Parties and Scope

This Data Processing Agreement (“Agreement”) forms part of the Terms of Service (the “Principal Agreement”) between you (the “Company” or “Controller”) and Revenue Operations, Inc. (the “Processor”), together the “Parties”.

(A) The Company acts as a Data Controller. (B) The Company wishes to use Services provided by the Processor which involve the processing of personal data. (C) The Parties seek to implement a data processing agreement that complies with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable U.S. state privacy laws.

It is agreed as follows.

1. Definitions

"Company Personal Data" means any Personal Data processed by Processor on behalf of Company under the Principal Agreement. "Data Protection Laws" means the GDPR and, to the extent applicable, U.S. state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). "Subprocessor" means any third party appointed by Processor to process Personal Data on behalf of Company. "Google user data" means data obtained from Google APIs through a Google account the Company or its personnel have connected to the Services.

The terms "Controller", "Data Subject", "Personal Data", "Personal Data Breach" and "Processing" have the meanings given in the GDPR.

2. Processing of Company Personal Data

2.1 Processor shall:

• comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and
• not Process Company Personal Data other than on Company's documented instructions, unless required by law.

2.2 Company instructs Processor to process Company Personal Data to provide the go-to-market services described in the Principal Agreement, including connecting Company's email and calendar accounts, building and enriching prospect and account records, scoring and qualifying them, drafting outbound messages for Company's review, and sending messages Company has approved.

2.3 Processor shall not sell or share Company Personal Data, and shall not use it for advertising or marketing purposes.

2.4 Where Processor is required by law to Process Company Personal Data other than on Company's documented instructions, Processor shall inform Company of that requirement before Processing, unless the law prohibits it on important grounds of public interest. Processor shall promptly inform Company if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that instruction until it is confirmed, amended or withdrawn.

3. Company Obligations

3.1 Company warrants that it has, and will maintain throughout the term, a valid legal basis and all necessary notices, consents and authorisations for the Processing it instructs, including in respect of Data Subjects who are not Company personnel. The Services process data about prospects, recipients and meeting attendees who have no direct relationship with Processor, and responsibility for the lawfulness of that Processing rests with Company.

3.2 Company warrants that each mailbox, calendar or other account it connects to the Services is one it is authorised to connect, and that connecting it does not breach any agreement or policy binding on Company or the account holder.

3.3 Company is solely responsible for the accuracy and lawfulness of Company Personal Data and of the instructions it issues, and shall not instruct Processing that would infringe Data Protection Laws.

4. Processor Personnel

Processor shall ensure that persons authorised to process Company Personal Data are subject to confidentiality obligations and that access is limited to those who need it to perform the Services. Human review of Google user data is further restricted by Section 12.

5. Security

5.1 Processor implements technical and organisational measures appropriate to the risk, including:

• encryption of data in transit over modern TLS;
• encryption of integration OAuth access and refresh tokens, and of any model-provider API credentials Company supplies, at rest under AES-256-GCM with authenticated encryption bound to the owning workspace;
• authentication and access controls, with membership in a workspace revalidated on each request so that removing a member ends their access immediately;
• logical separation of each workspace's data, enforced in the application layer on every query;
• cryptographic signature verification on inbound integration webhooks, and signed, expiring state parameters on OAuth authorisation flows;
• length limits on all third-party content admitted into automated processing, and standing instructions in Processor's analysis and drafting pipelines that such content is data and must not be followed as instructions; and
• delivery of changes to shared environments only through reviewed, version-controlled database migrations.

5.2 Processor maintains a written information security programme covering the measures in Section 5.1, reviews it at least annually, and will make available to Company on request a current description of its technical and organisational measures and a completed industry-standard security questionnaire. Where Processor holds an independent certification, attestation or assessment covering the Services, it will make the corresponding report or letter available on request.

6. Subprocessing

6.1 Company authorises Processor to engage Subprocessors. A current list is published at revenueoperations.inc/security.

6.2 Processor shall notify Company of any intended addition or replacement of a Subprocessor at least 30 days before that Subprocessor begins Processing Company Personal Data. Company may object on reasonable data protection grounds within 30 days of notice, in which case the Parties shall work in good faith towards a commercially reasonable alternative. If none can be agreed, Company may terminate the affected Services without penalty and receive a pro-rata refund of prepaid fees.

