Data Processing Addendum (DPA)

1. Parties and acceptance

The Customer accepts this DPA in the app when creating a business or agency account. The app stores the accepted version, the date and the user who accepted it on the Customer's behalf. Whoever accepts represents that they are authorized to bind the Customer.

When we publish a new major version of this DPA (for example, from 1.x to 2.0), the app will ask for acceptance again before the features that process data on the Customer's behalf can keep being used. Minor versions (corrections and clarifications that do not reduce protection) are published in the version log without new acceptance.

SalesMarketing contact details for this DPA: {RAZON_SOCIAL}, {DIRECCION}, tax ID {NIF_O_EIN}, email {CORREO_LEGAL}.

2. Definitions

• Customer Data: personal data that the Customer, its users or its integrations enter into the platform, or that the platform collects on the Customer's instructions, about people who are not SalesMarketing users.
• Controller: whoever decides why and how data is processed. Equivalent to "business" (CCPA), "controlador" (LGPD) or "responsable" (Latin American laws).
• Processor: whoever processes data on behalf of the controller. Equivalent to "service provider" (CCPA), "operador" (LGPD) or "encargado" (Latin American laws).
• Subprocessor: a third party SalesMarketing engages to carry out part of the processing of Customer Data.
• Breach: a security incident leading to the unauthorized destruction, loss, alteration, disclosure of or access to Customer Data.
• Applicable Law: the data protection laws that apply to the processing, including those of the United States (federal and state), Brazil, Mexico, Colombia, Argentina, Chile and the other Latin American countries where the Customer operates.

3. Roles of each party

• For Customer Data, the Customer is the controller and SalesMarketing is the processor. The Customer decides whom to contact, what to import, what to connect and what to automate.
• For our own users' data (business owners, team members and agencies: account, access, billing and use of the dashboard), SalesMarketing is the controller. That processing is governed by the Privacy Policy, not by this DPA.
• Agencies. When an agency manages its clients' businesses, the agency acts as controller or as processor for its own client under its contract with that client, and SalesMarketing is the agency's processor or subprocessor. The agency undertakes to pass on to its client obligations equivalent to those in this DPA.
• Markets. The platform is offered only to businesses and professionals established in the United States and Latin America, except Peru. It is not offered to anyone established in the European Union, the European Economic Area, the United Kingdom or Peru, and it is not directed at people in those territories. The annexes in section 15 exist only in case a Customer nonetheless processes data of residents of those regions.

4. Subject matter, duration, nature and purpose

• Subject matter: providing the service described in the Terms: campaigns and ads, creatives, organic publishing, omnichannel CRM, email, WhatsApp, telephony with voice agents, recorded meetings, SEO, market radar, automations and reports.
• Duration: for as long as the Customer has an account, plus the deletion periods in section 13.
• Nature: hosting, organizing, retrieval, analysis, sending, recording, transcription, AI content generation and deletion.
• Purpose: solely to provide the service to the Customer, keep it secure and comply with the law. SalesMarketing does not use Customer Data for its own purposes, does not sell it or share it for cross-context behavioral advertising, and does not use it to train models.

5. Documented instructions

SalesMarketing processes Customer Data only on the Customer's documented instructions. Instructions include: the Terms and this DPA, the account settings, the connections, flows, automations and agents the Customer creates or turns on, and the actions its users approve in the app.

AI agents that act on their own and automatic flows run because the Customer created or turned them on; turning them on is an instruction from the Customer. If SalesMarketing believes an instruction infringes Applicable Law, it will inform the Customer and may decline to carry it out. If the law requires SalesMarketing to process data otherwise, it will inform the Customer beforehand unless the law prohibits it.

6. Customer obligations

• Have a valid legal basis for each processing activity and each contact, and give people the privacy notices their law requires.
• Obtain and keep the consents each channel and region requires (calls with an artificial voice, WhatsApp, commercial email, recording, people's voice and likeness), and not enter data it has no right to process.
• Honor unsubscribes, objections and do-not-contact lists, and answer people's requests within the deadlines of their law.
• Not use the platform for decisions with legal or similarly significant effects on people (credit, employment, housing, insurance, health or education), nor to target minors.

7. Categories of data subjects and data

Sensitive data. A cloned voice and an avatar or digital twin may be biometric data. They are created only with the consent of the person concerned, kept until revoked or after 3 years without use, and also purged at the provider. The Customer must not enter other sensitive data (health, origin, religion, orientation, data of minors) unless its law allows it and it has the required basis.

