Data Processing Addendum

Version 1.0. Effective November 16, 2026.

This Data Processing Addendum ("DPA") forms part of the agreement between Workspace369 LLC, 8225 Emerald Winds Circle, Boynton Beach, FL 33473, USA ("Workspace369", "we", "processor") and the customer that accepted our Terms of Service ("Customer", "controller") (the "Agreement"). It applies when we process Customer Personal Data on Customer's behalf. If it conflicts with the Agreement on the processing of personal data, this DPA wins. It is accepted when Customer accepts the Terms (it is incorporated into them by reference) and needs no signature. Customer may ask for a countersigned copy by emailing support@workspace369.com with the subject "DPA".

1. Definitions

"Data Protection Law" means all privacy laws that apply to Customer Personal Data, including the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws including the California Consumer Privacy Act as amended ("CCPA"). "Customer Personal Data" means personal data in Workspace Content that we process for Customer, including data about Customer's clients, leads, contacts, callers and signers ("End-Client Data"). "Controller", "processor", "data subject", "personal data", "personal data breach", "processing", "supervisory authority", "business", "service provider", "sell" and "share" have the meanings in Data Protection Law. "Sub-processor" means a third party we engage to process Customer Personal Data. "Restricted Transfer" means a transfer of Customer Personal Data that Data Protection Law restricts unless a transfer mechanism applies. "SCCs" means the EU Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0).

2. Roles and scope

2.1 For Customer Personal Data, Customer is the controller (or, if Customer itself processes for another controller, a processor, in which case Customer confirms it has authority to give these instructions and we act as its sub-processor). We are the processor. 2.2 For account, billing, security and usage data about Customer's own users, and for our own website and marketing, we are an independent controller under our Privacy Policy. This DPA does not cover that data. 2.3 Annex I describes the processing. Customer decides what Customer Personal Data to put in the Service and is responsible for having a lawful basis, giving notices (including for call recording and AI processing), obtaining consents (including for SMS and email marketing) and honouring data subject requests. 2.4 Customer must not submit special categories of data under Art 9 GDPR, health records (PHI), or payment card numbers outside Stripe's fields, unless the Agreement permits it in writing.

3. Our obligations as processor (Art 28(3))

3.1 Instructions (28(3)(a)). We process Customer Personal Data only on Customer's documented instructions, which are: the Agreement and this DPA, Customer's use and configuration of the Service (including AI, recording, messaging and automation settings), and further written instructions both parties agree. We will tell Customer if we think an instruction infringes Data Protection Law, and we may suspend that instruction until it is changed. If law requires us to process otherwise, we will tell Customer before processing unless the law forbids it. Transfers outside the EEA/UK are covered by section 9. 3.2 Confidentiality (28(3)(b)). Everyone we authorise to process Customer Personal Data is bound by a written or statutory duty of confidentiality, and access is limited to what the role needs. 3.3 Security (28(3)(c)). We implement the measures in Annex II, appropriate to the risk under Art 32 GDPR. We may update them if the protection is not reduced. 3.4 Sub-processors (28(3)(d)). Section 7. 3.5 Data subject requests (28(3)(e)). Section 5. 3.6 Assistance (28(3)(f)). Taking account of the processing and information we hold, we help Customer meet its duties on security (Art 32), personal data breaches (Arts 33-34), data protection impact assessments and prior consultation (Arts 35-36). We provide the information in Annex I-II and our sub-processor page for that purpose. Work beyond the standard features may be charged at our reasonable rates if Customer asks for more than the Service's tools provide. 3.7 Return and deletion (28(3)(g)). Section 8. 3.8 Information and audits (28(3)(h)). Section 6. 3.9 No selling; CCPA service-provider terms. Section 10. 3.10 Records. We keep a record of processing carried out for Customer as Art 30(2) requires.

4. Customer's duties

Customer will (a) give lawful instructions; (b) use the Service's controls, such as access roles, retention settings and the recording notice, correctly; (c) tell us promptly of anything that stops it complying; and (d) cooperate with our reasonable requests to prove lawful basis for messaging where a carrier or regulator asks.