6.3 Processor shall impose on each Subprocessor, by written contract, data protection obligations no less protective than those in this Agreement, including obligations sufficient to meet Article 28(3) of the GDPR and the restrictions in Sections 12 and 13. Processor remains fully liable to Company for each Subprocessor's performance.

7. Data Subject Rights

7.1 Processor shall promptly notify Company if it receives a request from a Data Subject and shall not respond except as instructed by Company or required by law.

7.2 Processor shall assist Company in responding to Data Subject requests, taking into account the nature of the Processing and the information available to it.

8. Assistance, Assessments and Records

8.1 Taking into account the nature of the Processing and the information available to it, Processor shall provide reasonable assistance to Company with data protection impact assessments and with any prior consultation with a supervisory authority, in each case solely in relation to Processing carried out by Processor. Processor may charge a reasonable fee for assistance beyond information already documented in this Agreement or its published security materials.

8.2 Processor shall maintain written records of the categories of Processing carried out on behalf of Company as required by Article 30(2) of the GDPR, and shall make those records available to Company or a supervisory authority on request.

9. Personal Data Breach

9.1 Processor shall notify Company without undue delay, and in any event within 72 hours of becoming aware, of a Personal Data Breach affecting Company Personal Data.

9.2 The notification shall describe, to the extent then known: the nature of the breach including the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information. Where the information is not all available at once, Processor may provide it in phases without undue further delay.

9.3 Processor shall cooperate with Company and take reasonable steps to assist in the investigation and remediation of each breach.

10. Audit and Information Rights

10.1 Processor shall make available to Company the information reasonably necessary to demonstrate compliance with this Agreement and Article 28 of the GDPR. Processor may satisfy this by providing a description of its technical and organisational measures, a completed industry-standard security questionnaire, and any then-current third-party certification, attestation or assessment report.

10.2 Where that information is insufficient to demonstrate compliance, Company may, no more than once in any twelve-month period and on 30 days' written notice, audit Processor's Processing of Company Personal Data, subject to confidentiality obligations and reasonable restrictions protecting the security and data of other customers. Company bears its own audit costs and shall audit during business hours with minimal disruption. Company may audit more frequently where required by a supervisory authority or following a confirmed Personal Data Breach.

11. International Data Transfers

11.1 Company Personal Data may be transferred to and processed in the United States and in any other jurisdiction where a Subprocessor listed under Section 6.1 operates.

11.2 Standard Contractual Clauses. The Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") are incorporated into this Agreement by reference and apply to transfers of Company Personal Data from the EEA to Processor. Module Two applies where Company is a controller and Processor is a processor; Module Three applies where Company acts as a processor for its own customers. Company is the data exporter and Processor the data importer. The docking clause in Clause 7 applies. Clause 9 option 2 (general written authorisation) applies, with the notice period in Section 6.2. The optional redress clause in Clause 11(a) does not apply. The competent supervisory authority under Clause 13 is that of the EEA Member State in which the data exporter is established. The governing law under Clause 17 is the law of Ireland and the forum under Clause 18(b) is the courts of Ireland. Annex I.A is completed by the Parties' details, Annex I.B by Annex A of this Agreement, Annex II by Section 5, and Annex III by the subprocessor list referenced in Section 6.1.

11.3 United Kingdom. For transfers subject to the UK GDPR, the EU SCCs apply as varied by the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0), incorporated by reference. For the purposes of Table 4, neither Party may end the Addendum as set out in its Section 19. References to the GDPR are read as references to the UK GDPR where the Addendum applies.

11.4 Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the EU SCCs apply with references to the GDPR read as references to the FADP, the competent authority being the Swiss Federal Data Protection and Information Commissioner, and the term "Member State" not being interpreted to prevent Data Subjects in Switzerland from bringing claims in their place of habitual residence.

