Data Processing Addendum

This Data Processing Addendum (“DPA”) reflects the requirements of the European Union and United Kingdom General Data Protection Regulations (‘GDPR’). Smartlead’s products and services offered in the European Union and the UK are GDPR ready and this DPA provides you with the necessary documentation of this readiness.

This Data Processing Addendum is an addendum to the Smartlead Terms of Use (“Terms”) between 521 PRODUCTS PTY LTD (ACN 645 593 835), (“Smartlead”) and Smartlead’s users (“User”) who are referred to as “You” in the Terms, whose representative accepts this DPA. All capitalized terms not defined in this DPA shall have the meanings set forth in the Terms. User enters into this DPA on behalf of itself and, to the extent required under Data Protection Laws, in the name and on behalf of its Authorized Affiliates (defined below).

THIS DPA IS ACCEPTED BY THE USER BY VIRTUE OF THE USER ACCEPTING THE TERMS UPON BUYING A SUBCRIPTION FROM SMARTLEAD. THIS DPA CONSTITUTES PART OF THE TERMS.

The parties agree as follows:

1. Definitions

In this Data Processing Addendum, the following capitalised terms have the following meaning:

“Affiliate” means an entity that directly or indirectly Controls, is Controlled by or is under common Control with an entity.
“Approved EU SCCs” means the Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
“Authorized Affiliate” means any User Affiliate(s) permitted to or otherwise receiving the benefit of the Service pursuant to the Terms.
“Control” (including the terms “Controlled by” and “under common Control with”) means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of an entity, whether through the ownership of voting securities, by contract or otherwise.
“Controller” means an entity that determines the purposes and means of the processing of Personal Data.
“Data Protection Laws” means all data protection and privacy laws and regulations applicable to the processing of Personal Data under the Terms, including, where applicable: (i) the Australian Privacy Act; (ii) EU Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation or GDPR); (iii) the UK Data Protection Act 2018 and the UK General Data Protection Regulation; and (iv) EU Directive 2002/58/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector and applicable national implementations of it (in each case, as may be amended, superseded or replaced).
“Personal Data” means any User Data relating to an identified or identifiable natural person to the extent that such information is protected as personal data or personal information under applicable Data Protection Law.
“Processor” means an entity that processes Personal Data on behalf of the Controller.
“Processing” has the meaning given to it in the GDPR and “process”, “processes” and “processed” shall be interpreted accordingly.
“Security Incident” means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.
“Service” means any product or service provided by Smartlead to User pursuant to and as more particularly described in the Terms.
“Subscription Plan” has the meaning given in the Terms.
“Sub-processor” means any Processor engaged by Smartlead or its Affiliates to assist in fulfilling its obligations with respect to providing the Service pursuant to the Terms or this DPA. Sub-processors may include third parties or any Smartlead Affiliate.
“UK Addendum” means the UK Addendum VERSION B1.0, in force 21 March 2022 as approved by the UK ICO and which incorporate the Approved EU SCCs.
“User Data” means any data that Smartlead and/or its Affiliates processes on behalf of User in the course of providing the Service under the Terms.
“Terms” means the Terms of Use which this Data Processing Addendum accompanies.

2. Scope and Applicability of this DPA

Application. This DPA applies where and only to the extent that Smartlead processes Personal Data on behalf of the User in the course of providing the Service and such Personal Data is subject to Data Protection Laws of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom. The parties agree to comply with the terms and conditions in this DPA in connection with such Personal Data.
Role of the Parties. As between Smartlead and User, User is the Controller of Personal Data and Smartlead shall process Personal Data only as a Processor on behalf of User. Nothing in the Terms or this DPA shall prevent Smartlead from using or sharing any data that Smartlead would otherwise collect and process independently of User's use of the Service.
User Obligations. User agrees that (i) it shall comply with its obligations as a Controller under Data Protection Laws in respect of its processing of Personal Data and any processing instructions it issues to Smartlead; and (ii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data Protection Laws for Smartlead to process Personal Data and provide the Service pursuant to the Terms and this DPA.
Smartlead Processing of Personal Data. As a Processor, Smartlead shall process Personal Data only for the following purposes: (i) processing to perform the Service in accordance with the Terms; (ii) processing to perform any steps necessary for the performance of the Terms; (iii) to comply with other reasonable instructions provided by User to the extent they are consistent with the terms of this Terms and only in accordance with User’s documented lawful instructions; and (iv) on an aggregated and anonymised basis only, for its own internal analysis and improvement of the Service. The parties agree that this DPA and the Terms set out the User’s complete and final instructions to Smartlead in relation to the processing of Personal Data and processing outside the scope of these instructions (if any) shall require prior written agreement between User and Smartlead.
Nature of the Data. Smartlead handles User Data provided by User. Such User Data may contain special categories of data depending on how the Service are used by User. The User Data may be subject to the following process activities: (i) storage and other processing necessary to provide, maintain and improve the Service provided to User; (ii) to provide customer and technical support to User; and (iii) disclosures as required by law or otherwise set forth in the Terms.
Smartlead Data. Notwithstanding anything to the contrary in the Terms (including this DPA), User acknowledges that Smartlead shall have a right to use and disclose data relating to and/or obtained in connection with the operation, support and/or use of the Service for its legitimate business purposes, such as billing, account management, technical support, product development and sales and marketing. To the extent any such data is considered personal data under Data Protection Laws, Smartlead is the Controller of such data and accordingly shall process such data in compliance with Data Protection Laws.

