Data Processing Agreement

This Data Processing Addendum (“DPA”) supplements the SmartReach AI Terms and Conditions, applicable Order Form, Statement of Work, subscription agreement, or other agreement between SmartReach AI LLC (“SmartReach,” “Company,” “we,” “us,” or “our”) and the customer (“Customer,” “Client,” “you,” or “your”) governing Customer's use of SmartReach Services (“Agreement”).

This DPA applies where SmartReach processes Personal Data on behalf of Customer in connection with the Services.

The Services may include:

• SmartReach AI platform services;
• Managed Outbound and full-service outreach;
• SmartData;
• SmartMail;
• SmartLink;
• SmartAgent;
• SmartSonar;
• SmartDesign;
• SmartConvert;
• CRM services;
• website design and hosting;
• website visitor identification;
• website chat;
• AI communications;
• AI voice;
• telephone services;
• SMS;
• WhatsApp;
• email;
• appointment scheduling;
• workflow automation;
• lead management;
• B2B prospecting;
• data enrichment;
• data verification;
• analytics;
• integrations;
• research; and
• related services.

This DPA forms part of the Agreement.

1. Definitions

1.1 Applicable Data Protection Law

“Applicable Data Protection Law” means privacy, data protection, and data security laws applicable to the processing governed by this DPA, including, where applicable:

• the EU General Data Protection Regulation (“GDPR”);
• the UK GDPR;
• the Swiss Federal Act on Data Protection;
• the California Consumer Privacy Act, as amended (“CCPA”);
• other applicable United States state privacy laws; and
• other applicable privacy and data protection laws.

1.2 Customer Data

“Customer Data” means Personal Data provided by or on behalf of Customer to SmartReach or collected, received, generated, stored, transmitted, or otherwise processed by SmartReach on Customer's behalf through the Services. Customer Data does not include Aggregated Data or De-identified Data, which are not Personal Data.

1.3 Personal Data

“Personal Data,” “Personal Information,” “Controller,” “Processor,” “Business,” “Service Provider,” “Contractor,” “Data Subject,” “Consumer,” “Processing,” “Sell,” “Share,” and similar terms have the meanings assigned under Applicable Data Protection Law.

1.4 Subprocessor

“Subprocessor” means a third party engaged by SmartReach to process Customer Data on behalf of Customer.

1.5 Services

“Services” means the SmartReach products and services covered by the Agreement.

1.6 Aggregated Data

“Aggregated Data” means information that combines data relating to multiple individuals, Clients or campaigns so that no individual, Client or single record can be singled out, and that meets the De-identification Standard.

1.7 De-identified Data

“De-identified Data” means information, including anonymized information, that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual or Client, directly or indirectly, and that meets the De-identification Standard. Information from which only some identifiers have been removed or replaced (pseudonymised information), or that SmartReach or a recipient could reasonably link back to an individual or Client, is not De-identified Data. It remains Customer Data and Personal Data, and SmartReach does not license or disclose it outside SmartReach.

1.8 De-identification Standard

The “De-identification Standard” means that the information (i) is “deidentified” within the meaning of the California Consumer Privacy Act; (ii) is anonymous within the meaning of Recital 26 of the GDPR and UK GDPR, taking into account all means reasonably likely to be used by SmartReach or any recipient; and (iii) meets the three criteria in the European Data Protection Board Guidelines 02/2026 on anonymisation (or any later final version of them): no record relating to a single individual or Client can be isolated; no record can be linked, with certainty or high likelihood, to a record about the same individual or Client in another dataset, including public professional profiles; and no specific and meaningful inference can be drawn about an individual or Client, including about their engagement, interests, preferences or purchasing behaviour. SmartReach applies at least the Anonymisation Measures to meet these criteria. SmartReach also (a) takes reasonable measures to ensure the information cannot be associated with an individual, household or Client; (b) publicly commits to maintain and use the information only in aggregated or de-identified form and not to attempt to re-identify it, except to test whether its de-identification processes are effective; and (c) contractually obligates every recipient to comply with these requirements, not to re-identify or attempt to re-identify the information, and to impose the same obligations on any onward recipient.

1.9 Campaign Data

“Campaign Data” means data generated in the course of Managed Outbound or other campaigns run through the Services for a Client, including campaign settings and targeting criteria, messages and replies, send, delivery and engagement events, reply classifications, and meeting and conversion outcomes. Campaign Data is Client Data to the extent it is supplied by or collected for the Client.

