Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of, and is incorporated by reference into, the SocialMedia DMs Terms & Conditions (the "Terms") between the Customer ("you," "Controller") and ScaleUp Works LLC, doing business as SocialMedia DMs ("SocialMedia DMs," "we," "us," "Processor"). This DPA applies automatically upon your acceptance of the Terms, without the need for a separate signature, to the extent we process Customer Personal Data on your behalf. Capitalized terms not defined here have the meanings given in the Terms.

1. Definitions

"Applicable Data Protection Laws" means all data protection and privacy laws applicable to the processing of Customer Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the Data Protection Act 2018 ("UK GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other U.S. state privacy laws.

"Customer Personal Data" means personal data described in Annex 1 that we process on your behalf in providing the Services.

"Controller," "Processor," "data subject," "personal data," "processing," and "personal data breach" have the meanings given in the GDPR; equivalent terms under other Applicable Data Protection Laws (including "business," "service provider," "contractor," and "consumer" under the CCPA) apply where relevant.

"Lead Finder Results" means the publicly available social profile information surfaced to you through the Lead Finder feature.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, and, for UK transfers, the UK International Data Transfer Addendum issued by the UK Information Commissioner (the "UK Addendum").

"Sub-processor" means any third party engaged by us to process Customer Personal Data.

2. Roles of the parties and scope

With respect to Customer Personal Data, you act as the Controller (or, under the CCPA, the business) and we act as the Processor (or service provider/contractor), processing Customer Personal Data on your behalf. This DPA governs our processing of Customer Personal Data and does not apply to personal data for which we are an independent controller (such as our own account, billing, and website-visitor data), which is governed by our Privacy Policy.

You are responsible for your own compliance with Applicable Data Protection Laws as Controller, including establishing a lawful basis for your outreach and for the use of Lead Finder Results, and for providing any required notices to, and honoring the rights of, the data subjects you contact or identify (see Section 13).

3. Processing of Customer Personal Data

3.1 Documented instructions. We will process Customer Personal Data only on your documented instructions, including as set out in the Terms, this DPA, and your configuration and use of the Services, unless required to process by law (in which case we will inform you of that legal requirement before processing, unless the law prohibits such notice).

3.2 Scope. The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are described in Annex 1.

3.3 Lawfulness of instructions. We will inform you if, in our opinion, an instruction infringes Applicable Data Protection Laws; we are not, however, responsible for determining whether your instructions or your outreach are lawful, which remain your responsibility as Controller.

3.4 Compliance. We will comply with Applicable Data Protection Laws in our capacity as Processor and will not sell or share Customer Personal Data, nor retain, use, or disclose it for any purpose other than providing the Services or as otherwise permitted by Applicable Data Protection Laws (see Section 14).

4. Confidentiality

We ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and are made aware of the confidential nature of the data. Access is limited to personnel who need it to provide, secure, or support the Services.

5. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to data subjects, we implement appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex 2. You are responsible for assessing whether those measures are appropriate for your use of the Services and the personal data you choose to process, and for configuring the Services and your own systems securely (including protecting your account credentials and your connected-account session).

6. Sub-processing

6.1 General authorization. You provide general authorization for us to engage Sub-processors to process Customer Personal Data. A current list of Sub-processors is set out in Annex 3 and is available to you on request at privacy at socialmediadms.com and at legal.socialmediadms.com/dpa.

6.2 Obligations. We impose data-protection obligations on each Sub-processor by written contract that are no less protective than those in this DPA, and we remain responsible for each Sub-processor's performance of its obligations.

6.3 Changes and objection. We will notify you of any intended addition or replacement of a Sub-processor — by email or by updating the Sub-processor list published at legal.socialmediadms.com/dpa — at least 30 days before that Sub-processor begins processing Customer Personal Data, giving you a reasonable opportunity to object on reasonable data-protection grounds. If you object and we cannot reasonably accommodate the objection, you may discontinue use of the affected feature or terminate as your sole remedy.

7. Assistance with data subject rights

Taking into account the nature of the processing, we will provide reasonable assistance through appropriate technical and organizational measures, insofar as possible, to help you respond to requests from data subjects to exercise their rights under Applicable Data Protection Laws. If a data subject submits such a request directly to us regarding Customer Personal Data, we will, where permitted, refer them to you or promptly notify you so that you can respond, and we will not respond on your behalf except on your instructions or as required by law.

8. Personal data breach

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. We will take reasonable steps to mitigate and remediate the breach. This notification is not an acknowledgment of fault or liability.

9. Data protection impact assessments and prior consultation

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance to help you carry out data protection impact assessments and, where required, prior consultations with supervisory authorities.

10. International data transfers

10.1 We are located in the United States and may process Customer Personal Data in the United States and other countries. Where our processing of Customer Personal Data involves a transfer from the European Economic Area, the United Kingdom, or Switzerland to a country that does not ensure an adequate level of protection, the parties agree that the Standard Contractual Clauses (and, for UK transfers, the UK Addendum) are incorporated into and form part of this DPA and apply to that transfer.

