings, and applicable platform terms.

Client personal data and confidential information are processed only under the client’s documented instructions. Cat Media does not use client personal data or confidential information to train public, shared, or third-party foundation models, and does not authorise approved subprocessors to do so.

2. Legal Basis for Processing

Where Cat Media acts as a processor, the client, as data controller, is responsible for identifying the applicable legal basis for processing personal data. Cat Media processes personal data only on the client’s documented instructions, including any instructions relating to transfers to a third country or international organisation, unless required to do otherwise by applicable law.

The personal data processed by Cat Media is used exclusively for the purposes specified by our clients, which may include CRM management, marketing operations, customer support, data analytics, data quality, implementation, integration, and related consultancy services. All processing activities are carried out in accordance with the applicable client agreement, statement of work, data processing agreement, and documented client instructions.

Cat Media ensures that personnel authorised to process personal data are subject to appropriate confidentiality obligations.

3. Data Storage and Security

How do we store your data?

Extracted data is stored temporarily in our secure systems when necessary for processing, after which it is either returned to the client or securely deleted, as per contractual agreements.

Cat Media Ltd securely stores your data at:

HubSpot CRM software HubSpot, Inc., HubSpot Ireland Limited, and the HubSpot affiliates listed in Annex 4 to the Data Processing Agreement) Visit HubSpot's Privacy Policy to learn more. HubSpot CRM is used for longer-term data storage for ongoing customer relationship management.
Microsoft Business Cloud, Office 365, inclusive of OneDrive and SharePoint, in accordance with Microsoft GDPR compliance. Visit Microsoft's Privacy Policy to learn more. Personal data is temporarily stored on SharePoint when applicable, utilising strong encryption protocols to ensure data security.
Microsoft Azure Cloud, in accordance with an extensive range of national, regional, and industry-specific legislative requirements and security standards, the Microsoft Azure Cloud Platform maintains strict compliance with such regulations, including, inter alia, SOC 2, ISO 27001, and multiple additional standards.

We aim to process and store your personal data in the European Union (EU) or in the United Kingdom (UK), but this isn’t always possible; thus, we may occasionally process, store, and transfer your personal data to service providers located in a country outside of the EU/UK. Whenever we transfer personal data out of the EU/UK, we ensure a similar degree of protection is afforded to it by ensuring one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data and
• Where we use certain service providers, we may use specific contracts such as standard contractual clauses approved for use in the EU/UK which give personal data the same protection it has in the UK. For example, the use of Article 46 UK and EU GDPR safeguard mechanisms to transfer personal data to “third countries” endorsed by the UK Government or European Commission.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EU/UK.

Data Security

Cat Media implements and maintains appropriate technical and organisational measures, as required by Article 32 of the UK GDPR and EU GDPR, to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure.

Our security measures include:

We implement robust security measures, including encryption, access control, and secure data transfer protocols to protect data against unauthorised access, alteration, or destruction.
Regular security assessments and audits are conducted to ensure the ongoing effectiveness of our security practices.
Implementation of data anonymization techniques where feasible.
Comprehensive training for all employees on data protection.
Continuous monitoring and incident response plans are in place to address potential data breaches swiftly and effectively.

Learn more about Cat Media's Data Security.

4. Sub-processors and Third-party Sharing

In addition to our primary partners, HubSpot and Microsoft, we may use selected third parties and subprocessors to help provide agreed services. Where subprocessors are used, they are subject to appropriate data protection, confidentiality, and security obligations, and their use is governed by applicable agreements, data processing terms, and client instructions.

Cat Media will inform clients of any intended changes concerning the addition or replacement of subprocessors and provide an opportunity to object to such changes, where required under the applicable data processing agreement. We do not share client personal data with third parties unless required to provide the agreed services, authorised by the client, or otherwise permitted under the applicable agreement and data protection terms.

