Data Processing Agreement

This Data Processing Addendum (“DPA”) supplements the SmartReach AI Terms and Conditions, applicable Order Form, Statement of Work, subscription agreement, or other agreement between SmartReach AI LLC (“SmartReach,” “Company,” “we,” “us,” or “our”) and the customer (“Customer,” “Client,” “you,” or “your”) governing Customer's use of SmartReach Services (“Agreement”).

This DPA applies where SmartReach processes Personal Data on behalf of Customer in connection with the Services.

The Services may include:

• SmartReach AI platform services;
• Managed Outbound and full-service outreach;
• SmartData;
• SmartMail;
• SmartLink;
• SmartAgent;
• SmartSonar;
• SmartDesign;
• SmartConvert;
• CRM services;
• website design and hosting;
• website visitor identification;
• website chat;
• AI communications;
• AI voice;
• telephone services;
• SMS;
• WhatsApp;
• email;
• appointment scheduling;
• workflow automation;
• lead management;
• B2B prospecting;
• data enrichment;
• data verification;
• analytics;
• integrations;
• research; and
• related services.

This DPA forms part of the Agreement.

1. Definitions

1.1 Applicable Data Protection Law

“Applicable Data Protection Law” means privacy, data protection, and data security laws applicable to the processing governed by this DPA, including, where applicable:

• the EU General Data Protection Regulation (“GDPR”);
• the UK GDPR;
• the Swiss Federal Act on Data Protection;
• the California Consumer Privacy Act, as amended (“CCPA”);
• other applicable United States state privacy laws; and
• other applicable privacy and data protection laws.

1.2 Customer Data

“Customer Data” means Personal Data provided by or on behalf of Customer to SmartReach or collected, received, generated, stored, transmitted, or otherwise processed by SmartReach on Customer's behalf through the Services.

1.3 Personal Data

“Personal Data,” “Personal Information,” “Controller,” “Processor,” “Business,” “Service Provider,” “Contractor,” “Data Subject,” “Consumer,” “Processing,” “Sell,” “Share,” and similar terms have the meanings assigned under Applicable Data Protection Law.

1.4 Subprocessor

“Subprocessor” means a third party engaged by SmartReach to process Customer Data on behalf of Customer.

1.5 Services

“Services” means the SmartReach products and services covered by the Agreement.

2. Roles and Scope

2.1 Customer as Controller

Where SmartReach processes Customer Data on Customer's behalf:

• Customer acts as Controller, Business, or equivalent role; and
• SmartReach acts as Processor, Service Provider, Contractor, or equivalent role.

If Customer itself acts as a Processor for another party, SmartReach may act as Customer's Subprocessor.

2.2 SmartReach as Independent Controller

This DPA does not apply to processing for which SmartReach independently determines the purposes and means.

SmartReach may act independently as Controller or Business for activities including:

• administration of SmartReach customer accounts;
• SmartReach billing and financial records;
• fraud prevention;
• security;
• SmartReach legal and compliance activities;
• SmartReach's own marketing;
• SmartReach's own B2B research;
• independently sourced professional or business information;
• independently licensed business data;
• aggregated information;
• de-identified information; and
• other processing described in the SmartReach Privacy Policy.

2.3 Processing Instructions

SmartReach will process Customer Data only:

• to provide the Services;
• according to Customer's documented instructions;
• according to Customer's Service configuration;
• according to the Agreement and this DPA; or
• where required by applicable law.

Customer's use and configuration of the Services constitutes documented instructions to SmartReach.

2.4 Unlawful Instructions

SmartReach may notify Customer if SmartReach reasonably believes a Customer processing instruction violates Applicable Data Protection Law.

SmartReach may refuse or suspend processing that SmartReach reasonably believes would violate applicable law.

