Data Processing Agreement

1. About This Agreement

1.1 This Data Processing Agreement (the "DPA") is entered into between ElevateAI ("ElevateAI", "we", "us" or "our") and the customer that has agreed to the Terms and Conditions ("you"). It forms part of the Terms and Conditions and applies whenever we process Customer Personal Data on your behalf.

1.2 Under the order of precedence in the Terms and Conditions, Section 5.2, this DPA prevails over the Terms and Conditions on the processing of personal data only. On every other subject the Terms and Conditions control.

1.3 This DPA does not cover personal data we process as a controller for our own purposes, such as account administration, billing, marketing to you and the security of our own systems. That processing is described in our Privacy Notice.

2. Definitions

2.1 Terms defined in the Terms and Conditions, Section 2, have the same meaning here. In addition:

• (a) "Data Protection Laws" means all laws on privacy and personal data that apply to the processing under this DPA, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other US state privacy laws;
• (b) "Customer Personal Data" means personal data contained in Customer Data that we process on your behalf in providing the Services;
• (c) "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR, and include the equivalent terms (such as "business" and "service provider") in other Data Protection Laws;
• (d) "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data while it is processed by us or our sub-processors;
• (e) "Sub-processor" means any third party we engage to process Customer Personal Data on your behalf; and
• (f) "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for transfers of personal data to third countries approved by the European Commission in Decision 2021/914, and "UK Transfer Terms" means the International Data Transfer Agreement or the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

3. Roles of the Parties

3.1 For Customer Personal Data, you are the controller (or, where you act for your own clients, a processor acting on the instructions of your client, who is the controller), and we are your processor (or sub-processor).

3.2 You are responsible for having a lawful basis for the processing, for obtaining every notice and consent that Data Protection Laws require (including consent for marketing messages and calls under the Acceptable Use Policy), and for the accuracy and lawfulness of the Customer Personal Data you give us.

3.3 Where the CCPA applies, we act as your service provider. We will not sell or share Customer Personal Data, retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Services, or combine it with personal data we receive from other sources except as the CCPA permits.

4. Details of the Processing

4.1 Subject matter. The provision of the Services described in the Terms and Conditions, including CRM, messaging, calling, email, automation, websites and funnels, booking, reputation management and AI Features.

4.2 Duration. For as long as you use the Services, and afterwards until the Customer Personal Data is deleted under Section 12.

4.3 Nature and purpose. Collecting, recording, organizing, storing, retrieving, transmitting, analyzing, generating content from, backing up and deleting Customer Personal Data, solely to provide, secure, support and maintain the Services for you and as you instruct.

4.4 Categories of data subjects. Your contacts, leads, customers and prospects; your authorized users, employees and agents; and any other individuals whose personal data you choose to submit to the Services.

4.5 Categories of personal data. Identification and contact details (such as names, email addresses, phone numbers and postal addresses); communications content and metadata (such as messages, emails, call recordings and transcripts); appointment, transaction and order details; website, form and funnel interactions; and any other personal data you choose to submit.

4.6 Sensitive data. You must not submit special categories of personal data, health information or other sensitive data to the Services except as the Acceptable Use Policy, Section 4.2, allows.

5. Your Instructions

5.1 We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise; in that case we will tell you before processing unless the law prohibits it.

5.2 Your instructions are the Terms and Conditions, this DPA, your configuration and use of the Services (including the settings, automations, integrations and AI Features you turn on), and any other written instructions you give us that are consistent with them. Additional instructions outside the scope of the Services may require a separate agreement and fees.

5.3 We will tell you if, in our opinion, an instruction breaks Data Protection Laws. We may then suspend the affected processing until the instruction is changed or confirmed.

6. Confidentiality

6.1 We will make sure that everyone we authorize to process Customer Personal Data, including our employees, contractors and virtual assistants, is bound by an appropriate duty of confidentiality and accesses Customer Personal Data only as needed to provide the Services.

7. Security Measures

7.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we maintain appropriate technical and organizational measures to protect Customer Personal Data, including:

• (a) encryption of data in transit and, through our hosting providers, at rest;
• (b) access controls based on least privilege, with individual credentials and multi-factor authentication for administrative access;
• (c) logging and monitoring of access to production systems;
• (d) regular backups and tested recovery procedures;
• (e) vulnerability management and timely security patching;
• (f) security and privacy training for personnel with access to Customer Personal Data;
• (g) vendor due diligence before engaging Sub-processors; and
• (h) an incident response process covering detection, containment, investigation and notification.

7.2 We may update these measures from time to time, provided the overall level of protection is not reduced.

7.3 You are responsible for the security of your own account, including your credentials, user permissions and the configuration choices you make in the Services, as described in the Terms and Conditions, Section 3.3.

8. Sub-processors

8.1 You give us general authorization to engage Sub-processors to process Customer Personal Data. The categories of Sub-processors we currently use are:

• (a) the HighLevel platform, on which the core CRM and automation features of the Services are built;
• (b) telephony and messaging carriers and providers, for example Twilio, for SMS, MMS and voice;
• (c) email delivery providers, for sending and receiving email;
• (d) AI model providers, for example OpenAI, for AI Features;
• (e) payment processors, for example Stripe, for payments you take and fees you pay through the Services; and
• (f) hosting and cloud infrastructure providers, for storage, computing and backups.

8.2 We will impose on each Sub-processor data protection obligations that are no less protective than those in this DPA, and we remain responsible to you for each Sub-processor's performance of those obligations.

8.3 A list of our current Sub-processors is available on request to [email protected]. We will give you notice of any intended addition or replacement of a Sub-processor by email or in-app message at least 14 days before the change takes effect, except where an urgent change is needed to keep the Services running or secure, in which case we will notify you as soon as practicable.

8.4 You may object to a new Sub-processor on reasonable data protection grounds by writing to [email protected] within the notice period. We will then discuss your concern in good faith and, where reasonably possible, offer an alternative. If we cannot resolve the objection, you may cancel the affected Services under the Terms and Conditions, Section 9, as your sole remedy.

9. Assistance With Data-Subject Requests and Compliance

9.1 Taking into account the nature of the processing, we will help you, by appropriate technical and organizational measures and as far as reasonably possible, to respond to requests from data subjects to exercise their rights of access, correction, deletion, restriction, portability and objection. The Services include tools that let you find, export, correct and delete Customer Personal Data yourself.

9.2 If we receive a request directly from a data subject about Customer Personal Data, we will not respond to it ourselves, except to tell the data subject to contact you, and we will pass the request to you without undue delay where we can identify you as the controller.

9.3 We will give you reasonable help, using information available to us, with data protection impact assessments and prior consultations with supervisory authorities that Data Protection Laws require of you in relation to the Services.

9.4 Assistance that goes beyond the tools in the Services or beyond what is reasonable may be charged at our then-current rates, which we will agree with you in advance.

10. Personal Data Breaches

10.1 We will notify you without undue delay after becoming aware of a Personal Data Breach, and in any case within 72 hours of becoming aware of it where Data Protection Laws require you to notify a supervisory authority within that time.

10.2 Our notice will describe, as far as the information is then available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where we cannot give all the information at once, we will give it in phases without further undue delay.

10.3 We will take reasonable steps to contain, investigate and mitigate the breach, and will cooperate with you so that you can meet your own notification obligations. Notifying you of a breach is not an admission of fault or liability.

10.4 We will send breach notices to the email address of your account administrator. You are responsible for keeping it up to date.

11. International Transfers

11.1 We and our Sub-processors may process Customer Personal Data in the United States and in other countries where we or they operate.

11.2 Where Customer Personal Data subject to the GDPR is transferred to a country that has not been found to provide adequate protection, the Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor, as applicable) are incorporated into this DPA by reference, with you as data exporter and us as data importer. For the SCCs: the optional docking clause in Clause 7 applies; Option 2 (general written authorization) applies in Clause 9, with the notice period in Section 8.3; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by the law and courts of Ireland; and Annexes I and II are completed by Sections 4 and 7 of this DPA.

11.3 Where Customer Personal Data subject to the UK GDPR is transferred, the UK Transfer Terms apply, completed with the information in this DPA, and either party may end them only as they allow.

11.4 Where we transfer Customer Personal Data to a Sub-processor in another country, we will make sure an appropriate transfer mechanism is in place, such as the SCCs, the UK Transfer Terms, or the Sub-processor's certification under an applicable data privacy framework.

11.5 If a transfer mechanism we rely on is invalidated or replaced, we will work with you in good faith to adopt a valid alternative.

12. Return and Deletion of Customer Personal Data

12.1 Export before cancellation takes effect. While your account is active you can export Customer Personal Data at any time using the export tools and APIs in the Services. Under the Terms and Conditions, Section 10, it is your responsibility to export what you need before cancellation or termination takes effect; we do not keep a copy for you to retrieve later.

12.2 Deletion schedule. After cancellation or termination of your account takes effect:

• (a) Customer Personal Data in your account, together with the associated services and integrations described in the Terms and Conditions, Section 10.1, is deleted from our live systems and those of our Sub-processors within 30 days;
• (b) copies held in backups are purged within a further 60 days, as backups are rotated, so that all Customer Personal Data is deleted within 90 days after cancellation or termination takes effect; and
• (c) until deletion is complete, any remaining copies stay protected by this DPA and are not actively processed except as needed for deletion or as the law requires.

12.3 Legal retention. We may keep Customer Personal Data for longer only where the law requires us to, or to establish, exercise or defend legal claims. Any data we keep for these reasons remains subject to this DPA and is deleted once the reason ends.

12.4 Deletion is permanent and cannot be undone. On written request to [email protected] made within 60 days after deletion, we will confirm in writing that deletion has taken place.

13. Audits and Information

13.1 We will make available to you the information reasonably necessary to demonstrate our compliance with this DPA and with Article 28 of the GDPR.

13.2 You may audit our compliance with this DPA no more than once in any 12-month period, unless a supervisory authority requires it or a Personal Data Breach makes it necessary. You must first send us a written questionnaire, which we will answer within a reasonable time, and provide any relevant third-party certifications or audit reports we hold.

13.3 If our answers do not reasonably satisfy your audit obligations under Data Protection Laws, you may request an on-site or remote audit, on at least 30 days' written notice, during normal business hours, without unreasonable disruption to our operations, and subject to appropriate confidentiality obligations. Audits are at your expense, and we may charge for our reasonable time. Any auditor must be independent and must not be our competitor.

13.4 Audits of our Sub-processors are carried out by relying on the reports, certifications and information those Sub-processors make available.

14. Liability

14.1 Each party's liability under or in connection with this DPA, including the Standard Contractual Clauses and the UK Transfer Terms to the extent the law allows, is subject to the single liability cap and exclusions in the Terms and Conditions, Section 23. This DPA does not create a separate or additional cap.

14.2 Nothing in this DPA limits a party's liability to data subjects where Data Protection Laws or the Standard Contractual Clauses do not allow it to be limited.

15. Term and Survival

15.1 This DPA applies for as long as we process Customer Personal Data on your behalf, and its obligations survive termination of the Terms and Conditions until all Customer Personal Data has been deleted under Section 12.

16. Governing Law and Disputes

16.1 This DPA is governed by the same law, and disputes under it are resolved in the same way, as set out in the Terms and Conditions, Sections 25 and 26, except where the Standard Contractual Clauses or the UK Transfer Terms require a different governing law or forum for matters within their scope.

17. Changes to This Agreement

17.1 We may update this DPA from time to time, for example to reflect changes in Data Protection Laws, our Sub-processors or the Services, by posting the new version on this page with a new date at the top. We will give reasonable advance notice of material changes as described in the Terms and Conditions, Section 20, and no change will reduce the overall protection given to Customer Personal Data.

18. Prior Versions

18.1 This version takes effect on the date at the top of this page and replaces all earlier versions.

19. Contact

Questions about this DPA, Sub-processors or data-subject requests: [email protected]. Legal notices: [email protected]. ElevateAI, 8 The Green, Ste R, Dover, Delaware 19901, United States. Phone: +1 212 287 9171.