1.10 Effective Date

“Effective Date” means the date on which, for each Client, the version of the Terms dated October 22, 2026, or a later version, first became binding on that Client. References to the “effective date” of the Terms or of the DPA mean the Effective Date.

1.11 Customer Personal Data

“Customer Personal Data” and “Customer Personal Information” mean Customer Data.

1.12 Anonymisation Measures

“Anonymisation Measures” means the minimum measures SmartReach applies to each dataset or statistic that it licenses or discloses outside SmartReach: (1) data from Client campaigns is pooled across Clients, and every group, cell or combination of descriptive fields is drawn from at least 10 records and, where the data comes from Client campaigns, from at least 5 different Clients; (2) descriptive fields such as job title, seniority, department, industry, company size and location, and all dates and times (including time to reply and time to meeting), are shown as bands or categories, not exact values; (3) no text written by a prospect or other recipient is included, including email or LinkedIn replies, chat messages, call recordings and transcripts; (4) no names, email addresses, telephone numbers, postal addresses, profile URLs or other links to a personal or company profile, online or device identifiers, or record keys that could be used to link records across datasets are included; (5) any group that does not meet the minimums in (1), or in which every record has the same outcome so that the outcome of each member could be inferred, is suppressed or further generalised; and (6) before release, SmartReach tests the dataset against the three criteria in the De-identification Standard, records the result, and keeps that record for as long as the dataset is licensed.

2. Roles and Scope

2.1 Customer as Controller

Where SmartReach processes Customer Data on Customer's behalf:

• Customer acts as Controller, Business, or equivalent role; and
• SmartReach acts as Processor, Service Provider, Contractor, or equivalent role.

If Customer itself acts as a Processor for another party, SmartReach may act as Customer's Subprocessor.

This includes every campaign and service that SmartReach runs for Customer, including Managed Outbound email and LinkedIn campaigns, SmartConvert and SmartDesign. SmartReach acts as an independent Controller only as described in Sections 2.2 and 2.3.

2.2 SmartReach as Independent Controller

This DPA does not apply to processing for which SmartReach independently determines the purposes and means.

SmartReach acts as Controller or Business only for:

• administration of SmartReach customer accounts;
• SmartReach billing and financial records;
• fraud prevention and security;
• SmartReach legal and compliance activities;
• SmartReach's own marketing and sales outreach, including its own B2B research and professional or business information that SmartReach sources or licenses independently for that outreach;
• creation, use and licensing of Aggregated Data and De-identified Data under Sections 2.3, 22.4 and 22.5, including from Prior Data; and
• other processing for SmartReach's own business purposes described in the SmartReach Privacy Policy.

2.3 Processing Instructions

SmartReach will process Customer Data only:

• to provide the Services;
• according to Customer's documented instructions;
• according to Customer's Service configuration;
• according to the Agreement and this DPA; or
• where required by applicable law.

Customer's use and configuration of the Services constitutes documented instructions to SmartReach.

Customer instructs and authorizes SmartReach to create Aggregated Data and De-identified Data from Customer Data and Campaign Data, including from Prior Data (as defined in Section 22.5), as permitted under Sections 22.4 and 22.5 of this DPA and Sections 6.4 to 6.6 of the Terms, and this constitutes a documented instruction and authorization of Customer. SmartReach performs that creation, and all later use and licensing of the resulting data, as an independent Controller (and, where United States privacy law applies, as a Business) under Section 2.2 and not on Customer’s behalf, consistent with Section 22.5. For all other processing of Customer Data, SmartReach acts as Processor under Section 2.1.

2.4 Unlawful Instructions

SmartReach may notify Customer if SmartReach reasonably believes a Customer processing instruction violates Applicable Data Protection Law.

SmartReach may refuse or suspend processing that SmartReach reasonably believes would violate applicable law.

3. Customer Responsibilities

Customer is responsible for:

• determining a lawful basis for processing;
• providing required privacy notices;
• obtaining required permissions or consent;
• ensuring Customer has the legal right to provide Customer Data to SmartReach;
• maintaining accurate Customer Data;
• complying with direct-marketing requirements;
• maintaining opt-out and suppression information;
• complying with electronic communications laws;
• complying with SMS and WhatsApp requirements;
• complying with telephone and voice requirements;
• complying with applicable call-recording and transcription laws;
• providing cookie and tracking notices;
• obtaining cookie consent where required;
• responding to Data Subject requests as Controller;
• configuring SmartConvert and other Services appropriately; and
• ensuring Customer's instructions comply with Applicable Data Protection Law.