3. Customer Responsibilities

Customer is responsible for:

• determining a lawful basis for processing;
• providing required privacy notices;
• obtaining required permissions or consent;
• ensuring Customer has the legal right to provide Customer Data to SmartReach;
• maintaining accurate Customer Data;
• complying with direct-marketing requirements;
• maintaining opt-out and suppression information;
• complying with electronic communications laws;
• complying with SMS and WhatsApp requirements;
• complying with telephone and voice requirements;
• complying with applicable call-recording and transcription laws;
• providing cookie and tracking notices;
• obtaining cookie consent where required;
• responding to Data Subject requests as Controller;
• configuring SmartConvert and other Services appropriately; and
• ensuring Customer's instructions comply with Applicable Data Protection Law.

4. Nature of the Processing

SmartReach may perform processing including:

• collection;
• recording;
• storage;
• organization;
• structuring;
• retrieval;
• consultation;
• analysis;
• enrichment;
• verification;
• classification;
• transmission;
• communication;
• AI processing;
• transcription;
• summarization;
• personalization;
• matching;
• scoring;
• aggregation;
• de-identification;
• alteration;
• restriction;
• deletion; and
• other processing reasonably necessary to provide the Services.

5. SmartConvert Processing

Customer acknowledges that SmartConvert may process Customer Data including:

• CRM contact records;
• leads;
• customers;
• prospective customers;
• company information;
• pipeline information;
• opportunities;
• notes;
• tags;
• custom fields;
• website visitors;
• website activity;
• form submissions;
• chatbot conversations;
• AI conversations;
• emails;
• SMS communications;
• WhatsApp communications;
• telephone numbers;
• telephone calls;
• AI voice conversations;
• call recordings where enabled;
• call transcripts;
• call summaries;
• appointments;
• calendar information;
• workflow activity;
• automation history;
• consent status;
• opt-out information;
• analytics;
• IP addresses;
• device information;
• AI prompts;
• AI outputs; and
• related metadata.

6. Managed Outbound Processing

Managed Outbound and full-service outreach may require SmartReach to process:

• prospect lists;
• names;
• business email addresses;
• business telephone numbers;
• company information;
• job titles;
• departments;
• seniority;
• professional profile information;
• public professional information;
• LinkedIn information;
• campaign lists;
• email communications;
• LinkedIn communications;
• replies;
• campaign status;
• campaign outcomes;
• engagement information;
• appointment information;
• opt-out information;
• suppression data;
• CRM information; and
• related campaign information.

Customer instructs SmartReach to process this information as reasonably necessary to provide the applicable Managed Outbound Services.

7. SmartDesign Processing

SmartDesign may require processing of Personal Data included in:

• websites;
• website forms;
• website copy;
• contact information;
• employee profiles;
• customer testimonials;
• photographs;
• videos;
• domain accounts;
• hosting accounts;
• analytics systems;
• CRM systems;
• integration credentials;
• website databases; and
• materials supplied by Customer.

Customer is responsible for ensuring it has the right to provide Personal Data contained in materials supplied to SmartReach.

8. AI Processing

8.1 AI Features

Customer authorizes SmartReach to use artificial intelligence where reasonably necessary to provide enabled Services.

AI processing may include:

• website chat;
• AI voice;
• customer support;
• lead qualification;
• reply analysis;
• reply classification;
• email drafting;
• message generation;
• conversation summaries;
• call summaries;
• transcription;
• intent detection;
• personalization;
• data analysis;
• research;
• workflow recommendations;
• coding;
• website development;
• automation development; and
• other AI-enabled functionality.

8.2 AI Providers

Where SmartReach uses a commercial AI provider as a Subprocessor, Customer Data may be transmitted to the provider as reasonably necessary to provide the applicable functionality.

SmartReach will use commercial or business AI arrangements for identifiable Customer Data where reasonably appropriate.

8.3 Customer Configuration

Customer is responsible for deciding what Customer Data may be submitted to AI-enabled features and for configuring those features appropriately.

9. Voice, Call Recording, and Messaging

Where Customer enables telephone, AI voice, recording, transcription, SMS, WhatsApp, email, or other communication functionality, Customer instructs SmartReach to process communications necessary to provide those Services.

Customer is responsible for determining whether:

• notice is required;
• consent is required;
• recording is permitted;
• transcription is permitted;
• automated communications are permitted; and
• marketing communications may lawfully be sent.

