Data Processing Agreement

“Controller” means the entity that determines the purposes and means of processing Personal Data.

“Processor” means the entity that processes Personal Data on behalf of the Controller.

“Personal Data” means any information relating to an identified or identifiable natural person contained in Customer Data.

“Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

“Data Protection Laws” means all applicable laws relating to privacy and data protection, including the GDPR, UK GDPR, CCPA/CPRA, and their implementing regulations.

“Sub-processor” means any third party engaged by StickRate to process Personal Data in connection with providing the Service.

Capitalized terms used but not defined in this DPA, including Customer Data, Usage Data, and Connected Applications, have the meanings given in the Agreement.

The parties acknowledge that: (a) Customer is the Controller of Personal Data in Customer Data; (b) StickRate is the Processor acting on Customer’s behalf; and (c) StickRate may engage Sub-processors subject to Section 5 of this DPA.

StickRate will process Personal Data only on documented instructions from Customer (including as set forth in this DPA and the Agreement) and not for any other purpose, except as required by applicable law.

StickRate will: (a) ensure that persons authorized to process Personal Data are subject to confidentiality obligations; (b) inform Customer if, in StickRate’s opinion, an instruction infringes applicable Data Protection Laws; and (c) assist Customer with data protection impact assessments to the extent required by Data Protection Laws.

Customer instructs and authorizes StickRate to create Usage Data from Customer Data, as described in the Agreement. Usage Data will be de-identified or aggregated so that it does not identify Customer, its authorized users, or any Data Subject. StickRate will use Usage Data only as described in the Agreement and in StickRate’s Privacy Policy.

Subject matter: The performance of the Service under the Agreement.

Duration: The term of the Agreement plus any post-termination data retention period specified in the Agreement.

Nature and purpose: The nature of the Processing is the performance of the Service under the Agreement. StickRate will process Personal Data as necessary to perform the Service under the Agreement, as further specified in the Documentation, and as further instructed by Customer in its use of the Service.

Types of Personal Data: Personal Data submitted by Customer may include, but is not limited to: first and last name; title; position; employer; contact information (company, email, phone, business address); professional life data, including business communications; audit log data (user ID, IP address, timestamp); content of materials Customer connects to or uploads into the Service, including email messages, calendar events, CRM notes, messaging, call recordings and transcripts, and documents, and the names, job titles, and contact details of people that appear in them; and information derived from that content, including excerpts, extracted evidence, attachment names and types, and embeddings.

Special categories of data: None. Customer will not submit Sensitive Data, as defined in the Agreement.

Categories of Data Subjects: Customer may submit Personal Data to the Service, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to, Personal Data relating to the following categories of data subjects: prospects, customers, business partners, and vendors of Customer (who are natural persons); employees or contact persons of Customer’s prospects, customers, business partners, and vendors; employees, agents, advisors, and contractors of Customer (who are natural persons); and Customer’s users authorized by Customer to use the Service.

StickRate will implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized access, loss, or disclosure, as described in the Information Security Overview at stickrate.io/legal/security. These measures include, at minimum: encryption at rest and in transit, access controls and least-privilege principles, security monitoring and logging, and regular security assessments.

Customer grants StickRate general authorization to engage the Sub-processors listed at stickrate.io/legal/sub-processors. StickRate will impose data protection obligations on Sub-processors no less protective than those in this DPA.

StickRate will notify Customer of any intended addition or replacement of Sub-processors by updating the Sub-Processor List at stickrate.io/legal/sub-processors at least 30 days in advance. Customers may subscribe to sub-processor change notifications by emailing privacy@stickrate.io.

Customer may object to a new Sub-processor within 14 days of notice; if Customer objects and StickRate cannot accommodate the objection, Customer may terminate the affected subscription without penalty.

StickRate will assist Customer in fulfilling Data Subject rights requests (access, rectification, erasure, restriction, portability, and objection) to the extent technically feasible and as required by Data Protection Laws. Customer is responsible for responding to Data Subject requests; StickRate will promptly forward any requests it receives directly.

StickRate will notify Customer of a confirmed breach of security leading to the unauthorized disclosure of Customer’s Personal Data (“Security Incident”) without undue delay. Notifications will be sent to the security contact designated by Customer. StickRate will provide sufficient information to allow Customer to meet its breach notification obligations under applicable Data Protection Laws.

Where StickRate transfers Personal Data from the EEA, UK, or Switzerland to a country not recognized as providing an adequate level of data protection, StickRate will implement the EU Standard Contractual Clauses (Module 2: Controller to Processor) as the transfer mechanism. For transfers from the UK, StickRate will implement the UK International Data Transfer Addendum to the SCCs. The SCCs and UK Addendum are incorporated into this DPA by reference and are available upon request at privacy@stickrate.io.

StickRate will make available to Customer, upon written request, information reasonably necessary to demonstrate compliance with this DPA. If StickRate maintains a SOC 2 Type II report or equivalent certification, StickRate may satisfy audit requests by providing a copy of the most recent report. Customer may conduct an audit not more than once per year upon 30 days’ notice, subject to confidentiality obligations and at Customer’s expense, and must coordinate with StickRate to minimize disruption to operations. Audit rights under this Section 9 extend only to StickRate and do not extend to StickRate’s Sub-processors.

Upon termination of the Agreement, StickRate will delete Personal Data within a commercially reasonable period, except where retention is required by law. If Customer requests return of Personal Data prior to deletion, StickRate will make reasonable efforts to accommodate such request. StickRate will provide written confirmation of deletion upon request.

To the extent StickRate processes Personal Information (as defined under the CCPA/CPRA) on Customer’s behalf, StickRate acts as a “Service Provider.” StickRate will not: (a) sell or share Personal Information; (b) retain, use, or disclose Personal Information outside the scope of this DPA, except as permitted for service providers under the CCPA/CPRA, including to create Usage Data as described in Section 2; or (c) combine Personal Information received from Customer with Personal Information received from other sources, except as permitted by applicable law.

In the event of a conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA will prevail. Information StickRate receives through Google APIs is also subject to the Google User Data section of StickRate’s Privacy Policy, which controls where it is more restrictive.