11.5 Government and law enforcement requests. If Processor receives a legally binding request from a public authority for disclosure of Company Personal Data, Processor shall notify Company promptly unless prohibited by law, shall seek to challenge or narrow the request where it has reasonable grounds to consider it unlawful, and shall disclose only the minimum legally required. Processor shall document each such request and, where notification is prohibited, use reasonable efforts to obtain a waiver.

12. Google API Services User Data

12.1 Limited Use. Processor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace User Data and Developer Policy. Processor uses Google user data solely to provide or improve the user-facing features that are visible and prominent in the Services' interface, and for no other purpose. These restrictions apply to raw data obtained from Google APIs and to all data aggregated, anonymised or derived from it, and they survive termination of this Agreement.

12.2 Prohibited uses. Processor shall not use Google user data to serve advertising of any kind, including retargeted, personalised or interest-based advertising; shall not transfer or sell it to advertising platforms, data brokers or information resellers; and shall not use it to determine credit-worthiness or for lending purposes.

12.3 Processor shall not transfer Google user data except: (a) to provide or improve the user-facing features described in Section 12.1, with the user's consent; (b) for security purposes, including investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition or sale of assets, after obtaining explicit prior consent from the user. All other transfers, uses or sales are prohibited.

12.4 Human review. Processor shall not permit any natural person to read Google user data unless: (a) Processor has obtained and documented the user's affirmative agreement to view the specific messages, files or other data concerned; (b) the data, including derivations, is aggregated and anonymised and used for internal operations in accordance with applicable law; (c) access is necessary for security purposes, such as investigating a bug or abuse; or (d) access is necessary to comply with applicable law. Processor shall maintain a record of each instance of access under (a) and (c), including the person, the justification, the scope accessed and the date.

12.5 Scope minimisation and revocation. Processor requests only the narrowest Google OAuth scopes required for the features it has implemented, and stores Google OAuth access and refresh tokens encrypted at rest as described in Section 5.1. Processor is completing the Cloud Application Security Assessment (CASA) applicable to its use of restricted scopes and will maintain it on the cadence Google requires. Where a user or Company disconnects a Google integration, Processor shall delete the Google user data obtained through that integration in accordance with Section 15.

12.6 Notice to Google. Processor shall promptly notify Google of any known or suspected unauthorised access to the systems, networks or accounts where Google user data is stored, shall cooperate with Google to correct it, and shall notify Google before making any public statement about it. This is in addition to, and does not delay, Processor's obligations to Company under Section 9.

12.7 Outbound messaging. Company instructs Processor to send email on Company's behalf only to recipients from whom Company has obtained any consent required by applicable law, including the CAN-SPAM Act, the ePrivacy Directive as implemented in the relevant Member State, and Canada's Anti-Spam Legislation. Company is the sender of record for every message sent through the Services, controls its content, and shall ensure accurate sender identification and a functioning opt-out mechanism. Processor may suspend outbound sending where it reasonably believes this Section has been breached.

13. Artificial Intelligence and Model Training

13.1 Processor shall not use Company Personal Data or Google user data to develop, train, fine-tune or improve any generalised or non-personalised machine learning or artificial intelligence model, and shall not permit any Subprocessor to do so. Processor may use such data to generate outputs and personalisation solely for Company's own workspace.

13.2 Where Processor transmits Company Personal Data or Google user data to a third-party model provider in order to deliver a user-facing feature, Processor shall use only providers whose terms require them to process the data solely to return outputs to Processor, to refrain from using it to train or improve any model, and to limit retention to what is necessary to deliver the output and any short abuse-monitoring window the provider applies. Processor shall not use free or consumer tiers of any model provider for this Processing.

13.3 Processor may create and use aggregated and de-identified data derived from the Services, provided it does not attempt to re-identify it, does not disclose it in a form identifying Company or any Data Subject, and does not use Google user data in a manner inconsistent with Section 12.

