Data Processing Agreement

1. Overview

This DPA reflects the parties' agreement on the processing of Customer Personal Data in accordance with the requirements of applicable Data Protection Laws. It is entered into pursuant to Article 28 of the GDPR.

In the event of any conflict or inconsistency between this DPA and any other terms of the Agreement, this DPA shall prevail with regard to the parties' data protection obligations.

2. Definitions

The following terms have the meanings set out below. Capitalized terms not otherwise defined have the meaning given to them in the Agreement or applicable Data Protection Law:

• "Customer Personal Data" means any Personal Data processed by SUBLAKE on behalf of Customer in connection with the Services.
• "Data Protection Laws" means the EU GDPR (Regulation 2016/679), the UK GDPR, the Swiss FADP, and applicable national implementing laws.
• "Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Personal Data Breach" have the meanings given in the GDPR.
• "Sub-Processor" means any third-party processor engaged by SUBLAKE to process Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the European Commission's 2021 SCCs and the UK Addendum where applicable.

3. Roles of the Parties

For the purposes of this DPA, in respect of Customer Personal Data:

• Customer is the Controller.
• SUBLAKE is the Processor acting on Customer's documented instructions.

Each party shall comply with its respective obligations under Data Protection Laws. The Agreement, the Services Customer enables, and Customer's configurations constitute Customer's complete documented instructions to SUBLAKE for the Processing of Customer Personal Data.

4. Processing of Customer Personal Data

Subject matter & duration: Provision of the SUBLAKE Services for the term of the Agreement.

Nature & purpose: SUBLAKE processes Customer Personal Data to provide the Services as described in the Agreement, including message handling, appointment booking, and maintaining a unified contact record across the channels and integrations Customer chooses to connect.

Categories of Data Subjects: Customer's end users, contacts, leads, prospects, customers, employees, and any individuals whose data Customer chooses to import or who appear in messages routed through the Services.

Categories of Personal Data: Identity data (name, title), contact data (email, phone, address), professional data (employer, role), communication content (emails, messages, notes), behavioural data (engagement metrics), and any other Personal Data Customer chooses to submit.

5. Security Measures

SUBLAKE shall implement and maintain appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including:

• Encryption of Customer Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256)
• Tenant isolation so each customer's data is logically separated from others
• Least-privilege access controls for the systems that hold Customer Personal Data
• Confidentiality obligations for personnel with access to Customer Personal Data
• Engagement of reputable sub-processors under data-protection terms
• A documented incident-response process, including 72-hour breach notification
• Automated backups to support recovery

6. Sub-Processors

Customer authorises SUBLAKE to engage Sub-Processors to process Customer Personal Data. SUBLAKE's current Sub-Processors are set out below. Sub-Processors marked "only when you connect it" receive Customer Personal Data only where Customer connects the relevant channel or integration:

The authoritative, current sub-processor list is maintained at /subprocessors.

SUBLAKE shall enter into a written agreement with each Sub-Processor imposing data protection obligations no less protective than those set out in this DPA.

SUBLAKE will provide notice of any intended additions or replacements of Sub-Processors at least 30 days in advance via email to the Customer's designated billing contact and via the SUBLAKE website. Customer may object on reasonable grounds during the notice period.

7. International Transfers

Where Customer Personal Data of EU, UK, or Swiss data subjects is transferred outside the EEA, UK, or Switzerland to a country not deemed adequate by the European Commission (or equivalent authority), the parties agree that the transfer is governed by the European Commission's 2021 Standard Contractual Clauses (Module Two: Controller-to-Processor), as supplemented by the UK Addendum and the Swiss FADP equivalent terms, which are incorporated by reference into this DPA.

For the purposes of the SCCs, the Annexes (identifying the parties, the details of the processing, and the technical and organisational measures) are constituted by the processing details in Section 4, the security measures in Section 5, and the sub-processor list in Section 6 of this DPA.

SUBLAKE will implement supplementary measures (such as encryption and access controls) consistent with EDPB Recommendations 01/2020 to support essentially equivalent protection.

8. Data Subject Requests

SUBLAKE provides Customer with self-service tooling within the Services to access, export, correct, restrict, or delete Customer Personal Data. Where required by applicable law and not feasible through self-service, SUBLAKE shall, taking into account the nature of the processing, assist Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling Customer's obligation to respond to requests from Data Subjects.

If SUBLAKE receives a request directly from a Data Subject relating to Customer Personal Data, SUBLAKE will redirect the Data Subject to Customer without responding to the substance of the request, unless authorised by Customer or required by law.

9. Personal Data Breach Notification

SUBLAKE shall notify Customer without undue delay, and in any event no later than 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent known:

• The nature of the breach and categories and approximate number of Data Subjects affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach
• A point of contact at SUBLAKE for further information

10. Audits

SUBLAKE shall make available to Customer, on reasonable request, information necessary to demonstrate compliance with this DPA, including:

• The sub-processor list and update notifications
• Documentation of the technical and organisational measures described in this DPA

On-site audits will be considered on a case-by-case basis for larger, negotiated customers and may be subject to reasonable confidentiality and scheduling requirements.

11. Return & Deletion of Data

On termination of the Agreement, SUBLAKE will, at Customer's choice, delete or return all Customer Personal Data within 30 days, unless storage is required by applicable law. Customer can also self-serve export or deletion at any time during the term via the Services. Backups will be deleted in accordance with the rolling retention schedule, not exceeding 90 days.

12. California (CCPA)

To the extent SUBLAKE processes personal information subject to the California Consumer Privacy Act, as amended ("CCPA"), on behalf of Customer, SUBLAKE acts as a "service provider" (and Customer as a "business"). SUBLAKE processes such personal information only to provide the Services under the Agreement, and does not sell or share it. SUBLAKE will not retain, use, or disclose the personal information for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties, except as permitted by the CCPA.

13. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability section of the Agreement. Nothing in this DPA limits liability where it cannot be limited under applicable law.

14. Governing Law

This DPA is governed by the laws of the State of Delaware, United States, without regard to its conflict-of-laws rules, except that the SCCs are governed by the law they specify. Nothing in this DPA overrides the mandatory rights and protections afforded to Data Subjects under applicable Data Protection Laws.

15. Duration & Termination

This DPA is effective from the date Customer accepts the Agreement and continues until SUBLAKE ceases processing Customer Personal Data. Termination of the Agreement terminates this DPA, subject to surviving obligations regarding return/deletion, confidentiality, audits, and liability.

16. Contact

For data protection inquiries or to request a counter-signed copy of this DPA: