Data Processing Addendum (DPA)

This Data Processing Addendum applies only where it is incorporated into, accepted with, or otherwise made part of an agreement between LeadForge LLC and a customer that requires LeadForge to process personal data on the customer's behalf.

For covered processing, this DPA forms part of the applicable LeadForge agreement. If a signed order form, enterprise agreement, or separately executed DPA contains more specific terms, the signed document controls to the extent of a conflict.

This public DPA does not expand LeadForge's role to processing activities for which LeadForge acts independently rather than on the customer's instructions.

For this DPA, Customer Data means personal data or personal information submitted to or made available through the Service by or for the customer and processed by LeadForge on the customer's behalf.

Applicable Data Protection Law means privacy or data-protection law that applies to the covered processing, including where applicable laws using the terms controller, business, processor, service provider, contractor, personal data, or personal information.

Controller and Processor include equivalent terms used by applicable law. Subprocessor means a third party engaged by LeadForge to process covered Customer Data on LeadForge's behalf.

For covered Customer Data, the customer generally acts as controller, business, or other party determining the purposes and means of processing, and LeadForge acts as processor, service provider, or contractor to the extent required by applicable law.

The customer is responsible for determining whether its use of LeadForge is lawful, providing required notices, establishing an appropriate legal basis, responding to individuals, and issuing lawful processing instructions.

LeadForge will process covered Customer Data only to provide, secure, support, and administer the Service, to follow the customer's documented instructions, or as otherwise permitted or required by applicable law.

The applicable agreement, product configuration, authorized user actions, documented support requests, and this DPA constitute the customer's documented instructions for ordinary processing through LeadForge.

LeadForge will notify the customer if, in LeadForge's reasonable view, an instruction violates applicable data-protection law, unless law prohibits that notice.

If the customer requests processing outside the ordinary Service, the parties may need to agree on additional scope, fees, technical measures, or contractual terms before LeadForge performs the request.

LeadForge processes Customer Data to provide an agency operating, territory discovery, sales-intelligence, collaboration, communications, and AI-assisted workflow platform.

Covered processing may include storage, retrieval, organization, analysis, enrichment, matching, generation, transmission, collaboration, campaign sending, meeting transcription, support, security monitoring, billing administration, and deletion as required to provide the configured Service.

The exact processing depends on the features the customer chooses to use.

Customer Data may include account and profile information, customer-provided lead or contact information, imported records, Workspace and Personal content, Team Threads and direct messages, campaign recipient information, meeting transcripts and artifacts, AI prompts and outputs, support content, and operational records associated with those features.

Affected individuals may include customer users, customer personnel, prospects, business contacts, campaign recipients, meeting participants, and other individuals whose information the customer lawfully provides or directs LeadForge to process.

LeadForge is not intended to be used as a repository for unnecessary sensitive personal data, and customers should avoid providing sensitive information unless the Service expressly supports that use and the customer has a lawful basis.

LeadForge processes Customer Data for the duration of the applicable customer relationship and thereafter only for the period reasonably necessary to return, delete, secure, back up, reconcile, or lawfully retain covered records.

Feature-specific retention and temporary-processing periods are described in the Data Retention & Deletion Policy and may be supplemented by the applicable enterprise agreement.

A freshness window used by a product feature is not automatically a deletion deadline.

LeadForge will ensure that personnel authorized to process covered Customer Data are subject to appropriate confidentiality obligations or professional duties of confidentiality.

Access is limited according to role and operational need and may be used for service delivery, support, security, incident response, legal compliance, and other permitted purposes.

LeadForge will maintain reasonable technical and organizational measures designed to protect covered Customer Data against unauthorized access, use, disclosure, alteration, or destruction.

Measures may include authenticated access, server-side authorization, encrypted network transport, protected provider credentials, encrypted connected-mailbox credentials, restricted infrastructure access, logging, monitoring, rate limits, managed cloud infrastructure, incident response, and other controls appropriate to the Service.

The Security & Data Protection Policy describes the current security approach in additional detail.

The customer authorizes LeadForge to engage subprocessors needed to provide the Service, subject to the safeguards described in this DPA.

LeadForge will impose data-protection obligations on subprocessors that are appropriate to the services they perform and the covered Customer Data they process.

LeadForge's current material providers are identified in the Subprocessors & Service Providers document. Where applicable law or an executed agreement requires advance notice of a new subprocessor, LeadForge will provide the required notice and any contractual opportunity to object.

LeadForge remains responsible for its obligations under this DPA notwithstanding the use of subprocessors, subject to the limitations of liability in the governing agreement.

Taking into account the nature of the processing, LeadForge will provide reasonable assistance to help the customer respond to valid requests from individuals exercising rights under applicable data-protection law where the relevant Customer Data is processed through LeadForge.

If LeadForge receives a request directly that clearly relates to Customer Data for which the customer is responsible, LeadForge may direct the requester to the customer unless law requires LeadForge to respond independently.

The customer remains responsible for verifying requests, determining whether a right applies, and communicating the substantive response unless the parties agree otherwise.

Taking into account the nature of processing and information available to LeadForge, LeadForge will provide reasonable assistance with applicable security, breach-notification, data-protection impact assessment, consultation, and similar processor obligations where required by law.

Assistance that requires material work outside normal Service operation may be subject to reasonable fees or a separate statement of work where permitted by the governing agreement.

LeadForge will notify the customer without undue delay after confirming a breach of security involving covered Customer Data where applicable law or the governing agreement requires processor notice.

Notice may be provided in phases as information becomes available and may describe the nature of the incident, affected data, likely consequences where known, and measures taken or proposed to address the incident.

A notification is not an admission of fault or liability. The customer remains responsible for determining whether it must notify regulators, individuals, or other parties unless applicable law assigns that obligation to LeadForge.

At the end of the applicable services, LeadForge will delete or return covered Customer Data as required by the governing agreement and applicable law, subject to technical feasibility, backup cycles, legal retention duties, security needs, and other lawful exceptions.

LeadForge may retain limited records needed for billing, tax, security, fraud prevention, dispute resolution, legal claims, or other obligations where permitted by law.

Residual copies may remain temporarily in backups, logs, or provider-managed recovery systems until they are overwritten or expire in the ordinary course.

LeadForge will make available information reasonably necessary to demonstrate compliance with applicable processor obligations, taking into account the sensitivity of security information and the need to protect other customers.

Where law requires an audit right and reasonable documentary evidence is insufficient, the parties may agree on a proportionate audit process that minimizes disruption, protects confidential information, and avoids exposing systems or data unrelated to the customer.

Audits may be subject to reasonable notice, confidentiality obligations, scope limitations, security requirements, and reimbursement of extraordinary costs where legally permitted.

LeadForge and its providers may process information in jurisdictions different from the customer's location.

Where applicable law requires a transfer mechanism for covered Customer Data, the parties will use an appropriate lawful mechanism, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or other approved mechanism, together with supplementary measures where required.

If a signed customer agreement contains a specific transfer annex, that annex controls for the covered transfer.

Where a United States state privacy law applies and LeadForge acts as a processor, service provider, or contractor, LeadForge will process covered Customer Data for the limited and specified purposes described in the governing agreement and this DPA.

LeadForge will not retain, use, or disclose covered Customer Data outside the permitted business purposes and customer instructions except as allowed by applicable law.

LeadForge will provide the level of privacy protection required of its applicable role and will notify the customer if LeadForge determines it can no longer meet a legally required obligation for the covered processing.

The customer represents that it has the right to provide covered Customer Data to LeadForge and to instruct LeadForge to process it.

The customer is responsible for appropriate user access, lawful collection, required notices and consents, data minimization, retention choices, connected-service authorization, meeting-recording compliance, and the lawfulness of Email Campaign recipients and communications.

LeadForge is not responsible for a customer's processing instructions that violate law or the rights of another person.

If this DPA conflicts with the general Terms of Service on a data-processing matter covered by this DPA, this DPA controls for that matter.

A signed enterprise agreement, negotiated DPA, transfer annex, or order form controls over this public DPA to the extent it expressly addresses the same subject.

LeadForge may update this public DPA as laws, providers, or the Service evolve. Changes do not retroactively amend a separately executed DPA unless the applicable agreement permits that update.

Questions about this DPA or enterprise data-processing terms may be submitted through LeadForge Support or the contact method made available in the Legal & Trust Center.

LeadForge LLC