5. Data subject requests

5.1 If a data subject contacts us about Customer Personal Data, we will not respond on the merits, will tell the person we received the request and that the controller is Customer where we can identify Customer, and will forward the request to Customer without undue delay and within five (5) business days. 5.2 The Service provides tools for Customer to access, correct, export and delete data (client records, workspace export, retention settings). If Customer cannot do it with those tools, we will help on written request within a reasonable time (normally within 10 business days), taking account of statutory deadlines. 5.3 Because of the 7-year (configurable 1 to 10 year) retention lock on sealed e-signature evidence, that evidence cannot be deleted early. Customer is responsible for explaining this to data subjects and, where the law allows, relying on legal-claims exceptions.

6. Audits and information

6.1 We make available on request a security questionnaire response and our current summary of controls (Annex II), and any independent audit report we hold. We do not currently hold SOC 2 or ISO 27001 certification. 6.2 If that is not enough to show compliance with Art 28, or if a regulator requires it, Customer may audit us, no more than once a year, with 30 days' written notice, during business hours, under confidentiality, through an independent auditor we accept, at Customer's cost, and without access to other customers' data. Audits cannot cover infrastructure operated by our sub-processors beyond the reports those providers publish. 6.3 We will tell Customer if a supervisory authority asks about Customer Personal Data, unless the law forbids it.

7. Sub-processors

7.1 General authorisation. Customer authorises us to use the Sub-processors listed at workspace369.com/sub-processors (Annex III) on the date it accepts this DPA. 7.2 Changes. We will post a new or replacement Sub-processor, or a change of purpose or location that affects Customer Personal Data, on that page at least 30 days before it starts processing Customer Personal Data, and email the owner of each Customer workspace at the same time. 7.3 Objection. Customer may object in writing, on reasonable data-protection grounds, within 30 days after the notice. We will work in good faith to offer a change that avoids the objected Sub-processor. If we cannot within 30 days, Customer may terminate the affected part of the Service on written notice and we will refund prepaid fees for the unused period of that part. This is Customer's only remedy for an objection. 7.4 Flow-down and liability. We bind each Sub-processor to data protection terms no less protective than this DPA (including the SCC transfer terms where relevant) and remain responsible to Customer for their performance, subject to the Agreement's limits of liability. 7.5 Emergency replacement. If we must replace a Sub-processor quickly for security or outage reasons, we will notify Customer as soon as reasonably possible and Customer may object as in 7.3.

8. Return and deletion

8.1 While the Agreement is in force Customer can export its Workspace Content with the workspace export tool. 8.2 After the Agreement ends or Customer deletes the workspace, we make Customer Personal Data available for export for 90 days. After that we may delete or de-identify it from live systems at any time, and we will do so within 30 days of Customer's written request, unless law requires us to keep it. When the Customer owner deletes a workspace, deletion starts after a 24-hour cancellation window. 8.3 Copies in encrypted backups are removed as the backups expire and are not used for any other purpose. Sealed e-signature evidence is kept for its retention-locked term (section 5.3). Billing and tax records we hold as controller are kept as the law requires. 8.4 On request we will confirm deletion in writing.

9. International transfers

9.1 Location. We store Customer Personal Data in the United States (Firestore in us-east1; functions and most services in us-central1). Some AI features use Google's global endpoint. Customer Personal Data is not currently hosted in the EEA or UK. Customer agrees to these locations. 9.2 EU SCCs. To the extent a Restricted Transfer from the EEA to us is made, the SCCs apply and are incorporated by reference as follows:

• Module Two (controller to processor) applies where Customer is a controller; Module Three (processor to processor) applies where Customer is itself a processor.
• Clause 7 (docking clause): included.
• Clause 9(a) (sub-processors): Option 2, general written authorisation, with the 30-day notice period in section 7.2.
• Clause 11(a) (independent dispute resolution): optional language not included.
• Clause 17 (governing law): the law of Ireland.
• Clause 18(b) (courts): the courts of Ireland.
• Clause 13 / Annex I.C (competent supervisory authority): the supervisory authority of the Member State where Customer is established, or, if Customer is not established in the EU, where its Art 27 representative is established, or otherwise the Irish Data Protection Commission.
• Annex I is Annex I below; Annex II is Annex II below; Annex III is Annex III below.
• The signature of the parties' acceptance of the Agreement is treated as signature of the SCCs.