3. Sub-processing

Authorized Sub-processors. User agrees that Smartlead may engage Sub-processors to process Personal Data on User's behalf. The Sub-processors currently engaged by Smartlead and authorized by User are listed in Exhibit A, Annex III and can be requested by User.
Sub-processor Obligations. Smartlead shall: (i) enter into a written agreement with the Sub-processor imposing data protection terms that require the Sub-processor to protect the Personal Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Smartlead to breach any of its obligations under this DPA.
Changes to Sub-processors. Smartlead shall update the list of Authorized Sub-processors from time to time and the User shall have deemed to accept any changes by accepting the Terms with Smartlead.
Objection to Sub-processors. User may object in writing to Smartlead’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Smartlead promptly in writing within five (5) calendar days of receipt of Smartlead’s notice in accordance with Section 3.3. Such notice shall explain the reasonable grounds for the objection. In such event, the parties shall discuss such concerns in good faith with a view to achieving commercially reasonable resolution. If this is not possible, either party may terminate the applicable Service that cannot be provided by Smartlead without the use of the objected-to-new Sub-processor.

4. Security

Security Measures. Smartlead shall implement and maintain appropriate technical and organizational security measures to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data, in accordance with Smartlead's security standards described in Exhibit B (“Security Measures”).
Confidentiality of Processing. Smartlead shall ensure that any person who is authorized by Smartlead to process Personal Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).
Security Incident Response. Upon becoming aware of a Security Incident, Smartlead shall notify User without undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by User.
Updates to Security Measures. User acknowledges that the Security Measures are subject to technical progress and development and that Smartlead may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Service purchased by the User.

5. Security Reports and Audits

Smartlead shall maintain records of its security standards. Upon User's written request, Smartlead shall provide (on a confidential basis) copies of relevant certifications, audit report summaries and/or other documentation reasonably required by User to verify Smartlead's compliance with this DPA. Smartlead shall further provide written responses (on a confidential basis) to all reasonable requests for information made by User, including responses to information security and audit questionnaires, that User (acting reasonably) considers necessary to confirm Smartlead's compliance with this DPA, provided that User shall not exercise this right more than once per year.

6. International Transfers

Processing Locations. Smartlead stores and processes EU and UK Data (defined below) in data centres located inside and outside the European Union and the UK. All other User Data may be transferred and processed in the United States, Australia, Europe, India and anywhere in the world where User, its Affiliates and/or its Sub-processors maintain data processing operations. Smartlead shall implement appropriate safeguards to protect the Personal Data, wherever it is processed, in accordance with the requirements of Data Protection Laws.
Transfer Mechanism. Notwithstanding Section 6.1, to the extent Smartlead processes or transfers (directly or via onward transfer) Personal Data under this DPA from the European Union, the European Economic Area and/or their member states and Switzerland or the UK (“EU and UK Data”) in or to countries which do not ensure an adequate level of data protection within the meaning of applicable Data Protection Laws of the foregoing territories, the parties agree to abide by and process EU and UK Data in compliance with the Approved EU SCCs and the UK Addendum in the form set out in Exhibit A.

7. Return or Deletion of Data

Upon deactivation of the Service, all Personal Data shall be deleted within 90 days subject to full User payment of any outstanding invoices, save that this requirement shall not apply to the extent Smartlead is required by applicable law to retain some or all of the Personal Data, or to Personal Data it has archived on back-up systems, which such Personal Data Smartlead shall securely isolate and protect from any further processing, except to the extent required by applicable law.