10.2 For the purposes of the SCCs: you are the data exporter and we are the data importer; the Module Two (controller-to-processor) clauses apply; the optional docking clause (Clause 7) applies; the general written authorization for Sub-processors under Clause 9 applies, with the notice period set out in Section 6.3; the audit and information requirements are satisfied as described in Section 12; the governing law of the SCCs and the forum for disputes is the Republic of Ireland, and the competent supervisory authority is the Irish Data Protection Commission. For transfers subject to United Kingdom data protection law, the UK Addendum applies, with the Information Commissioner's Office as the competent authority. Annexes 1, 2, and 3 of this DPA populate the corresponding annexes of the SCCs. In the event of a conflict between the SCCs and this DPA, the SCCs prevail with respect to the relevant transfer.

11. Deletion or return of Customer Personal Data

Upon expiry or termination of the Terms, or earlier on your request, we will delete or return Customer Personal Data as described in the Terms and Privacy Policy. For a limited period following termination, you may request export of your Customer Content; thereafter we may delete Customer Personal Data in the ordinary course, subject to any records we are required to retain by law and to backups that are overwritten in the normal course.

12. Audits and information

We will make available to you information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior written notice and subject to confidentiality, will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, no more than once per year (except where required by a supervisory authority or following a personal data breach) and at your expense. To the extent available, we may satisfy this obligation by providing third-party certifications, reports, or a written response to a reasonable security questionnaire.

13. Customer obligations and warranties

You represent, warrant, and undertake that, in your use of the Services: (a) you have and will maintain a lawful basis and any required consent for your processing of Customer Personal Data, including for your outreach and for your use of Lead Finder Results; (b) you have provided, and will provide, all notices and obtained all rights required for us and our Sub-processors to process Customer Personal Data as contemplated by this DPA; (c) your instructions and your processing comply with Applicable Data Protection Laws; and (d) you will not use the Services to process special-category or other sensitive personal data, or to target, contact, or message individuals you know or should know are minors. You are solely responsible for the legality of the audiences you target and the messages you send.

14. U.S. state privacy laws (service provider / processor terms)

This Section applies to Customer Personal Data subject to the CCPA or other U.S. state privacy laws. With respect to such data, we act as a service provider, processor, or contractor (as applicable). We will:

• not sell or share Customer Personal Data, and not retain, use, or disclose it for any purpose other than the specific business purpose of providing the Services described in the Terms and this DPA, or as otherwise permitted by Applicable Data Protection Laws;
• not retain, use, or disclose Customer Personal Data outside the direct business relationship between you and us;
• not combine Customer Personal Data with personal information received from, or on behalf of, any third party, or collected from our own interactions, except as permitted by Applicable Data Protection Laws;
• comply with the applicable obligations under Applicable Data Protection Laws and provide the same level of privacy protection as required of businesses; and
• notify you if we determine we can no longer meet these obligations, and, upon your reasonable instruction, take steps to stop and remediate any unauthorized use.

We certify that we understand and will comply with the restrictions in this Section. You may take reasonable and appropriate steps to help ensure that we use Customer Personal Data in a manner consistent with your obligations under Applicable Data Protection Laws.

15. Liability

Each party's liability arising out of or related to this DPA is subject to the exclusions and limitations of liability set out in the Terms, and any reference in the Terms to a party's liability means the aggregate liability of that party under the Terms and this DPA together. Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Laws, and, where the SCCs apply, nothing in this Section limits liability as between the parties and data subjects under the SCCs.

16. Term, precedence, and general

16.1 Term. This DPA takes effect when you accept the Terms and continues for as long as we process Customer Personal Data on your behalf.

16.2 Order of precedence. In the event of a conflict regarding the processing of Customer Personal Data, the following order of precedence applies: (i) the SCCs (where applicable); (ii) this DPA; (iii) the Terms; (iv) the Privacy Policy.

16.3 Governing law. Except where Applicable Data Protection Laws or the SCCs require otherwise, this DPA is governed by the laws of the State of Florida, consistent with the Terms.

16.4 Changes. We may update this DPA to reflect changes in Applicable Data Protection Laws, Sub-processors, or our practices, consistent with the "Changes to these Terms" provisions of the Terms; we will not make changes that materially reduce the protections in this DPA without notice as required by law. The current version of this DPA is published at legal.socialmediadms.com/dpa.

16.5 Contact. Privacy and data-protection matters: privacy at socialmediadms.com. Legal notices: legal at socialmediadms.com.

Annex 1 — Description of the Processing and the Parties

Annex 2 — Technical and Organizational Security Measures

The following measures describe the technical and organizational measures we maintain. They may be updated as the Services evolve, provided the level of protection is not materially reduced.

Annex 3 — Sub-processors

Sub-processors are engaged under the general authorization in Section 6. Vendor identities that are not otherwise public are described by function; a current list is available to the Customer on request at privacy at socialmediadms.com and at legal.socialmediadms.com/dpa.

Email addresses on this page are shown in an obfuscated "name at domain" format to reduce automated spam collection. Replace " at " with the @ symbol when contacting us.