Customer must comply with applicable consent, recording, telecommunications, privacy, and marketing laws.

10. Website Visitor Identification and Tracking

SmartReach Services may include website analytics, visitor tracking, company identification, person-level B2B identification, lead identification, enrichment, and intent signals.

Where Customer enables these features, Personal Data may include:

• IP address;
• browser information;
• user agent;
• device information;
• cookies and similar identifiers;
• website pages viewed;
• timestamps;
• referring URLs;
• traffic source;
• company information;
• professional information;
• professional profile information;
• business contact information;
• website engagement;
• conversion activity; and
• derived intent signals.

Customer is responsible for providing required privacy and cookie disclosures and obtaining consent where required.

11. Confidentiality

SmartReach will ensure that personnel authorized to process Customer Data:

• are subject to appropriate confidentiality obligations; and
• access Customer Data only where reasonably necessary for their duties.

12. Security

SmartReach will maintain reasonable technical and organizational measures appropriate to the nature and risk of the processing.

Measures may include:

• access controls;
• authentication;
• restricted administrator access;
• encryption in transit;
• encryption at rest where supported by the applicable platform;
• secure cloud infrastructure;
• network security measures;
• logging;
• monitoring;
• backup processes;
• vendor controls;
• confidentiality obligations;
• security policies;
• credential controls;
• incident-response procedures; and
• access restrictions.

Specific controls may vary depending on the applicable Service and underlying infrastructure provider.

13. Subprocessors and Technology Providers

13.1 General Authorization

Customer provides SmartReach with general authorization to engage Subprocessors where reasonably necessary to provide the Services.

SmartReach will require Subprocessors processing Customer Data on SmartReach's behalf to maintain data protection obligations appropriate to the nature of the processing and as required by Applicable Data Protection Law.

13.2 Provider Roles

Not every provider listed by SmartReach necessarily acts as a Subprocessor for every activity.

Depending on how a Service is used, a provider may act as:

• Subprocessor;
• Processor;
• independent Controller;
• data provider;
• enrichment provider;
• integration provider;
• infrastructure provider; or
• another legally recognized role.

This DPA does not change the independent legal status or privacy obligations of a third party.

14. Current Authorized Providers

SmartReach may use the following providers depending on the Services purchased or enabled by Customer.

HighLevel / GoHighLevel

Purpose: SmartConvert platform infrastructure, CRM, websites, funnels, forms, calendars, workflows, automation, email, messaging, telephone functionality, AI functionality, website hosting, lead management, scheduling, analytics, integrations, and related platform services.

HighLevel may use its own authorized subprocessors to provide underlying functionality.

Microsoft Azure / Microsoft

Purpose: Cloud infrastructure, servers, application hosting, databases, storage, networking, backups, security, and related infrastructure services.

Anthropic / Claude / Claude Code

Purpose: Artificial intelligence, analysis, coding, website development, software development, automation development, content processing, and related AI functionality.

Where Customer Data is submitted to Anthropic directly by SmartReach, SmartReach intends to use applicable commercial services and contractual terms appropriate to the processing.

Bright Data

Purpose: Public web research, public web data collection, web search, discovery, datasets, and related research and data services.

Depending on the applicable product, Bright Data may act as a Processor, data provider, or independent Controller.

MoltSets

Purpose: B2B search, professional contact data, enrichment, email verification, telephone verification, and related lead-data services.

RocketReach

Purpose: B2B professional information, business contact data, prospecting, research, and enrichment.

WizLeads

Purpose: B2B prospecting, professional data processing, Sales Navigator-related processing, enrichment, verification, and related lead-generation services.

Prospeo

Purpose: B2B professional data, search, enrichment, email discovery, verification, and related services.

Prospeo may act as a Processor for Customer-provided information submitted for enrichment while acting independently with respect to its own B2B dataset.

LinkedIn / LinkedIn Sales Navigator

Purpose: Professional network research, prospect identification, professional profile information, B2B research, and related business intelligence.

LinkedIn generally operates its services under its own privacy and contractual terms.