8. Personnel confidentiality

Only SalesMarketing personnel who need Customer Data to provide the service can access it, and they are bound by confidentiality. Support can enter an account only with prior permission from a Customer administrator, read-only by default, for at most 2 hours; every request is logged and the screen shows a notice banner while it lasts.

9. Security measures

SalesMarketing applies these technical and organizational measures, which form Annex II for the purposes of section 15:

• Per-account isolation: every authenticated request is limited to the account of the credential, and the database also enforces a second row-level security barrier (RLS) in enforcement mode, so one account cannot read another's rows even if the first barrier fails. Anything outside an account's scope responds as non-existent.
• Secret encryption: integration tokens, customers' own provider keys and two-step secrets are stored encrypted with authenticated symmetric encryption (Fernet); they are never written to logs.
• Passwords: stored as bcrypt hashes; never in clear text.
• Two-step verification: TOTP with hashed recovery codes and a per-account policy (nobody, administrators or everyone).
• Roles: owner, administrator, editor, viewer and agency client, with different permissions; only the owner can delete the account.
• Rate limits on sign-in, sign-up and password recovery.
• Transport: HTTPS with HSTS, and security headers (no MIME sniffing, no framing of the app and a content security policy).
• Logs: sign-in events with IP and browser, purged after 90 days; an activity log of changes, visible to the owner and administrators.
• Errors: the error-tracking tool is configured without personal data by default and with a filter that strips sensitive data before sending.
• Recordings: audio is stored in a separate private store, can only be played through the server with a valid session (the screen never receives the storage address or key), and the telephony provider's copy is deleted once stored.
• Retention: call and meeting audio 12 months; transcripts and conversations while the contact record exists (once the record is deleted, they are cleared after 30 days); biometrics until revoked or after 3 years without use; sign-in events 90 days; prospecting data 30 or 90 days depending on its status. The account can shorten these periods, never extend them.
• Backups: managed by the infrastructure provider as part of its service. SalesMarketing does not claim security certifications of its own.

SalesMarketing may update these measures as long as the level of protection is not reduced.

10. Subprocessors

• The Customer gives a general authorization for SalesMarketing to use the subprocessors in the subprocessor list.
• SalesMarketing will give notice of any new or replaced subprocessor at least 30 days in advance, on that page and by email to anyone who has subscribed by writing to {CORREO_LEGAL}.
• The Customer may object on reasonable data protection grounds within that period. If no solution is found, the Customer may turn off the affected feature or terminate without penalty for the unused part.
• Each subprocessor is contractually bound by data protection duties equivalent to those in this DPA. SalesMarketing is liable to the Customer for its subprocessors.
• Integrations the Customer connects itself (ad platforms, stores, external CRMs, the Customer's email and calendar, among others) are not our subprocessors: they are the Customer's providers under its own contract, and SalesMarketing sends or reads data there on the Customer's instructions.

11. Data subject rights, assessments and consultations

• The platform includes a rights tool in the CRM to log requests, export what exists about a person and anonymize them without touching amounts or invoices. It computes the legal deadlines for Brazil (15 days), Colombia (10 business days for inquiries and 15 for complaints) and Mexico (20 days plus 15 to carry it out); for other regions the Customer applies the deadline of its law.
• Deletion also removes audio and attachments from storage and asks ad platforms to remove the person from audiences; anything a platform does not allow to be deleted is recorded.
• If a person contacts SalesMarketing about data we process on behalf of a Customer, they will be referred to the Customer or the request will be forwarded without our answering it on our own account, unless the law requires otherwise.
• SalesMarketing will reasonably assist the Customer with impact assessments and consultations with authorities related to the service, with the information it has available.

12. Security breaches

SalesMarketing will notify the Customer without undue delay and in any case within 48 hours of becoming aware of a breach affecting its data. The notice will include, to the extent known: what happened and when, the categories and approximate number of people and records affected, likely consequences, measures taken or proposed, and a contact. What is not known at first will be sent in phases.

SalesMarketing's notice is not an admission of fault. As controller, the Customer decides whether to notify authorities and individuals. As guidance only, not a substitute for reading the law in force:

13. Deletion or return at termination

• Before terminating, the Customer can export its data from the app; offboarding a business from an agency also generates an export file kept for 30 days.
• When the account is closed, Customer Data is deleted from the platform. Anything held by third parties (voices, samples, voice assistants, phone numbers) is purged with automatic retries, and each deletion is considered done only once the third party confirms it.
• SalesMarketing may keep what the law requires it to keep (for example, invoices) and what remains in backups until they are rotated, always protected and unused.

