Data Processing Agreement

Effective: 5 October 2026

1. Parties and relation to the Terms of Service

1.1 This data processing agreement (the “Agreement”) is entered into by the customer of the HypeLead service as controller (the “Customer”) and HypeDigitaly s.r.o., company ID (IČO) 17665655, registered office Velká Hradební 2800/54, 400 01 Ústí nad Labem, Czech Republic, as processor (the “Processor”), under Art. 28 of Regulation (EU) 2016/679 (GDPR).

1.2 The Agreement is part of the HypeLead Terms of Service (the “Terms”). The Customer accepts it together with the Terms at sign-up. On the protection of personal data, the Agreement prevails over the Terms.

1.3 If you would like a signed copy of the Agreement, write to info@hypedigitaly.ai. A signed copy has the same content as this version.

1.4 Terms have the meaning given in the GDPR and the Terms.

2. Subject matter, duration, nature and purpose of processing

2.1 The Processor processes personal data on behalf of the Customer to provide it with the HypeLead service (the “Service”), in particular: managing contacts and companies, preparing and sending campaigns from the Customer’s connected accounts, managing replies in one place, preparing message drafts with artificial intelligence, and related support.

2.2 Processing lasts for the term of the Terms and, after they end, until the data is deleted or returned under section 12.

2.3 Details of the processing are in Annex 1.

2.4 This Agreement does not cover processing for which the Processor is an independent controller, in particular finding and enriching lead data, billing, and the security of the Service. These are described in the Privacy Policy.

3. Customer instructions

3.1 The Processor processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless EU or Member State law requires the processing. In that case the Processor informs the Customer in advance, unless that law prohibits it.

3.2 The instructions are this Agreement, the Terms, and the actions that the Customer and its users take in the Service. The Processor keeps records of material actions (for example starting a campaign, turning on AI features, approving a send). These records serve as proof of the instructions.

3.3 If, in the Processor’s opinion, an instruction infringes the GDPR or other data protection law, the Processor informs the Customer without undue delay.

3.4 Lookups in the Prospeo database. If the Customer has the Service find email addresses or phone numbers for contacts it imported from a file, and the Service looks a contact up in the database of the data supplier Prospeo (Defastra Tech Inc.), the Processor sends Prospeo the details needed for the lookup: the contact’s name, the company name and web address, and, if the Service already has them, the contact’s profile link (for example LinkedIn) and email address, the company’s LinkedIn page and Prospeo’s own record number for the person. Starting such a run is the Customer’s documented instruction to make this disclosure (Art. 28(3)(a) GDPR). Prospeo receives the data as a recipient and independent controller, not as a sub-processor of the Processor, and keeps it under its own terms, including to maintain its database; section 7 does not apply to it. Prospeo is based in Canada, for which the European Commission has adopted an adequacy decision; Prospeo is responsible, as controller, for the safeguards for its own servers in the USA. The Customer is responsible for having a legal basis for the disclosure and for naming Prospeo as a recipient when it informs the data subjects (Art. 14(1)(e) GDPR). The contact details that Prospeo returns become part of the Customer’s data processed under this Agreement.

4. Customer obligations

4.1 The Customer is responsible for having a valid legal basis for the processing, for obtaining the data lawfully and for informing the data subjects.

4.2 The Customer does not upload or target:

• special categories of personal data under Art. 9 GDPR,
• personal data relating to criminal convictions and offences under Art. 10 GDPR,
• lists of consumers as outreach recipients.

4.3 The Customer completes the privacy notice page for its recipients in the Service before contacting them for the first time.

5. Confidentiality

5.1 The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

5.2 Only persons who need access to personal data to do their job have it.

6. Security

6.1 The Processor takes technical and organisational measures under Art. 32 GDPR. They are described in Annex 2.

6.2 The Processor may change the measures as long as the overall level of protection is not reduced.

7. Sub-processors

7.1 The Customer gives the Processor general written authorisation to engage sub-processors. The current list is on “Sub-processor List” (Annex 3).

7.2 The Processor announces an intended addition or replacement of a sub-processor at least 15 days in advance, by updating the list and by email to Customers who have subscribed to changes.

7.3 Within 15 days of the announcement, the Customer may object on reasonable data protection grounds. The parties will try to find a solution.

7.4 If no solution is possible, the Customer may, within 30 days, terminate the part of the Service affected by the change, or the Terms as a whole. Some sub-processors (for example hosting or the AI gateway) cannot be replaced; in that case the only solution is to end the affected feature or the Service.

7.5 If a sub-processor must be replaced immediately, for example because of an outage or a security risk, the Processor may act at once and announce the change without undue delay. The right to object is not affected.

7.6 The Processor imposes on each sub-processor, by contract, the same data protection obligations it has under this Agreement. The only exception today is the web search supplier Serper.dev, which has not agreed to such a contract (see Annex 3). The Processor remains liable to the Customer for the performance of every sub-processor, including Serper.dev.