Customer warrants that it has provided the notices, and has the lawful basis, required for SmartReach to process prospect data on Customer's behalf under Section 2.1. Customer also warrants that it is not aware of any restriction that would prevent SmartReach from creating Aggregated Data and De-identified Data under Section 2.3. SmartReach relies on its own legitimate interests for that creation, as described in Section 9 of the SmartReach Privacy Policy.

4. Nature of the Processing

SmartReach may perform processing including:

• collection;
• recording;
• storage;
• organization;
• structuring;
• retrieval;
• consultation;
• analysis;
• enrichment;
• verification;
• classification;
• transmission;
• communication;
• AI processing;
• transcription;
• summarization;
• personalization;
• matching;
• scoring;
• aggregation;
• de-identification;
• alteration;
• restriction;
• deletion; and
• other processing reasonably necessary to provide the Services.

5. SmartConvert Processing

Customer acknowledges that SmartConvert may process Customer Data including:

• CRM contact records;
• leads;
• customers;
• prospective customers;
• company information;
• pipeline information;
• opportunities;
• notes;
• tags;
• custom fields;
• website visitors;
• website activity;
• form submissions;
• chatbot conversations;
• AI conversations;
• emails;
• SMS communications;
• WhatsApp communications;
• telephone numbers;
• telephone calls;
• AI voice conversations;
• call recordings where enabled;
• call transcripts;
• call summaries;
• appointments;
• calendar information;
• workflow activity;
• automation history;
• consent status;
• opt-out information;
• analytics;
• IP addresses;
• device information;
• AI prompts;
• AI outputs; and
• related metadata.

6. Managed Outbound Processing

Managed Outbound and full-service outreach may require SmartReach to process:

• prospect lists;
• names;
• business email addresses;
• business telephone numbers;
• company information;
• job titles;
• departments;
• seniority;
• professional profile information;
• public professional information;
• LinkedIn information;
• campaign lists;
• email communications;
• LinkedIn communications;
• replies;
• campaign status;
• campaign outcomes;
• engagement information;
• appointment information;
• opt-out information;
• suppression data;
• CRM information; and
• related campaign information.

Customer instructs SmartReach to process this information as reasonably necessary to provide the applicable Managed Outbound Services. SmartReach performs this processing as Customer's Processor under Section 2.1, including for LinkedIn campaigns. Section 22.6 describes the limited LinkedIn information SmartReach uses to create Aggregated Data and De-identified Data.

7. SmartDesign Processing

SmartDesign may require processing of Personal Data included in:

• websites;
• website forms;
• website copy;
• contact information;
• employee profiles;
• customer testimonials;
• photographs;
• videos;
• domain accounts;
• hosting accounts;
• analytics systems;
• CRM systems;
• integration credentials;
• website databases; and
• materials supplied by Customer.

Customer is responsible for ensuring it has the right to provide Personal Data contained in materials supplied to SmartReach.

8. AI Processing

8.1 AI Features

Customer authorizes SmartReach to use artificial intelligence where reasonably necessary to provide enabled Services.

AI processing may include:

• website chat;
• AI voice;
• customer support;
• lead qualification;
• reply analysis;
• reply classification;
• email drafting;
• message generation;
• conversation summaries;
• call summaries;
• transcription;
• intent detection;
• personalization;
• data analysis;
• research;
• workflow recommendations;
• coding;
• website development;
• automation development; and
• other AI-enabled functionality.

8.2 AI Providers

Where SmartReach uses a commercial AI provider as a Subprocessor, Customer Data may be transmitted to the provider as reasonably necessary to provide the applicable functionality.

SmartReach will use commercial or business AI arrangements for identifiable Customer Data where reasonably appropriate.

8.3 Customer Configuration

Customer is responsible for deciding what Customer Data may be submitted to AI-enabled features and for configuring those features appropriately.

9. Voice, Call Recording, and Messaging

Where Customer enables telephone, AI voice, recording, transcription, SMS, WhatsApp, email, or other communication functionality, Customer instructs SmartReach to process communications necessary to provide those Services.