14. Audits

SalesMarketing will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and will answer a reasonable security questionnaire once a year. If that is not enough, or if an authority requires it, the Customer may carry out an audit at its own cost, with at least 30 days' notice, during business hours, at most once a year, through an auditor bound by confidentiality and without access to other customers' data.

15. International transfers and regional annexes

Customer Data is hosted and processed in the United States and may be processed by subprocessors in the countries shown in the list. The Customer authorizes this. The following annexes apply only when the law of the relevant region governs the processing.

EU/EEA annex: standard contractual clauses

SalesMarketing does not target the EU/EEA. Only in case a Customer processes data of EU/EEA residents and the transfer to SalesMarketing becomes subject to the GDPR, the parties incorporate by reference the standard contractual clauses of Commission Implementing Decision (EU) 2021/914, with these choices:

• Module 2 (controller to processor) when the Customer is a controller, and Module 3 (processor to processor) when the Customer is a processor for a third party, such as an agency.
• Clause 7 (docking clause): included.
• Clause 9: option 2, general authorization, with 30 days' notice under section 10.
• Clause 11: without the independent dispute resolution option.
• Clause 13: the supervisory authority of the Member State where the exporter is established or, if it is not, that of its representative.
• Clauses 17 and 18: Irish law and the courts of Ireland.
• Annex I: the Customer is the exporter and SalesMarketing the importer (section 1); the description of the processing is in sections 4, 5 and 7, and the duration in sections 4 and 13.
• Annex II: the measures in section 9.
• Annex III: the subprocessor list.

If the standard contractual clauses and this DPA conflict, the clauses prevail. Because the service is not offered in the United Kingdom, the UK addendum is not incorporated.

Brazil annex: ANPD standard clauses

For international transfers of data from Brazil subject to the LGPD, the parties incorporate by reference the standard contractual clauses in Annex II of ANPD Resolution CD/ANPD No. 19/2024, without changing their text. The Customer is the exporter and controller; SalesMarketing is the importer and processor. The information the clauses require to be completed (parties, purpose, categories of data and data subjects, duration, measures and subprocessors) is that in sections 1, 4, 7, 9 and 10 and the subprocessor list. For the purposes of the transparency clause, SalesMarketing will make these clauses available to data subjects who request them through the Customer. To the extent they apply, the ANPD clauses prevail over this DPA.

United States annex

• Under the CCPA/CPRA (Cal. Civ. Code §1798.140(ag) and 11 CCR §7051), SalesMarketing acts as a service provider and undertakes to: not sell or share Customer Data; not retain, use or disclose it outside the direct business relationship with the Customer or for purposes other than those in this DPA; not combine it with data from other sources except as the law allows; comply with the CCPA and provide the same level of protection; and notify the Customer if it can no longer comply.
• The Customer may take reasonable steps to stop and remediate unauthorized use, and SalesMarketing will cooperate.
• SalesMarketing certifies that it understands and will comply with these restrictions.
• Under state laws that use the "processor" role (including Virginia, Colorado, Connecticut, Texas, Utah and Oregon), this DPA serves as the required contract.

Latin America annex

• Colombia: this DPA is the transmission contract under article 25 of Decree 1377 of 2013 (now article 2.2.2.25.5.2 of Decree 1074 of 2015). SalesMarketing will process the data in line with the Customer's policies and Law 1581 of 2012.
• Mexico: this DPA documents the remission of data to the processor under the Federal Law on Protection of Personal Data Held by Private Parties (2025) and its regulations.
• Argentina: this DPA is the service contract under article 25 of Law 25.326. For international transfers, the model clauses of AAIP Provision 60-E/2016 apply as relevant.
• Chile: Law 19.628 applies and, once in force, Law 21.719, whose processor obligations are deemed incorporated.
• Other Latin American countries (except Peru, where the service is not offered): this DPA serves as the processor contract required by local law.

16. Liability and term

Each party's liability under this DPA is governed by the limits in the Terms, except where the law or the incorporated clauses do not allow them. This DPA lasts as long as the Terms, and its confidentiality, security and deletion obligations continue for as long as SalesMarketing holds Customer Data. The governing law and courts are those of the Terms, except as set by the clauses incorporated in section 15.