Data Processing Addendum (DPA)

1. SCOPE AND INCORPORATION

This Data Processing Addendum ("Addendum") is incorporated into and forms a functional part of the SalesVault Terms of Service (the "Agreement"). This Addendum applies where SalesVault Processes Customer Personal Data as a Processor on behalf of the Customer (as Controller) to provide the Services. In the event of a conflict between this Addendum and the Agreement, this Addendum shall prevail.

2. DATA PROCESSING TERMS

• 2.1 Instructions: Processor shall Process Personal Data only on the documented instructions of the Controller.
• 2.2 Google Workspace Integrity: Processor's use and transfer of information received from Google APIs will strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• 2.3 AI Processing Isolation: Processing conducted via the Google Gemini API occurs in a siloed, transactional environment. Processor warrants that Customer Personal Data is not utilized by the AI Subprocessor to train foundational Large Language Models (LLMs).

3. SUBPROCESSOR DIRECTORY

• 3.1 Authorization: Controller provides a general written authorization for the engagement of the Subprocessors listed below.
• 3.2 Notification & Objection: Processor shall notify Controller of any intended changes to its Subprocessors via account email at least thirty (30) days prior to engagement. If the Processor cannot accommodate a reasonable objection, the Controller's exclusive remedy is to terminate the Agreement.

SUBPROCESSOR DIRECTORY

4. SECURITY AND AUDIT COMPLIANCE

• 4.1 Technical Measures: Processor shall maintain enterprise-grade technical measures, including AES-256 encryption at rest, TLS 1.2+ or TLS 1.3 in transit, and multi-tenant logical isolation on GCP, and the use of non-persistent session identifiers and cookieless tracking architecture for non-consenting users as described in the Cookie Policy.
• 4.2 Security Assessments: Processor shall make available to Controller information necessary to demonstrate compliance via Summary Security Reports detailing Processor's alignment with SOC 2 principles and GCP security architecture.
• 4.3 Risk Allocation: Processor maintains a comprehensive internal security program designed to mitigate risks associated with the Processing of Personal Data. Processor agrees to maintain financial resources or coverage sufficient to meet its remediation obligations under this Addendum.

5. DATA SUBJECT RIGHTS & CCPA/CPRA

• 5.1 Self-Serve Assistance: Processor's platform provides functional tools to enable Controller to fulfill Data Subject requests (access, deletion, portability) autonomously.
• 5.2 Global Privacy Control (GPC): Processor's platform is engineered to detect and honor GPC signals, automatically opting Users out of non-essential Processing in compliance with US State Privacy Laws.

6. TERMINATION AND DELETION

Upon termination of the Services, Processor shall delete all Customer Personal Data from active production environments within thirty (30) days, except where retention is required by applicable law or defined in the Data Retention and Disposal Schedule of the Privacy Policy (e.g., 7-year statutory tax obligations and 24-month interaction analytics).