Customer is responsible for determining whether:

• notice is required;
• consent is required;
• recording is permitted;
• transcription is permitted;
• automated communications are permitted; and
• marketing communications may lawfully be sent.

Customer must comply with applicable consent, recording, telecommunications, privacy, and marketing laws.

10. Website Visitor Identification and Tracking

SmartReach Services may include website analytics, visitor tracking, company identification, person-level B2B identification, lead identification, enrichment, and intent signals.

Where Customer enables these features, Personal Data may include:

• IP address;
• browser information;
• user agent;
• device information;
• cookies and similar identifiers;
• website pages viewed;
• timestamps;
• referring URLs;
• traffic source;
• company information;
• professional information;
• professional profile information;
• business contact information;
• website engagement;
• conversion activity; and
• derived intent signals.

Customer is responsible for providing required privacy and cookie disclosures and obtaining consent where required.

11. Confidentiality

SmartReach will ensure that personnel authorized to process Customer Data:

• are subject to appropriate confidentiality obligations; and
• access Customer Data only where reasonably necessary for their duties.

12. Security

SmartReach will maintain reasonable technical and organizational measures appropriate to the nature and risk of the processing.

Measures may include:

• access controls;
• authentication;
• restricted administrator access;
• encryption in transit;
• encryption at rest where supported by the applicable platform;
• secure cloud infrastructure;
• network security measures;
• logging;
• monitoring;
• backup processes;
• vendor controls;
• confidentiality obligations;
• security policies;
• credential controls;
• incident-response procedures; and
• access restrictions.

Specific controls may vary depending on the applicable Service and underlying infrastructure provider.

13. Subprocessors and Technology Providers

13.1 General Authorization

Customer provides SmartReach with general authorization to engage Subprocessors where reasonably necessary to provide the Services.

SmartReach will require Subprocessors processing Customer Data on SmartReach's behalf to maintain data protection obligations appropriate to the nature of the processing and as required by Applicable Data Protection Law.

13.2 Provider Roles

Not every provider listed by SmartReach necessarily acts as a Subprocessor for every activity.

Depending on how a Service is used, a provider may act as:

• Subprocessor;
• Processor;
• independent Controller;
• data provider;
• enrichment provider;
• integration provider;
• infrastructure provider; or
• another legally recognized role.

This DPA does not change the independent legal status or privacy obligations of a third party.

14. Current Authorized Providers

SmartReach may use the following providers depending on the Services purchased or enabled by Customer.

HighLevel / GoHighLevel

Purpose: SmartConvert platform infrastructure, CRM, websites, funnels, forms, calendars, workflows, automation, email, messaging, telephone functionality, AI functionality, website hosting, lead management, scheduling, analytics, integrations, and related platform services.

HighLevel may use its own authorized subprocessors to provide underlying functionality.

Microsoft Azure / Microsoft

Purpose: Cloud infrastructure, servers, application hosting, databases, storage, networking, backups, security, and related infrastructure services.

Anthropic / Claude / Claude Code

Purpose: Artificial intelligence, analysis, coding, website development, software development, automation development, content processing, and related AI functionality.

Where Customer Data is submitted to Anthropic directly by SmartReach, SmartReach intends to use applicable commercial services and contractual terms appropriate to the processing.

Bright Data

Purpose: Public web research, public web data collection, web search, discovery, datasets, and related research and data services.

Depending on the applicable product, Bright Data may act as a Processor, data provider, or independent Controller.

MoltSets

Purpose: B2B search, professional contact data, enrichment, email verification, telephone verification, and related lead-data services.

RocketReach

Purpose: B2B professional information, business contact data, prospecting, research, and enrichment.

WizLeads

Purpose: B2B prospecting, professional data processing, Sales Navigator-related processing, enrichment, verification, and related lead-generation services.

Prospeo

Purpose: B2B professional data, search, enrichment, email discovery, verification, and related services.

Prospeo may act as a Processor for Customer-provided information submitted for enrichment while acting independently with respect to its own B2B dataset.

LinkedIn / LinkedIn Sales Navigator

Purpose: Professional network research, prospect identification, professional profile information, B2B research, and related business intelligence.

LinkedIn generally operates its services under its own privacy and contractual terms.

HeyReach

Purpose: LinkedIn outreach, LinkedIn account connectivity, campaign management, messaging, campaign analytics, and related outreach functionality.