HeyReach

Purpose: LinkedIn outreach, LinkedIn account connectivity, campaign management, messaging, campaign analytics, and related outreach functionality.

ManyReach

Purpose: Email outreach, sending infrastructure, campaign management, email campaign analytics, reply processing, and related outreach functionality.

Smartlead

Purpose: Email outreach, mailbox connectivity, email campaign management, sending, campaign analytics, lead processing, reply management, and related outbound functionality.

Instantly

Purpose: Email outreach, mailbox connectivity, campaign management, email sending, lead management, enrichment where enabled, reply handling, analytics, and related sales-engagement functionality.

Reply / Reply.io

Purpose: Sales engagement, email outreach, campaign management, prospect communications, reply processing, automation, sequencing, analytics, and related outbound functionality.

HubSpot

Purpose: CRM, marketing, sales, customer relationship management, forms, contact management, integrations, analytics, communications, automation, enrichment where enabled, and related business functionality.

Depending on the HubSpot features used, HubSpot may act as a Processor or may separately act as a Controller for certain enrichment or tracking activities.

RB2B

Purpose: B2B website visitor identification, company identification, person-level professional identification where available, website intent signals, professional data enrichment, CRM enrichment, and related sales intelligence.

RB2B may act as a service provider or processor for certain Customer-submitted data and may act independently as Controller regarding certain data it provides or licenses.

15. Downstream Subprocessors

Customer acknowledges that certain providers, including HighLevel, Microsoft Azure, HubSpot, communications platforms, AI providers, and other technology providers, may use their own subprocessors.

Customer authorizes such downstream processing where reasonably necessary to provide the applicable Services, subject to applicable contractual and legal requirements.

SmartReach is not required to separately list every downstream provider used solely by an authorized Subprocessor where Applicable Data Protection Law does not require SmartReach to do so.

16. Changes to Providers

SmartReach may add, remove, or replace providers as its Services change.

Where Applicable Data Protection Law requires notice before engaging a new Subprocessor, SmartReach may provide notice through:

• email;
• Customer account notification;
• an updated subprocessor list;
• an updated DPA;
• website notice; or
• another reasonable method.

Where Customer has a legal right to object, Customer may submit a written objection based on reasonable and documented data-protection concerns.

The parties will attempt in good faith to resolve a valid objection.

If a commercially reasonable alternative is unavailable, SmartReach may permit Customer to discontinue the affected Service.

17. International Transfers

Customer acknowledges that SmartReach and its authorized providers may process Customer Data in the United States, Israel, the European Economic Area, and other countries where SmartReach or its providers operate.

Where Applicable Data Protection Law requires additional safeguards for an international transfer, SmartReach will use an appropriate transfer mechanism.

Such mechanisms may include:

• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• adequacy decisions;
• recognized privacy frameworks;
• appropriate contractual safeguards; or
• another legally permitted transfer mechanism.

Authorized Subprocessors are responsible for maintaining required transfer safeguards applicable to their processing.

18. Data Subject Requests

18.1 Assistance

Taking into account the nature of processing, SmartReach will provide reasonable assistance to Customer with requests involving:

• access;
• deletion;
• correction;
• restriction;
• portability;
• objection;
• consent withdrawal;
• sale or sharing opt-out;
• targeted-advertising opt-out; and
• other rights under Applicable Data Protection Law.

18.2 Requests Received by SmartReach

If SmartReach receives a request concerning Customer Data for which Customer is Controller, SmartReach may direct the requester to Customer.

SmartReach will not independently respond to the substance of the request unless:

• instructed by Customer;
• required by law; or
• SmartReach independently acts as Controller for the relevant information.

18.3 Suppression Information

SmartReach may retain limited information following a deletion request where reasonably necessary to:

• honor opt-outs;
• maintain suppression lists;
• prevent renewed outreach;
• comply with legal obligations;
• prevent abuse;
• investigate security incidents; or
• establish, exercise, or defend legal claims.

19. Personal Data Breach

19.1 Notification

SmartReach will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Data where notification is required by Applicable Data Protection Law.