8. Cooperation

To the extent that User is unable to independently access the relevant Personal Data within the Service, Smartlead shall (at User's expense) take into account the nature of the processing, provide reasonable cooperation to assist User by appropriate technical and organizational measures, in so far as is possible, to respond to any requests from individuals or applicable data protection authorities relating to the processing of Personal Data under the Terms. In the event that any such request is made directly to Smartlead, Smartlead shall not respond to such communication directly without User's prior authorization, unless legally compelled to do so. If Smartlead is required to respond to such a request, Smartlead shall promptly notify User and provide it with a copy of the request unless legally prohibited from doing so.
To the extent Smartlead is required under Data Protection Law, Smartlead shall (at User's expense) provide reasonably requested information regarding Smartlead's processing of Personal Data under the Terms to enable the User to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.

9. Miscellaneous

Except for the changes made by this DPA, the Terms remains unchanged and in full force and effect. If there is any conflict between this DPA and the Terms, this DPA shall prevail to the extent of that conflict.
This DPA is a part of and incorporated into the Terms so references to "Terms" in the Terms shall include this DPA.
In no event shall any party limit its liability with respect to any individual's data protection rights under this DPA or otherwise.
This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Terms, unless required otherwise by Data Protection Laws.

Exhibit A – UK Addendum

In accepting the Terms, the UK Addendum and Module 2 of the Approved EU SCCs are incorporated by reference with the following agreed terms:

Table 1: Parties

Start date	The date of acceptance of the Terms.
The Parties	Exporter	Importer
Parties’ details	The User, as defined in the Smartlead Terms of Use	521 PRODUCTS PTY LTD (ACN 645 593 835) (“Smartlead”)
Key Contact	See Subscription Plan	See Subscription Plan

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs. The Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:

Module	Module in operation	Clause 7 (Docking Clause)	Clause 11 (Option)	Clause 9a (Prior Authorisation or General Authorisation)	Clause 9a (Time period)	Is personal data received from the Importer combined with personal data collected by the Exporter?
1
2	X	X	Not included	Option 2	14 days	No
3
4

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties	The User and Smartlead
Annex 1B: Description of Transfer	Transfer of contact details of the data exporter’s employees, contractors and temporary workers (current, former, prospective) to the data importer; Transfer of email addresses and other personal data of past, present and prospective or potential customers, clients, visitors and users of data exporter, and of data exporter's goods, services and applications (including any leads); and Transfer of interactions between individuals who respond or otherwise interact with data exporter or employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter, each for the purpose of providing the Smartlead services and support.
Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data	See Exhibit B
Annex III: List of Sub processors (Modules 2 and 3 only)	AWS for hosting Remainder available on request

Table 4: Ending this Addendum when the Approved Addendum Changes

Ending this Addendum when the Approved Addendum changes

Which Parties may end this Addendum as set out in Section 19: - neither Party

Exhibit B

Technical and organisational measures including technical and organisational measures to ensure the security of the data

Data importer shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access. That shall include:

ensuring any of its employees or agents or other persons to whom it provides access to personal data are obliged to keep it confidential;
the use of pseudonymisation and encryption of personal data, where appropriate;
internal measures aiming to ensure the ongoing confidentiality, integrity, availability and resilience of the data importer’s systems and services;
the ability to restore the availability and access to personal data in a timely manner, pending back-ups every 24-48 hours, in the event of a physical or technical incident;
assisting data exporter to comply with its own data security obligations under applicable legislation;
securely storing data in a certified data repository, specifically one located in the Sydney Region of Amazon Web Services;
safeguarding data while not in operation by using the Advanced Encryption Standard (AES) along with a 256-bit encryption key;
employing further data protection measures through use of passwords and Virtual Private Cloud (VPC);
regulating access to the VPC through Identity and Access Management (IAM) measures, requiring users to verify their identity using Multi-Factor Authentication (MFA) and private keys for ensuring secured access; and
generally using reputable and highly secure providers and sub-processors with robust security practices and certifications.

Data importer shall notify data exporter promptly should it become aware of a security breach leading to the accidental or unauthorised loss, alteration or disclosure of personal data (a “Security Breach”). Data importer shall promptly:

attempt to provide any information needed or requested by data exporter including an approximate estimation of the nature of the Security Breach, the volume and type of personal data affected, the categories and approximate number of individuals concerned and an estimation of the likely consequences of the Security Breach; and
take all measures necessary to address the Security Breach, mitigate its effects and prevent further breaches, and provide details of those measures to data exporter.