ManyReach

Purpose: Email outreach, sending infrastructure, campaign management, email campaign analytics, reply processing, and related outreach functionality.

Smartlead

Purpose: Email outreach, mailbox connectivity, email campaign management, sending, campaign analytics, lead processing, reply management, and related outbound functionality.

Instantly

Purpose: Email outreach, mailbox connectivity, campaign management, email sending, lead management, enrichment where enabled, reply handling, analytics, and related sales-engagement functionality.

Reply / Reply.io

Purpose: Sales engagement, email outreach, campaign management, prospect communications, reply processing, automation, sequencing, analytics, and related outbound functionality.

HubSpot

Purpose: CRM, marketing, sales, customer relationship management, forms, contact management, integrations, analytics, communications, automation, enrichment where enabled, and related business functionality.

Depending on the HubSpot features used, HubSpot may act as a Processor or may separately act as a Controller for certain enrichment or tracking activities.

RB2B

Purpose: B2B website visitor identification, company identification, person-level professional identification where available, website intent signals, professional data enrichment, CRM enrichment, and related sales intelligence.

RB2B may act as a service provider or processor for certain Customer-submitted data and may act independently as Controller regarding certain data it provides or licenses.

15. Downstream Subprocessors

Customer acknowledges that certain providers, including HighLevel, Microsoft Azure, HubSpot, communications platforms, AI providers, and other technology providers, may use their own subprocessors.

Customer authorizes such downstream processing where reasonably necessary to provide the applicable Services, subject to applicable contractual and legal requirements.

SmartReach is not required to separately list every downstream provider used solely by an authorized Subprocessor where Applicable Data Protection Law does not require SmartReach to do so.

16. Changes to Providers

SmartReach may add, remove, or replace providers as its Services change.

Where Applicable Data Protection Law requires notice before engaging a new Subprocessor, SmartReach may provide notice through:

• email;
• Customer account notification;
• an updated subprocessor list;
• an updated DPA;
• website notice; or
• another reasonable method.

Where Customer has a legal right to object, Customer may submit a written objection based on reasonable and documented data-protection concerns.

The parties will attempt in good faith to resolve a valid objection.

If a commercially reasonable alternative is unavailable, SmartReach may permit Customer to discontinue the affected Service.

17. International Transfers

Customer acknowledges that SmartReach and its authorized providers may process Customer Data in the United States, Israel, the European Economic Area, and other countries where SmartReach or its providers operate.

Where Applicable Data Protection Law requires additional safeguards for an international transfer, SmartReach will use an appropriate transfer mechanism.

Such mechanisms may include:

• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• adequacy decisions;
• recognized privacy frameworks;
• appropriate contractual safeguards; or
• another legally permitted transfer mechanism.

Authorized Subprocessors are responsible for maintaining required transfer safeguards applicable to their processing.

18. Data Subject Requests

18.1 Assistance

Taking into account the nature of processing, SmartReach will provide reasonable assistance to Customer with requests involving:

• access;
• deletion;
• correction;
• restriction;
• portability;
• objection;
• consent withdrawal;
• sale or sharing opt-out;
• targeted-advertising opt-out; and
• other rights under Applicable Data Protection Law.

18.2 Requests Received by SmartReach

If SmartReach receives a request concerning Customer Data for which Customer is Controller, SmartReach may direct the requester to Customer.

SmartReach will not independently respond to the substance of the request unless:

• instructed by Customer;
• required by law; or
• SmartReach independently acts as Controller for the relevant information.

18.3 Suppression Information

SmartReach may retain limited information following a deletion request where reasonably necessary to:

• honor opt-outs;
• maintain suppression lists;
• prevent renewed outreach;
• comply with legal obligations;
• prevent abuse;
• investigate security incidents; or
• establish, exercise, or defend legal claims.

19. Personal Data Breach

19.1 Notification

SmartReach will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Data where notification is required by Applicable Data Protection Law.

19.2 Information

Where reasonably available, SmartReach will provide information regarding:

• the nature of the incident;
• categories of affected Personal Data;
• categories of affected Data Subjects;
• likely consequences;
• containment or remediation measures; and
• relevant contact information.

Information may be provided in stages as the investigation progresses.

19.3 Cooperation

SmartReach will provide reasonable assistance necessary for Customer to satisfy applicable breach-notification obligations.

19.4 No Admission

Notification of an incident does not constitute an admission of fault, liability, or violation of law.