Where AI-enabled tools or managed Cat Media tools are used to deliver agreed services, these may include Microsoft cloud infrastructure, Microsoft Azure AI services, Microsoft AI Foundry, Azure OpenAI models, OpenAI business services, the OpenAI API, Anthropic/Claude commercial services, client-owned platform AI features such as HubSpot AI/Breeze, CRM platforms, data quality tools, deduplication tools, and secure business productivity systems.

Such tools are used only for the agreed service purpose and, where personal data is involved, under the applicable client agreement, data processing agreement, approved subprocessor framework, transfer mechanism, and security controls. Cat Media does not authorise subprocessors to use client personal data or confidential information to train public, shared, or third-party foundation models.

Full details of these third-party partnerships are available upon request.

5. Data Subject Rights

As a data processor, we assist our clients in fulfilling their obligations to respond to requests for exercising data subject rights under data protection laws. This includes rights of access, correction, deletion, and data portability.

Where Cat Media uses client-owned platforms or approved business systems, such as HubSpot, Microsoft, or meeting recording/transcription tools, processing may include CRM activity records, emails, meeting recordings, transcripts, AI-generated notes, call logs, and related implementation or support records, where required for the agreed services and subject to the applicable client agreement, data processing agreement, platform settings, permissions, and documented client instructions.

Requests from data subjects to exercise their rights should be directed to the data controller. However, we will support our clients in responding to such requests as specified in our service agreements.

Where a request relates to personal data that Cat Media controls directly, such as personal data held in Cat Media’s own CRM, marketing systems, website forms, event records, or commercial records, individuals may submit a request through our Data Privacy Request Form or contact legal@catmedia.ie. Where a request relates to personal data processed by Cat Media on behalf of a client, the request should be directed to the relevant client as the data controller, and Cat Media will assist the client in accordance with the applicable agreement and data processing terms.

6. Data Retention and Deletion

How long will we retain your data?

Cat Media retains client service data processed as a processor only for as long as necessary to provide the agreed services, comply with documented client instructions, meet contractual obligations, and satisfy applicable legal, audit, tax, insurance, or compliance retention requirements. Retention periods for client service data are governed by the applicable client agreement, statement of work, data processing agreement, documented client instructions, and Cat Media’s internal retention policies.

Secure Deletion

We follow appropriate procedures to securely delete or return personal data when it is no longer required for the agreed services or when instructed by the client, subject to applicable legal, audit, tax, insurance, backup, or compliance retention requirements. Where data is retained in archival or backup systems, it remains protected and is deleted in accordance with Cat Media’s normal retention and backup lifecycle. Confirmation of deletion can be provided to the client where required under the applicable agreement.

Clients can request the deletion of their data as per data protection rights. Data is also deleted in accordance with Cat Media’s data retention policy once it is no longer necessary for the purposes for which it was collected.

Clients can request data deletion by contacting our Data Protection Officer via legal@catmedia.ie

7. Compliance and Auditing

Cat Media is committed to processing personal data in accordance with the UK GDPR, EU GDPR, and other applicable data protection laws. We regularly review and update our data processing practices to reflect changes in legal, regulatory, contractual, and security requirements.

Cat Media will make available all information necessary to demonstrate compliance with the obligations laid out in this statement and allow for and contribute to audits by the client or an auditor mandated by the client. Cat Media will immediately inform clients if, in its opinion, an instruction infringes upon this Regulation or other domestic laws relating to data protection.

Changes to our Data Processing Statement

Cat Media keeps its Data Processing Statement under regular review and places any updates on this web page. This statement was last updated on 1 April 2026.

How to contact us

For further information about our data processing practices, or if you have any questions regarding this statement, please contact our Data Protection Officer at legal@catmedia.ie.

Email us at: legal@catmedia.ie

Call us: (+353) 1 263 0390.

Or write to us by post: The Academy Building, Park West Business Park, D12FF83, Dublin, Ireland.

How to contact the appropriate authority

Should you wish to report a complaint or if you feel that Cat Media has not addressed your concern adequately, you may contact the Irish Data Protection Commission.

Data Processing Agreement