19.2 Information

Where reasonably available, SmartReach will provide information regarding:

• the nature of the incident;
• categories of affected Personal Data;
• categories of affected Data Subjects;
• likely consequences;
• containment or remediation measures; and
• relevant contact information.

Information may be provided in stages as the investigation progresses.

19.3 Cooperation

SmartReach will provide reasonable assistance necessary for Customer to satisfy applicable breach-notification obligations.

19.4 No Admission

Notification of an incident does not constitute an admission of fault, liability, or violation of law.

20. Return and Deletion

20.1 Termination

Upon expiration or termination of applicable Services, SmartReach will delete or return Customer Data as required by:

• Applicable Data Protection Law;
• the Agreement;
• this DPA; and
• Customer's documented instructions.

20.2 Exceptions

SmartReach may retain Customer Data where:

• required by law;
• required for tax, financial, or compliance records;
• reasonably necessary for legal claims;
• required for fraud or abuse prevention;
• required to maintain suppression records;
• contained in routine backups;
• subject to technical deletion cycles; or
• retained by an authorized provider according to applicable contractual retention requirements.

20.3 SmartConvert

Customer is responsible for exporting information it requires before termination of SmartConvert.

Access to Customer Data may end when the applicable account or Subscription terminates.

This may include:

• CRM information;
• contacts;
• messages;
• calls;
• recordings;
• transcripts;
• websites;
• forms;
• workflows;
• appointment records;
• telephone numbers;
• analytics; and
• other SmartConvert information.

20.4 Backups

Customer Data may remain temporarily in secure backup systems until deleted through normal backup rotation.

Information retained solely in backup systems will remain subject to appropriate protections.

21. United States Privacy Requirements

Where SmartReach processes Customer Personal Information as a Service Provider or Contractor under applicable United States privacy law, SmartReach will not:

• sell Customer Personal Information except where expressly permitted by law and Customer;
• share Customer Personal Information for cross-context behavioral advertising except where expressly authorized and legally permitted;
• retain, use, or disclose Customer Personal Information outside the specified business purposes except where permitted by law;
• retain, use, or disclose Customer Personal Information outside the direct business relationship except where permitted by law; or
• combine Customer Personal Information with other information where such combination is prohibited by law.

Nothing in this Section prohibits processing permitted by law for:

• security;
• fraud prevention;
• debugging;
• service delivery;
• service improvement;
• de-identification;
• aggregation;
• legal compliance; or
• other permitted business purposes.

22. Aggregated and De-Identified Data

Nothing in this DPA prevents SmartReach from creating and using aggregated or de-identified information where permitted by Applicable Data Protection Law and the Agreement.

SmartReach may use aggregated or de-identified information for:

• analytics;
• benchmarking;
• product improvement;
• research;
• service improvement;
• security;
• AI evaluation;
• AI development;
• model evaluation;
• statistical analysis; and
• other lawful purposes.

SmartReach will use reasonable measures designed to prevent de-identified information from identifying Customer or an individual.

23. Audits and Compliance

23.1 Information

SmartReach will make available information reasonably necessary to demonstrate compliance with this DPA where required by Applicable Data Protection Law.

23.2 Audits

Where legally required, Customer may request an audit relating to SmartReach's processing of Customer Data.

Audits must:

• be reasonably necessary;
• relate specifically to Customer Data;
• protect SmartReach Confidential Information;
• protect other customers' information;
• avoid unreasonable business disruption;
• comply with reasonable security requirements; and
• occur no more than once annually unless additional auditing is legally required following a material security incident or regulatory request.

23.3 Existing Documentation

Where appropriate, SmartReach may satisfy audit obligations by providing:

• security documentation;
• certifications;
• third-party audit reports;
• provider documentation;
• compliance materials; or
• substantially equivalent evidence.

23.4 Costs

Customer bears its own audit costs.

SmartReach may charge reasonable costs associated with unusually burdensome audit requests where permitted by law.

24. Government and Legal Requests

SmartReach may disclose Customer Data where legally required.

