Data Processing Agreement

1. Overview

This DPA reflects the parties' agreement on the processing of Customer Personal Data in accordance with the requirements of applicable Data Protection Laws. It is entered into pursuant to Article 28 of the GDPR.

In the event of any conflict or inconsistency between this DPA and any other terms of the Agreement, this DPA shall prevail with regard to the parties' data protection obligations.

2. Definitions

The following terms have the meanings set out below. Capitalized terms not otherwise defined have the meaning given to them in the Agreement or applicable Data Protection Law:

• "Customer Personal Data" means any Personal Data processed by SUBLAKE on behalf of Customer in connection with the Services.
• "Data Protection Laws" means the EU GDPR (Regulation 2016/679), the UK GDPR, the Swiss FADP, and applicable national implementing laws.
• "Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Personal Data Breach" have the meanings given in the GDPR.
• "Sub-Processor" means any third-party processor engaged by SUBLAKE to process Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the European Commission's 2021 SCCs and the UK Addendum where applicable.

3. Roles of the Parties

For the purposes of this DPA, in respect of Customer Personal Data:

• Customer is the Controller.
• SUBLAKE is the Processor acting on Customer's documented instructions.

Each party shall comply with its respective obligations under Data Protection Laws. The Agreement, the Services Customer enables, and Customer's configurations constitute Customer's complete documented instructions to SUBLAKE for the Processing of Customer Personal Data.

4. Processing of Customer Personal Data

Subject matter & duration: Provision of the SUBLAKE Services for the term of the Agreement.

Nature & purpose: SUBLAKE processes Customer Personal Data to provide the Services as described in the Agreement, including AI-assisted contact extraction, deal detection, message routing, automated replies, analytics, and integration with Customer-authorized third-party channels (Gmail, Outlook, Calendar, Stripe, social platforms, etc.).

Categories of Data Subjects: Customer's end users, contacts, leads, prospects, customers, employees, and any individuals whose data Customer chooses to import or who appear in messages routed through the Services.

Categories of Personal Data: Identity data (name, title), contact data (email, phone, address), professional data (employer, role), communication content (emails, messages, notes), behavioural data (engagement metrics), and any other Personal Data Customer chooses to submit.

5. Security Measures

SUBLAKE shall implement and maintain appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including:

• Encryption of Customer Personal Data in transit (TLS 1.2+) and at rest (AES-256)
• Tenant isolation enforced at the database layer via row-level security (RLS)
• Role-based access control with least-privilege principles for SUBLAKE personnel
• Mandatory MFA on all SUBLAKE administrative accounts
• Comprehensive audit logging of authentication and data-access events
• Regular security testing including dependency scanning and code review
• Documented incident response and business continuity processes
• Background screening and confidentiality obligations for personnel with access to Customer Personal Data

6. Sub-Processors

Customer authorises SUBLAKE to engage Sub-Processors to process Customer Personal Data. SUBLAKE's current Sub-Processors are:

SUBLAKE shall enter into a written agreement with each Sub-Processor imposing data protection obligations no less protective than those set out in this DPA.

SUBLAKE will provide notice of any intended additions or replacements of Sub-Processors at least 30 days in advance via email to the Customer's designated billing contact and via the SUBLAKE website. Customer may object on reasonable grounds during the notice period.

7. International Transfers

Where Customer Personal Data of EU, UK, or Swiss data subjects is transferred outside the EEA, UK, or Switzerland to a country not deemed adequate by the European Commission (or equivalent authority), the parties agree that the transfer is governed by the European Commission's 2021 Standard Contractual Clauses (Module Two: Controller-to-Processor), as supplemented by the UK Addendum and the Swiss FADP equivalent terms, which are incorporated by reference into this DPA.

SUBLAKE will implement supplementary measures (encryption, access controls, transparency reporting) consistent with EDPB Recommendations 01/2020 to ensure essentially equivalent protection.

8. Data Subject Requests

SUBLAKE provides Customer with self-service tooling within the Services to access, export, correct, restrict, or delete Customer Personal Data. Where required by applicable law and not feasible through self-service, SUBLAKE shall, taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests from Data Subjects.

If SUBLAKE receives a request directly from a Data Subject relating to Customer Personal Data, SUBLAKE will redirect the Data Subject to Customer without responding to the substance of the request, unless authorised by Customer or required by law.

9. Personal Data Breach Notification

SUBLAKE shall notify Customer without undue delay, and in any event no later than 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent known:

• The nature of the breach and categories and approximate number of Data Subjects affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach
• A point of contact at SUBLAKE for further information

10. Audits

SUBLAKE shall make available to Customer, on reasonable request, information necessary to demonstrate compliance with this DPA, including:

• Sub-Processor list and update notifications
• Documentation of technical and organisational measures
• Summary results of independent third-party audits where available

On-site audits will be considered on a case-by-case basis for Enterprise customers and may be subject to reasonable confidentiality and scheduling requirements.

11. Return & Deletion of Data

On termination of the Agreement, SUBLAKE will, at Customer's choice, delete or return all Customer Personal Data within 30 days, unless storage is required by applicable law. Customer can also self-serve export or deletion at any time during the term via the Services. Backups will be deleted in accordance with the rolling retention schedule, not exceeding 90 days.

12. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability section of the Agreement. Nothing in this DPA limits liability where it cannot be limited under applicable law.

13. Duration & Termination

This DPA is effective from the date Customer accepts the Agreement and continues until SUBLAKE ceases processing Customer Personal Data. Termination of the Agreement terminates this DPA, subject to surviving obligations regarding return/deletion, confidentiality, audits, and liability.

14. Contact

For data protection inquiries or to request a counter-signed copy of this DPA: