Data Processing Addendum

1. Scope

The DPA covers personal information that you submit, collect or generate in the CRM, funnels, websites, communications, marketing automations, integrations, analysis, support and AI features you order, to the extent LeadsBlender acts as your processor or service provider. Customer Data includes custom fields, messages, attachments, prompts, outputs and logs that contain personal information.

You decide the purposes, sources, notices, lawful grounds, permissions, retention and marketing configuration for your Customer Data. LeadsBlender remains responsible for the data it controls itself, such as sales, account, invoice and security administration records. Those are covered by our Privacy Policy.

2. Processing only on your instructions

We process Customer Data only on your documented instructions to deliver and support the services you ordered, unless the law requires otherwise. A generic reference to service improvement does not authorize us to use your Customer Data for our own marketing, unrelated products or general model training.

We tell you promptly if we believe an instruction breaks privacy law, and we may pause that instruction while we resolve it together.

Where US service provider rules apply, we do not sell or share Customer Data for cross context behavioral advertising, use it for an unrelated commercial purpose, or combine it with other data except as the law and our agreement allow.

For outreach, you control the contact list, audience, sender, consent evidence, suppression and message approval. Signing the DPA alone does not activate any bulk send, campaign, published funnel or consequential AI action.

3. Confidentiality and security

Access is limited to personnel who need it to perform the services and who are bound by confidentiality. We implement risk appropriate technical and organizational measures, described in a schedule to the DPA. You secure your own devices, users, source data, chosen integrations and sending permissions, as allocated in that schedule.

4. Subprocessors and third party services

We only engage a subprocessor for Customer Data once it is authorized in the DPA schedule or through the agreed change process, which includes prior notice and the right to object on reasonable privacy grounds. Each subprocessor is bound by data protection terms appropriate to its processing, and we remain responsible for its performance as the law requires.

A CRM, messaging, payment, advertising, AI or analytics service that you choose and contract directly is not automatically our subprocessor.

5. Individual requests, assistance and audits

If we receive a rights request about your Customer Data, we notify you where permitted and do not respond substantively without your authorization unless the law requires it. We reasonably assist you with requests, security, breach assessment and notification, impact assessments and regulator consultation.

We make available the information needed to demonstrate compliance and allow reasonable audits as the law requires, with appropriate confidentiality and security.

6. Incidents and legally compelled disclosure

We notify you without undue delay after becoming aware of a personal data breach affecting your Customer Data, share the information available at that time and update you as the facts develop.

If we are legally required to disclose Customer Data, we notify you first where the law allows and limit the disclosure to what is required.

7. International transfers

Cross border transfers only happen on your instructions and in line with applicable privacy law. Where EU or UK transfer rules apply, the parties put the required instrument in place, such as the EU Standard Contractual Clauses or the UK transfer addendum. If a transfer mechanism fails, the affected transfer is suspended until a lawful alternative is agreed.

8. Return and deletion

When the services end, you choose whether your Customer Data is returned or deleted, unless the law requires us to keep it. We provide an agreed export method and carry out deletion under a written plan that covers CRM contacts, conversations, forms, custom fields, media, AI prompts and outputs, integrations and user access.

9. Order of precedence

For data protection matters, mandatory law and any executed transfer clauses come first, then the DPA and its schedules, then the order, then our general terms.

10. How to get the DPA

Business customers can request the DPA with its schedules by email. We complete the schedules for your setup and both parties sign it.