8. Transfers outside the EEA

8.1 The Processor stores personal data in the European Economic Area. The only exception is the copy of the backups kept with Google (Annex 3), which Google may store outside the EEA, including in the USA. The Processor encrypts each backup on its own server before it is uploaded and alone holds the key, so Google cannot read the content.

8.2 Where a sub-processor processes data outside the EEA, the Processor ensures appropriate safeguards under Chapter V GDPR: standard contractual clauses (module 3, processor to processor) with a transfer impact assessment, or the EU-US Data Privacy Framework where the recipient is certified. The only exception today is Serper.dev: it does not publish where it processes data and has given the Processor no such safeguard (see Annex 3).

8.3 If the Customer is established outside the EEA and it is needed, the parties will add further safeguards on request, for example standard contractual clauses module 4.

9. Help with data subject requests

9.1 The Processor helps the Customer meet its obligation to respond to data subject requests. The Service offers tools for export, correction, erasure and adding people to the unsubscribe list.

9.2 If the Processor receives a request that concerns the Customer’s data, it passes it to the Customer without undue delay and does not answer it on the merits itself, unless the Customer authorises it to do so.

10. Personal data breaches

10.1 The Processor notifies the Customer of a personal data breach without undue delay and no later than 48 hours after becoming aware of it.

10.2 The notice contains, as far as known at the time: a description of the breach, the categories and approximate number of people and records concerned, the likely consequences, the measures taken and proposed, and a contact for further information. The Processor adds information that is not yet known as it becomes available.

10.3 The Processor cooperates with the Customer in notifying the authority and informing the people concerned.

11. Impact assessments and cooperation with authorities

11.1 The Processor gives the Customer reasonable help with a data protection impact assessment and with prior consultation of the supervisory authority, taking into account the nature of the processing and the information available to it.

12. Return and deletion at the end

12.1 After the Terms end, the Processor keeps the Customer’s data for 30 days. During that time the Customer can export it (export in CSV format serves as the return of data).

12.2 After the 30 days, the Processor deletes the data. No later than 30 days after that, the Processor also deletes the backups that still contain it. Google, which stores the encrypted copy of the backups (Annex 3), removes deleted copies from its systems within at most 180 days; it cannot read their content.

12.3 After deletion, only data that the law requires to be kept, or that is needed to protect data subjects’ rights, remains: the unsubscribe list and identifier hashes after erasure (so that unsubscribes keep working), audit records (with personal data made unreadable) and records of the Customer’s consents and confirmations.

13. Audits

13.1 The Processor makes available to the Customer the information needed to demonstrate compliance with this Agreement.

13.2 An audit starts in writing: the Customer sends a questionnaire and the Processor answers it within a reasonable time.

13.3 If the written answers are not enough, the Customer or an auditor it appoints, bound by confidentiality, may carry out an on-site audit. The audit must be announced at least 30 days in advance, may be carried out at most once every 12 months (unless there has been a breach or an authority requires it), must not disrupt operations or endanger other customers’ data, and is at the Customer’s cost.

14. Liability

14.1 The parties’ liability is governed by the Terms, including their limits, unless the law provides otherwise.

15. Final provisions

15.1 The Agreement is governed by the law of the Czech Republic.

15.2 If the law changes, the parties will adjust the Agreement as needed. Changes to the Agreement follow the rules for changes to the Terms.

Annex 1 - Details of processing

Annex 2 - Technical and organisational measures

• encrypted data transfer (TLS) between the browser, servers and suppliers,
• encrypted storage of access credentials for connected accounts (envelope encryption with the key held separately from the database),
• separation of each customer’s data at database level (row-level security),
• passwords stored with the argon2id algorithm, short-lived access tokens with rotation and reuse detection, limits on login attempts and account lockout after repeated failures,
• deny by default: every part of the application is closed until we explicitly open it,
• hourly backups, each encrypted on the server with a public key before it is stored, with the decryption key held only by the Processor and never stored on the server; every hourly backup kept for 48 hours and one backup per day for 30 days; an encrypted copy stored off the server,
• a one-off copy of the database taken just before each database update, not encrypted, kept only on the Processor’s own server, accessible only to administrators and deleted within 30 days,
• audit records that cannot be overwritten, with personal data in them erased by making it unreadable,
• removal of passwords, tokens and personal data from system logs and error reports,
• outbound connections of the components that read web pages routed through a controlled gateway that blocks access to internal networks,
• payment cards entered only into a form hosted by Stripe, with no access to the card number,
• speech-to-text on our own servers, with audio deleted right after transcription,
• staff access to data limited to what is necessary,
• a procedure for handling security incidents.

Annex 3 - Sub-processors

The current list of sub-processors, their activities and places of processing is on “Sub-processor List”. The list, as in force at any given time, is part of this Agreement.