Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written agreement between GetLeadsFromAI and the customer (the "Agreement") and applies to the extent GetLeadsFromAI processes Customer Personal Data on the customer's behalf in providing the Service. It is incorporated automatically on acceptance of the Agreement. Customers that require a countersigned copy may request one at legal@getleadsfromai.com.

• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including U.S. state consumer privacy laws (such as the California Consumer Privacy Act as amended, the Florida Digital Bill of Rights where applicable, and similar laws of other states) and, where applicable, the EU and UK General Data Protection Regulation.
• "Customer Personal Data" means personal data or personal information within Customer Data that GetLeadsFromAI processes on the customer's behalf, primarily data collected through the attribution snippet.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.
• Terms such as "controller," "processor," "business," "service provider," "data subject," "consumer" and "processing" have the meanings given in Data Protection Laws.

The customer is the controller (or business) and GetLeadsFromAI is the processor (or service provider) of Customer Personal Data. Where the customer is itself a processor (for example, an agency acting for its clients), GetLeadsFromAI is a subprocessor and the customer warrants that its instructions are authorized by the relevant controller.

GetLeadsFromAI will process Customer Personal Data only on the customer's documented instructions, which consist of the Agreement, this DPA, the customer's configuration of the Service, and other written instructions agreed by the parties, unless required to do otherwise by law, in which case GetLeadsFromAI will inform the customer before processing unless the law prohibits it. GetLeadsFromAI will notify the customer if it believes an instruction violates Data Protection Laws.

The customer is responsible for:

• having a lawful basis for collection and processing, and providing all notices and obtaining all consents required by Data Protection Laws and by wiretapping and communications laws (including the Florida Security of Communications Act, Chapter 934, Florida Statutes) for the collection of data through the snippet on its websites;
• the accuracy of Customer Personal Data and the lawfulness of its instructions;
• not configuring the Service to collect sensitive data, payment card data, protected health information or children's data; and
• honoring opt-out preference signals and consumer requests as required by law.

With respect to Customer Personal Data, GetLeadsFromAI:

• will not sell or share it (including for cross-context behavioral advertising);
• will not retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Service, or outside the direct business relationship with the customer;
• will not combine it with personal information received from other sources, except as permitted by Data Protection Laws (for example, to detect security incidents or prevent fraud);
• will comply with applicable obligations under Data Protection Laws and provide the same level of privacy protection they require;
• will notify the customer if it can no longer meet its obligations, and grants the customer the right to take reasonable steps to stop and remediate unauthorized use; and
• may create and use de-identified or aggregated data only as permitted by Data Protection Laws.

GetLeadsFromAI certifies that it understands and will comply with these restrictions.

GetLeadsFromAI ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access it only as needed to provide the Service.

GetLeadsFromAI implements and maintains appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, costs, and the nature, scope, context and purposes of processing and the risks to individuals, including the measures described in Annex 2. GetLeadsFromAI may update these measures provided it does not materially reduce overall security.

The customer gives general authorization for GetLeadsFromAI to engage subprocessors. The current list is published at getleadsfromai.com/subprocessors. GetLeadsFromAI will impose data protection obligations on each subprocessor that are no less protective than this DPA, and remains liable for its subprocessors' performance.

GetLeadsFromAI will give at least 30 days' notice of new subprocessors by updating the list and, for customers who request it, by email. The customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if it cannot be resolved, the customer may terminate the affected Service and receive a prorated refund of prepaid fees as its sole remedy.

Taking into account the nature of processing, GetLeadsFromAI will provide reasonable assistance, including through the Service's features, to help the customer respond to requests from individuals exercising their rights, and with data protection impact assessments and consultations with regulators where required. If GetLeadsFromAI receives a request directly from an individual relating to Customer Personal Data, it will direct the individual to the customer, or forward the request to the customer where it can identify the customer, and will not respond except as instructed or required by law.

GetLeadsFromAI will notify the customer without undue delay, and where feasible within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate volume of data affected, likely consequences, and measures taken or proposed. GetLeadsFromAI will take reasonable steps to contain and remediate the incident and will cooperate with the customer's reasonable requests, including to support the customer's own notification obligations under laws such as Section 501.171, Florida Statutes. Notification is not an acknowledgment of fault or liability.

The customer may export Customer Personal Data during the subscription and for 30 days after it ends. Thereafter GetLeadsFromAI will delete Customer Personal Data from production systems within 30 days, and it will age out of backups in the normal rotation cycle (approximately 60 days), unless retention is required by law. Retained data remains subject to this DPA.

On written request no more than once per year, GetLeadsFromAI will make available information reasonably necessary to demonstrate compliance with this DPA, such as responses to security questionnaires and summaries of its security practices. If that information is insufficient to meet a requirement of Data Protection Laws, the customer may conduct an audit at its own expense, on at least 30 days' notice, during business hours, through an independent auditor bound by confidentiality, in a manner that does not disrupt GetLeadsFromAI's operations or compromise other customers' data.

GetLeadsFromAI processes data primarily in the United States. If Customer Personal Data subject to the EU or UK GDPR or Swiss law is transferred to GetLeadsFromAI in a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by European Commission Decision 2021/914 (Module Two where the customer is a controller, Module Three where it is a processor), together with the UK International Data Transfer Addendum where applicable, are incorporated by reference, with Annex 1 and Annex 2 of this DPA completing their appendices. The optional docking clause and Clause 7 do not apply; Clause 9 Option 2 (general authorization) applies; Clause 11's optional language does not apply; and for Clauses 17 and 18 the law and courts of Ireland apply.

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, to the extent permitted by Data Protection Laws. If this DPA conflicts with the Agreement regarding processing of Customer Personal Data, this DPA controls; if the Standard Contractual Clauses apply and conflict with this DPA, the Clauses control. Notices under this DPA may be sent by email to legal@getleadsfromai.com.

• Encryption of data in transit using TLS; encrypted off-site backups.
• Logical tenant isolation enforced in the data-access layer, with automated tests for cross-tenant access.
• Role-based access to production systems limited to authorized personnel; mandatory two-factor authentication and IP allow-listing for administrative access; short administrative session lifetimes.
• Append-only audit logging of administrative actions.
• Salted password hashing; rate-limited authentication; optional customer two-factor authentication.
• Secrets kept out of source code and stored in restricted environment configuration; least-privilege credentials for third-party services.
• Tracker ingestion hardened with origin validation, per-key rate limits, payload size caps and no PII collection by default.
• Error monitoring on self-hosted infrastructure configured to exclude personal data by default.
• Daily database backups with defined retention, and documented restore procedures.
• Prompt patching of dependencies and infrastructure; vulnerability reports handled at security@getleadsfromai.com.
• Incident response procedures with customer notification as described in section 10.