20. Return and Deletion

20.1 Termination

Upon expiration or termination of applicable Services, SmartReach will delete or return Customer Data as required by:

• Applicable Data Protection Law;
• the Agreement;
• this DPA; and
• Customer's documented instructions.

Deletion or return obligations do not extend to Aggregated Data or De-identified Data, which are not Customer Data. SmartReach may complete the creation of Aggregated Data and De-identified Data under Section 2.3 before it deletes or returns Customer Data.

20.2 Exceptions

SmartReach may retain Customer Data where:

• required by law;
• required for tax, financial, or compliance records;
• reasonably necessary for legal claims;
• required for fraud or abuse prevention;
• required to maintain suppression records;
• contained in routine backups;
• subject to technical deletion cycles; or
• retained by an authorized provider according to applicable contractual retention requirements.

20.3 SmartConvert

Customer is responsible for exporting information it requires before termination of SmartConvert.

Access to Customer Data may end when the applicable account or Subscription terminates.

This may include:

• CRM information;
• contacts;
• messages;
• calls;
• recordings;
• transcripts;
• websites;
• forms;
• workflows;
• appointment records;
• telephone numbers;
• analytics; and
• other SmartConvert information.

20.4 Backups

Customer Data may remain temporarily in secure backup systems until deleted through normal backup rotation.

Information retained solely in backup systems will remain subject to appropriate protections.

21. United States Privacy Requirements

Where SmartReach processes Customer Personal Information as a Service Provider or Contractor under applicable United States privacy law, SmartReach will not:

• sell Customer Personal Information except where expressly permitted by law and Customer;
• share Customer Personal Information for cross-context behavioral advertising except where expressly authorized and legally permitted;
• retain, use, or disclose Customer Personal Information outside the specified business purposes except where permitted by law;
• retain, use, or disclose Customer Personal Information outside the direct business relationship except where permitted by law; or
• combine Customer Personal Information with other information where such combination is prohibited by law.

Nothing in this Section prohibits processing permitted by law for:

• security;
• fraud prevention;
• debugging;
• service delivery;
• service improvement;
• de-identification;
• aggregation;
• legal compliance; or
• other permitted business purposes.

Creation of Aggregated Data and De-identified Data under Sections 22.4 and 22.5 is performed by SmartReach as a Business under Section 2.3, in accordance with the De-identification Standard, and the resulting information is not Customer Personal Information.

22. Aggregated and De-Identified Data

22.1 General

Nothing in this DPA prevents SmartReach from creating and using Aggregated Data and De-identified Data where permitted by Applicable Data Protection Law and the Agreement.

22.2 Permitted Uses

SmartReach may use Aggregated Data and De-identified Data for:

• analytics;
• benchmarking;
• product improvement;
• research;
• service improvement;
• security;
• AI evaluation;
• AI development;
• model evaluation;
• statistical analysis;
• dataset creation and licensing under Section 22.4; and
• other lawful purposes.

22.3 Safeguards

SmartReach will apply the De-identification Standard (Section 1.8) and at least the Anonymisation Measures (Section 1.12) to all Aggregated Data and De-identified Data. Before licensing or disclosing any dataset outside SmartReach, SmartReach will test it against the three criteria in Section 1.8 and keep a record of the result for as long as the dataset is licensed.

22.4 Commercial Licensing of Aggregated and De-Identified Data

Subject to Applicable Data Protection Law, the Agreement, and applicable third-party contractual restrictions, SmartReach may independently own, develop, retain, commercialize, license, sublicense, distribute, and otherwise make available Aggregated Data and De-identified Data, including aggregated, anonymized, and de-identified statistical, behavioral, operational, and performance information derived from the operation of its Services.

Such information may include outreach performance metrics, engagement patterns, message characteristics, timing information, response classifications, conversion outcomes, meeting-booking outcomes, meeting-attendance outcomes, campaign effectiveness measures, and related analytical datasets.

SmartReach may make such information available to third parties, including artificial intelligence developers, technology providers, research organizations, and commercial data-licensees, for machine learning, model training, evaluation, benchmarking, research, analytics, and product development.

SmartReach shall not disclose Customer Personal Data, identifiable prospect information, Customer Confidential Information, or information reasonably capable of identifying a Customer or individual. Section 6.5 of the Terms applies to everything SmartReach licenses under this Section.

