Lead360 Data Processing Addendum

Applicability and incorporation

This Data Processing Addendum, or DPA, applies when Lead360 processes Customer Personal Data on behalf of a customer under the Lead360 Terms, an order form, or another written agreement. It is incorporated into that agreement. It does not apply to processing for which Lead360 independently determines the purposes and means, as described in the Privacy Policy.

Customer is the controller or business and Lead360 is the processor or service provider unless applicable law uses different terms. Each party will comply with the privacy and data protection laws that apply to its role. If this DPA conflicts with the agreement on a data protection issue, this DPA controls.

Definitions

• Customer Personal Data means personal data contained in Customer Data that Lead360 processes on behalf of the customer.
• Data Protection Law means privacy, data protection, and breach-notification law applicable to the processing, including PIPEDA, applicable provincial Canadian laws, GDPR, UK GDPR, and US state privacy laws where they apply.
• Data Subject, personal data, process, processor, controller, business, service provider, and supervisory authority have the meanings given by applicable Data Protection Law.
• Security Incident means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Lead360 control. It does not include unsuccessful attempts that do not compromise data.

Customer instructions and responsibilities

Lead360 will process Customer Personal Data only to provide, secure, support, and maintain the service; comply with the agreement and documented customer instructions; prevent abuse; and comply with law. The agreement, account configuration, support requests, API calls, automation definitions, and authorized use of features are documented instructions.

Customer is responsible for the lawfulness, accuracy, and quality of Customer Personal Data; required notices and consent; permissions for connected services; instructions given to Lead360; and responding to individuals as controller. Customer will not instruct Lead360 to process data in violation of law. If Lead360 reasonably believes an instruction violates Data Protection Law, it may suspend that processing and notify the customer where permitted.

Confidentiality and personnel

Lead360 will limit access to Customer Personal Data to personnel and contractors who need it for the service and who are subject to confidentiality obligations. Lead360 will provide appropriate privacy and security guidance to personnel with such access.

Security measures

Lead360 will maintain measures appropriate to the nature, scope, context, and risk of the processing. Current measures include authentication, role-based access, tenant controls, transport encryption, logging, backup and recovery processes, credential protections, provider controls, and incident response. The Security page provides more detail.

Customer acknowledges the shared responsibility model. Customer is responsible for user access, role assignment, account configuration, endpoint security, connected providers, consent, content, exports, API keys, and secure use of the service. Lead360 does not promise that every data store or backup is encrypted at rest unless an applicable order or security schedule expressly says so.

Subprocessors

Customer gives Lead360 general authorization to use the subprocessors listed on the Subprocessors page. Lead360 will require a subprocessor to protect Customer Personal Data through written terms appropriate to the service it provides. Lead360 remains responsible for its subprocessor obligations to the extent required by Data Protection Law and the agreement.

Lead360 will update the public list before or when adding a material subprocessor. A customer with an active paid account may object in writing on reasonable data protection grounds within 30 days of notice. The parties will work in good faith on a commercially reasonable alternative. If none is available, Lead360 may stop the affected feature or either party may terminate only the affected service.

International transfers

Customer authorizes processing in Canada, the United States, and locations used by approved subprocessors. Where Data Protection Law requires a transfer mechanism, the parties will use an applicable mechanism, which may include an adequacy decision, standard contractual clauses, the UK Addendum, or another lawful safeguard. The parties will reasonably cooperate on required transfer assessments.

Data-subject requests and compliance assistance

Taking into account the nature of processing and information available, Lead360 will provide reasonable assistance for customer responses to access, correction, deletion, restriction, portability, objection, consent withdrawal, and similar requests. If Lead360 receives a request relating to Customer Personal Data, it may direct the requester to the customer and will not respond substantively except on customer instruction or as required by law.

Lead360 will provide reasonable information to help the customer conduct data protection impact assessments, consult regulators, and demonstrate compliance. Assistance that requires significant custom work may be subject to reasonable fees unless caused by Lead360 breach of this DPA.

Security incidents

Lead360 will notify the customer without undue delay after confirming a Security Incident affecting Customer Personal Data. Notice will include available information reasonably needed for the customer assessment and notification duties, such as the nature of the incident, affected data and people, likely consequences, and mitigation. Information may be provided in stages as the investigation continues.

Customer is responsible for its regulatory and individual notifications unless law assigns that duty to Lead360. Lead360 notification is not an admission of fault or liability. The parties will cooperate on containment, investigation, remediation, and legally required notices.

Return, deletion, and termination

During an active account, the customer may use available export and deletion tools and may request reasonable assistance. After termination, Lead360 will return or delete Customer Personal Data according to the agreement and Data Retention and Deletion Policy unless law requires retention. Disabled sub-accounts generally remain restorable for 90 days before becoming eligible for deletion.

Deletion from active systems may not immediately remove data from rotating backups, provider systems, security logs, legal holds, suppression records, or records that must be retained. Those records will remain protected and will not be used for a new purpose. A retrieval setting, including an AI memory window, is not by itself a verified deletion instruction.

Information and audits

On reasonable written request, Lead360 will provide information necessary to demonstrate compliance with this DPA. Where legally required and the provided information is insufficient, a customer may request an audit no more than once each year, during normal business hours, with reasonable notice, confidentiality safeguards, and scope limited to Customer Personal Data. The audit must avoid disruption and exposure of other customers or sensitive security information.

Customer will bear audit costs unless the audit identifies a material Lead360 breach. Lead360 may satisfy an audit request through current independent reports, questionnaires, documentation, or a qualified third-party assessment where appropriate.

Processing details

Liability and contact

The liability terms in the governing agreement apply to this DPA. Questions, notices, and subprocessor objections may be sent to [email protected] with the subject Data Protection.