Data Processing Addendum

1. Definitions

Applicable Privacy Laws means all privacy and data protection laws applicable to the processing described in this DPA, including GDPR, UK GDPR, CCPA/CPRA, VCDPA, CPA, CTDPA, and any other applicable national, state, or provincial privacy legislation.

Personal Information means any information that identifies, relates to, or could reasonably be linked to an identified or identifiable natural person or household, as defined under Applicable Privacy Laws.

Processing means any operation performed on Personal Information, including collection, use, storage, disclosure, transfer, analysis, deletion, or disposal.

Services means the CRM platform, multichannel inbox, automations, website builder, and all related services provided by InboxStream under your subscription.

Sub-processor means any third party engaged by InboxStream to Process Personal Information on InboxStream’s behalf in connection with the Services.

Controller means you — the party that determines the purposes and means of processing Personal Information.

Processor means InboxStream, which Processes Personal Information on behalf of and on the instructions of the Controller.

2. Roles and Scope

You are the Controller of Personal Information you submit to the Services about your customers, leads, or personnel. InboxStream acts as your Processor (or service provider under CCPA/CPRA) and will Process that Personal Information only: on your documented instructions; to provide, operate, and improve the Services for you; or as required by applicable law. For Personal Information InboxStream collects about its own clients and Site visitors, InboxStream acts as the Controller under its Privacy Policy.

3. Processing Instructions and Restrictions

InboxStream will Process Personal Information only to provide and maintain the Services, comply with applicable legal obligations, or as otherwise agreed in writing. InboxStream will not: sell Personal Information submitted under this DPA; retain, use, or disclose Personal Information outside the direct business relationship with you except as permitted by Applicable Privacy Laws; combine your Personal Information with data from other sources except as necessary to provide the Services or detect security incidents; or use Personal Information for advertising or profiling outside the scope of the Services. If InboxStream receives an instruction it believes violates Applicable Privacy Laws, it will promptly notify you.

4. Controller’s Responsibilities

As the Controller, you represent and warrant that: you have a lawful basis for collecting and transferring Personal Information to InboxStream; you have provided all required notices and obtained all required consents; you will comply with all Applicable Privacy Laws with respect to your instructions; and you are solely responsible for the accuracy, quality, and legality of the Personal Information you submit.

5. Confidentiality and Personnel

InboxStream ensures that all personnel authorized to Process Personal Information under this DPA are subject to appropriate confidentiality obligations, have received data protection training appropriate to their role, and access Personal Information only on a need-to-know basis.

6. Sub-Processors

6.1 Authorized Sub-Processors

You authorize InboxStream to engage the following sub-processors. InboxStream remains responsible for each sub-processor’s compliance with this DPA.

An up-to-date sub-processor list is available by emailing [email protected] with subject “Sub-Processor List.”

6.2 Changes to Sub-Processors

InboxStream will provide at least 30 days’ advance notice of any new sub-processor or material change. If you object on reasonable data protection grounds, you must notify InboxStream in writing within 14 days. If no resolution can be reached, either party may terminate the relevant Services upon reasonable written notice.

7. Security

InboxStream implements and maintains appropriate technical and organizational measures to protect Personal Information against unauthorized access, loss, or alteration. Measures include: HTTPS/TLS encryption in transit; access controls and role-based permissions; logging of access to client account data; contractual security obligations on all sub-processors; incident response and breach notification procedures; and regular review of data handling practices. InboxStream will notify you without undue delay (and within 72 hours where required by GDPR) upon becoming aware of a confirmed personal data breach affecting your Personal Information.

8. Consumer Rights Assistance

InboxStream will assist you, by appropriate technical and organizational measures insofar as possible, to fulfill your obligations to respond to consumer rights requests (access, deletion, correction, portability) under Applicable Privacy Laws. Where a rights request is submitted directly to InboxStream by one of your customers, InboxStream will: promptly inform you of the request; not respond directly unless legally required; and provide reasonable cooperation to enable you to respond within the required timeframe.

9. Data Retention and Deletion

Upon termination of your Subscription or upon your written request, InboxStream will: make Client Content available for export for 30 days following termination; after 30 days, permanently delete or archive Personal Information unless retention is required by law; and provide written confirmation of deletion upon request. InboxStream may retain de-identified or aggregated data that cannot reasonably be re-identified.

10. Data Protection Impact Assessments

Where required by Applicable Privacy Laws (including GDPR Article 35), InboxStream will provide reasonable assistance in conducting a data protection impact assessment (DPIA) in relation to InboxStream’s Processing, taking into account the nature of the Processing and information available to InboxStream.

11. Audits and Compliance Verification

Upon your reasonable written request, InboxStream will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of security practices, completed standard security questionnaires, or third-party audit reports where available. Any on-site audit will be: conducted during normal business hours; subject to at least 30 days’ advance written notice; conducted at your expense; and limited to information directly relevant to InboxStream’s Processing under this DPA.

12. International Data Transfers

Personal Information may be transferred to and processed in Pakistan, the United States, or other countries where InboxStream’s sub-processors operate. Where required, InboxStream will implement appropriate safeguards including Standard Contractual Clauses (SCCs) for transfers from the EEA or UK. You are responsible for ensuring that any transfer of Personal Information to InboxStream from the EEA, UK, or other regions with cross-border transfer restrictions complies with Applicable Privacy Laws.

13. Liability

Liability arising from InboxStream’s Processing under this DPA is subject to the limitations and exclusions in your Terms of Service, except where prohibited by Applicable Privacy Laws. InboxStream’s liability under this DPA is limited to losses arising directly from InboxStream’s breach of its Processor obligations and does not extend to losses arising from your instructions or your failure to comply with Applicable Privacy Laws as Controller.

14. Term and Termination

This DPA takes effect on the date you first accept the Terms of Service and continues for the duration of your Subscription. It automatically terminates upon termination of your Subscription. Sections covering data deletion, confidentiality, and liability limitations survive termination.

15. Order of Precedence

In the event of any conflict between this DPA and the Terms of Service with respect to data processing and privacy, this DPA takes precedence to the extent of that conflict. In all other matters, the Terms of Service govern.