Commercial licensing under this Section shall be limited to information that has been lawfully derived and appropriately anonymized or aggregated, and shall not override third-party intellectual property rights, confidentiality obligations, or contractual restrictions.

SmartReach may retain intellectual property rights in its independently developed analytical methodologies, statistical models, derived insights, and lawfully created data products, subject to the rights of Customers and third parties under applicable agreements and law.

SmartReach will apply the De-identification Standard (Section 1.8), including suppression of small groups, will maintain and use such data only in aggregated or de-identified form, and will not re-identify or attempt to re-identify it, except to test whether its de-identification processes are effective.

SmartReach will contractually prohibit licensees from re-identifying or attempting to re-identify any Customer or individual, require them to comply with the De-identification Standard, and require them to impose the same obligations on any onward recipient.

22.5 Prior Data

“Prior Data” has the meaning given in Section 6.6 of the Terms. It means Customer Data and Campaign Data processed for Customer before the Effective Date, from the start of Customer's engagement, including campaigns run by SSC International Ltd. (which operated the SSC Digital brand) before June 1, 2026, to the extent SSC International Ltd. has transferred or licensed the relevant rights and data to SmartReach AI LLC.

Customer authorizes SmartReach, acting as an independent Controller (and, where United States privacy law applies, as a Business) for this purpose and not on Customer's behalf, to create Aggregated Data and De-identified Data from Customer Data, including Prior Data. SmartReach may use that data for analytics, for the improvement, training and evaluation of models and AI systems, and for the creation and licensing of datasets, in each case as described in Sections 22.1 to 22.4 of this DPA and Sections 6.4 to 6.7 of the Terms.

Once data meets the De-identification Standard, it is no longer Customer Data or Personal Data and is not subject to this DPA, including Section 20.

SmartReach will not attempt to re-identify Customer or any individual from such data and will contractually prohibit recipients from doing so. This Section does not permit SmartReach to disclose Customer Data, prospect-written text, identifiable prospect information, or information reasonably capable of identifying Customer or an individual, and it is subject to Section 6.5 of the Terms.

To the extent any earlier data processing agreement or addendum between Customer and SSC International Ltd. or SmartReach limited the processing of Prior Data to Customer's documented instructions or to the provision of services, or required its return or deletion, this Section 22.5 is Customer's documented instruction and authorization for the processing described in it.

This Section 22.5 does not apply where a signed agreement or data processing agreement with Customer expressly prohibits the use of Customer Data for the service provider's own purposes, as described in Section 6.6(d) of the Terms. Customer may opt out of this Section 22.5 as described in Section 6.6(e) of the Terms, by emailing privacy@smartreachai.com.

22.6 LinkedIn and Social Platform Campaigns

SmartReach creates Aggregated Data and De-identified Data from LinkedIn and other social-platform campaigns only as described in Section 6.7 of the Terms: from content written by SmartReach, such as message templates and sequences, and from pooled statistics that meet the De-identification Standard. SmartReach does not include LinkedIn member data in Aggregated Data or De-identified Data. That means no member names, profile URLs or profile content, connection lists, or messages written by members.

23. Audits and Compliance

23.1 Information

SmartReach will make available information reasonably necessary to demonstrate compliance with this DPA where required by Applicable Data Protection Law.

23.2 Audits

Where legally required, Customer may request an audit relating to SmartReach's processing of Customer Data.

Audits must:

• be reasonably necessary;
• relate specifically to Customer Data;
• protect SmartReach Confidential Information;
• protect other customers' information;
• avoid unreasonable business disruption;
• comply with reasonable security requirements; and
• occur no more than once annually unless additional auditing is legally required following a material security incident or regulatory request.

23.3 Existing Documentation

Where appropriate, SmartReach may satisfy audit obligations by providing:

• security documentation;
• certifications;
• third-party audit reports;
• provider documentation;
• compliance materials; or
• substantially equivalent evidence.

23.4 Costs

Customer bears its own audit costs.

SmartReach may charge reasonable costs associated with unusually burdensome audit requests where permitted by law.

24. Government and Legal Requests

SmartReach may disclose Customer Data where legally required.

Unless legally prohibited, SmartReach will use reasonable efforts to notify Customer of a binding government or legal demand specifically concerning Customer Data where Customer is the appropriate party to respond.

SmartReach may challenge a request where SmartReach reasonably determines that a challenge is appropriate and legally permitted.