Unless legally prohibited, SmartReach will use reasonable efforts to notify Customer of a binding government or legal demand specifically concerning Customer Data where Customer is the appropriate party to respond.

SmartReach may challenge a request where SmartReach reasonably determines that a challenge is appropriate and legally permitted.

25. Liability

Liability arising under this DPA is subject to the limitations and exclusions of liability contained in the Agreement to the fullest extent permitted by Applicable Data Protection Law.

Nothing in this DPA excludes or limits liability where Applicable Data Protection Law prohibits such exclusion or limitation.

26. Precedence

If there is a conflict between this DPA and the Agreement regarding SmartReach's processing of Customer Personal Data on Customer's behalf, this DPA controls for that processing.

If mandatory Standard Contractual Clauses or another legally required transfer agreement conflicts with this DPA, the mandatory terms control to the extent of the conflict.

27. Term

This DPA remains effective for as long as SmartReach processes Customer Data subject to this DPA.

Obligations that by their nature should survive termination will remain effective following termination.

28. Updates to this DPA

SmartReach may update this DPA where reasonably necessary to:

• comply with changes in law;
• reflect new Services;
• reflect changes in processing;
• add or change providers;
• improve data protection terms;
• update security practices; or
• reflect changes to SmartReach's operations.

Where required by Applicable Data Protection Law, SmartReach will provide notice of material changes.

Schedule A — Details of Processing

Subject Matter

Processing of Customer Personal Data necessary to provide the Services purchased, requested, or enabled by Customer.

Duration

For the duration of the Agreement and any additional period reasonably necessary for:

• deletion;
• return;
• migration;
• backup rotation;
• legal retention;
• suppression;
• security; or
• compliance obligations.

Categories of Data Subjects

Data Subjects may include:

• Customer employees;
• Customer Users;
• Customer customers;
• prospective customers;
• business professionals;
• outreach recipients;
• leads;
• website visitors;
• callers;
• message recipients;
• appointment attendees;
• business contacts; and
• other individuals whose Personal Data Customer instructs SmartReach to process.

Categories of Personal Data

Personal Data may include:

• name;
• company;
• job title;
• department;
• professional role;
• seniority;
• professional email address;
• telephone number;
• company address;
• professional profile;
• CRM records;
• lead information;
• campaign information;
• emails;
• LinkedIn messages;
• SMS messages;
• WhatsApp messages;
• chatbot conversations;
• telephone communications;
• voice recordings;
• transcripts;
• summaries;
• appointment information;
• calendar information;
• website activity;
• IP address;
• browser information;
• device information;
• account information;
• workflow information;
• consent information;
• opt-out information;
• suppression information;
• analytics;
• AI prompts;
• AI outputs; and
• other Customer Data processed through the Services.

Sensitive Information

SmartReach Services are not designed to require sensitive or special-category Personal Data as part of normal B2B use.

Customer should not submit sensitive Personal Data unless such processing is necessary, lawful, appropriate, and covered by the applicable Service.

Schedule B — Technical and Organizational Measures

Depending on the applicable Service, SmartReach's security measures may include:

• controlled access to systems;
• account authentication;
• administrator access restrictions;
• confidentiality requirements;
• secure credential handling;
• encryption in transit;
• encryption at rest where supported;
• Microsoft Azure and other secure infrastructure;
• network security;
• backups;
• monitoring;
• logging;
• incident response procedures;
• software updates;
• vendor management;
• Subprocessor contractual protections;
• data minimization;
• logical access separation;
• role-based access where available;
• system availability measures; and
• recovery procedures.

Security controls may depend in part on the controls provided by the underlying technology platform.

Schedule C — Authorized Provider List

The provider list may change as SmartReach Services develop.

Inclusion in this Schedule does not mean that every provider receives Customer Data for every Customer.

A provider's legal role depends on:

• the Service used;
• the feature enabled;
• the information processed; and
• the provider's applicable contractual and privacy terms.

Contact

Questions concerning this DPA or SmartReach's processing of Personal Data may be sent to:

SmartReach AI LLC

Privacy: privacy@smartreachai.com

Legal: legal@smartreachai.com