14. United States State Privacy Laws

14.1 CCPA. With respect to Personal Information subject to the CCPA, Company is the Business and Processor is a Service Provider. Processor shall not sell or share Personal Information; shall not retain, use or disclose it for any purpose other than the business purposes specified in this Agreement or as otherwise permitted by the CCPA; shall not retain, use or disclose it outside the direct business relationship between the Parties; and shall not combine it with Personal Information received from other sources except as the CCPA permits. Processor certifies that it understands and will comply with these restrictions, shall notify Company promptly if it determines it can no longer meet them, and grants Company the right to take reasonable steps to stop and remediate unauthorised use.

14.2 Where Company Personal Data is subject to the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or any other U.S. state imposing processor obligations, Processor shall comply with those obligations, including duties of confidentiality, deletion or return of data at Company's direction, making available information necessary to demonstrate compliance, cooperating with reasonable assessments, and engaging subcontractors only under written contracts imposing equivalent obligations.

15. Return and Deletion

15.1 Company may export Company Personal Data at any time during the term. At Company's election, made by written notice before or within 30 days after termination, Processor shall return Company Personal Data in a structured, machine-readable format rather than delete it.

15.2 Disconnecting a Google integration stops synchronisation for that account, revokes the stored credentials, and deletes the mail and contact data imported through it from Processor's database, file storage and search index.

15.3 On termination of the Services, or on Company's written deletion request, Processor shall delete Company Personal Data from its production systems within 30 days, unless retention is required by law. Copies held in routine backups are deleted on the ordinary backup cycle and in any event no later than 90 days thereafter. On request, Processor shall confirm in writing when deletion is complete.

15.4 Content synchronised independently by another member of Company's workspace from that member's own account is retained for that member and is deleted when they disconnect or their data is deleted.

16. General Terms

16.1 This Agreement is entered into by Company's acceptance of the Principal Agreement or by continued use of the Services. Processor may update it to reflect changes in Data Protection Laws, Subprocessors or the Services, provided no update materially reduces the protections afforded to Company Personal Data, and shall give at least 30 days' notice of material changes. A Company requiring a counter-signed copy may request one at the address below.

16.2 In the event of conflict, the following order of precedence applies: (i) the EU SCCs and, where applicable, the UK Addendum; (ii) this Agreement; (iii) the Principal Agreement. Nothing here limits Data Subjects' rights under the EU SCCs.

16.3 Each Party's liability under this Agreement is subject to the exclusions and limitations in the Principal Agreement, and counts towards and is not additional to any cap in it. Nothing limits either Party's liability to Data Subjects or supervisory authorities under Data Protection Laws or the EU SCCs.

16.4 This Agreement is governed by the laws of the State of Delaware, USA, and remains in effect for as long as Processor processes Company Personal Data. Where it conflicts with the Principal Agreement on data protection, this Agreement prevails.

16.5 The Services are not designed for special categories of Personal Data within the meaning of Article 9 of the GDPR, or for data subject to HIPAA, GLBA, FERPA or PCI DSS. Company shall not instruct the Processing of such data. Where it appears incidentally within connected email or calendar content, Processor applies the measures in Section 5 to it.

Annex A — Details of Processing

Subject matter and duration. Provision of the Services under the Principal Agreement, for its duration and any retention period permitted by Section 15.

Nature and purpose. Collection, storage, organisation, retrieval, enrichment, analysis, generation of drafts and recommendations, transmission of Company-approved messages, and deletion.

Categories of Data Subjects. Company's personnel who use the Services and connect accounts to them; the senders, recipients and meeting attendees appearing in those connected accounts; and the prospects and business contacts Company researches or contacts through the Services.

Categories of Personal Data. Names, business email addresses, job titles, employers and professional profile information; email message headers, and message content for correspondents Company has accepted into its workspace; calendar event times and the email addresses of matched external attendees; and records of outbound messages and replies.

Frequency. Continuous for the duration of the Principal Agreement.

Special categories. None intended. Company shall not instruct Processor to process special categories of Personal Data.

Annex B — Technical and Organisational Measures

The measures required by Article 32 of the GDPR and Annex II of the EU SCCs are those set out in Section 5 of this Agreement, as supplemented by the security information published at revenueoperations.inc/security.

Annex C — Subprocessors

The current list of Subprocessors, their purpose and their processing location is published at revenueoperations.inc/security and forms Annex III of the EU SCCs.

Resources