25. Liability

Liability arising under this DPA is subject to the limitations and exclusions of liability contained in the Agreement to the fullest extent permitted by Applicable Data Protection Law.

Nothing in this DPA excludes or limits liability where Applicable Data Protection Law prohibits such exclusion or limitation.

26. Precedence

If there is a conflict between this DPA and the Agreement regarding SmartReach's processing of Customer Personal Data on Customer's behalf, this DPA controls for that processing.

If mandatory Standard Contractual Clauses or another legally required transfer agreement conflicts with this DPA, the mandatory terms control to the extent of the conflict.

Processing under Sections 2.2, 2.3 (creation of Aggregated Data and De-identified Data) and 22.1 to 22.6 is not processing on Customer's behalf, and nothing in this DPA limits Sections 6.4 to 6.7 of the Terms.

27. Term

This DPA remains effective for as long as SmartReach processes Customer Data subject to this DPA.

Obligations that by their nature should survive termination will remain effective following termination.

Sections 22.4 to 22.6 survive termination or expiry of the Agreement and this DPA. Section 22.5 applies to Prior Data processed before the Effective Date.

28. Updates to this DPA

SmartReach may update this DPA where reasonably necessary to:

• comply with changes in law;
• reflect new Services;
• reflect changes in processing;
• add or change providers;
• improve data protection terms;
• update security practices; or
• reflect changes to SmartReach's operations.

Where required by Applicable Data Protection Law, SmartReach will provide notice of material changes.

Schedule A — Details of Processing

Subject Matter

Processing of Customer Personal Data necessary to provide the Services purchased, requested, or enabled by Customer. Creation of aggregated and de-identified data under Sections 22.4 and 22.5, including from Prior Data, is described in those Sections.

Duration

For the duration of the Agreement and any additional period reasonably necessary for:

• deletion;
• return;
• migration;
• backup rotation;
• legal retention;
• suppression;
• security; or
• compliance obligations.

Categories of Data Subjects

Data Subjects may include:

• Customer employees;
• Customer Users;
• Customer customers;
• prospective customers;
• business professionals;
• outreach recipients;
• leads;
• website visitors;
• callers;
• message recipients;
• appointment attendees;
• business contacts; and
• other individuals whose Personal Data Customer instructs SmartReach to process.

Categories of Personal Data

Personal Data may include:

• name;
• company;
• job title;
• department;
• professional role;
• seniority;
• professional email address;
• telephone number;
• company address;
• professional profile;
• CRM records;
• lead information;
• campaign information;
• emails;
• LinkedIn messages;
• SMS messages;
• WhatsApp messages;
• chatbot conversations;
• telephone communications;
• voice recordings;
• transcripts;
• summaries;
• appointment information;
• calendar information;
• website activity;
• IP address;
• browser information;
• device information;
• account information;
• workflow information;
• consent information;
• opt-out information;
• suppression information;
• analytics;
• AI prompts;
• AI outputs; and
• other Customer Data processed through the Services.

Sensitive Information

SmartReach Services are not designed to require sensitive or special-category Personal Data as part of normal B2B use.

Customer should not submit sensitive Personal Data unless such processing is necessary, lawful, appropriate, and covered by the applicable Service.

Schedule B — Technical and Organizational Measures

Depending on the applicable Service, SmartReach's security measures may include:

• controlled access to systems;
• account authentication;
• administrator access restrictions;
• confidentiality requirements;
• secure credential handling;
• encryption in transit;
• encryption at rest where supported;
• Microsoft Azure and other secure infrastructure;
• network security;
• backups;
• monitoring;
• logging;
• incident response procedures;
• software updates;
• vendor management;
• Subprocessor contractual protections;
• data minimization;
• logical access separation;
• role-based access where available;
• system availability measures; and
• recovery procedures.

Security controls may depend in part on the controls provided by the underlying technology platform.

Schedule C — Authorized Provider List

The provider list may change as SmartReach Services develop.

Inclusion in this Schedule does not mean that every provider receives Customer Data for every Customer.

A provider's legal role depends on:

• the Service used;
• the feature enabled;
• the information processed; and
• the provider's applicable contractual and privacy terms.

Contact

Questions concerning this DPA or SmartReach's processing of Personal Data may be sent to:

SmartReach AI LLC

Privacy: privacy@smartreachai.com

Legal: legal@smartreachai.com