9.3 UK. For a Restricted Transfer from the UK, the UK Addendum applies and is incorporated by reference. Table 1 parties and contacts are those in Annex I. Table 2: the Approved EU SCCs are those in 9.2. Table 3: Annexes are Annexes I-III here. Table 4: neither party may end the UK Addendum when the ICO issues a revised Approved Addendum. Where UK law applies, references to the GDPR mean the UK GDPR. 9.4 Switzerland. For a Restricted Transfer from Switzerland, the SCCs apply with these changes: references to the GDPR mean the Swiss FADP; the competent authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" includes Switzerland so Swiss data subjects can enforce their rights in Switzerland; the law is Swiss law for Clause 17 and Swiss courts for Clause 18. 9.5 Data Privacy Framework. Workspace369 is not self-certified under the EU-US Data Privacy Framework, so the SCCs in 9.2 apply. 9.6 Priority and our commitments. If the SCCs conflict with this DPA or the Agreement, the SCCs win. We will: (a) tell Customer if we can no longer meet the SCCs; (b) challenge a government request for Customer Personal Data where there are reasonable grounds to think it is unlawful, and tell Customer first unless forbidden (SCC Clause 15); (c) give Customer information it reasonably needs for a transfer impact assessment. Our sub-processors may be "electronic communication service providers" within the scope of FISA 702, and we cannot fully exclude that. 9.7 EU and UK representative. We have not appointed a representative under Article 27 of the GDPR or the UK GDPR. Write to support@workspace369.com with the subject "DPA" for Article 27 matters.

10. US state laws (CCPA service-provider terms)

10.1 For Customer Personal Data subject to the CCPA, Customer is the "business" and we are its "service provider" (and for other US state privacy laws, its "processor"). 10.2 We process the personal information only for the limited and specified business purposes in Annex I and not for any other purpose, including our own commercial purposes outside these purposes. Customer discloses it to us only for those purposes. 10.3 We will not sell or share (for cross-context behavioural advertising) the personal information. 10.4 We will not retain, use or disclose it for any purpose, including a commercial purpose, other than the business purposes in Annex I, or outside our direct business relationship with Customer, except as the CCPA allows service providers (for example to engage sub-processors, to build or improve the quality of our services without building profiles to serve other businesses, to detect security incidents, and to comply with law). 10.5 We will not combine the personal information with personal information we receive from or on behalf of another source or collect from our own interactions with consumers, except as the CCPA regulations allow. 10.6 We will comply with the CCPA and give the same level of privacy protection as it requires of the business. We will notify Customer within a reasonable time (and within 5 business days of confirming) if we decide we can no longer meet our CCPA obligations. Customer may take reasonable and appropriate steps to stop and remedy unauthorised use, and to ensure we use the personal information consistently with its CCPA obligations, including through the audit and information rights in section 6. 10.7 We will give Customer the cooperation it needs for consumer requests (section 5), and will bind our sub-processors to the same terms (section 7.4). 10.8 We certify that we understand and will comply with these restrictions.

11. Personal data breach

11.1 We will notify Customer without undue delay and within 72 hours of confirming a personal data breach affecting Customer Personal Data. "Confirming" means we have reasonable certainty that unauthorised access, loss, alteration or disclosure of Customer Personal Data happened. 11.2 The notice, sent to Customer's account owner email and privacy contact, will describe as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and our contact. We will send further information as we learn it, in phases if needed. 11.3 We will take reasonable steps to contain and investigate the breach and help Customer with its Art 33-34 duties. Customer is responsible for deciding whether to notify authorities and data subjects, and for the content of those notices. Our notice is not an admission of fault.

12. Liability

Each party's liability under or in connection with this DPA is subject to Section 26 of the Terms, including the higher limit for data claims in Section 26.3, except that nothing limits liability that cannot be limited by law, or the rights of data subjects under the SCCs.

13. Term and general

This DPA lasts as long as we process Customer Personal Data. Sections that by nature survive, do. We may update this DPA by posting a new version and giving at least 30 days' notice for changes that matter, and must follow section 7 for sub-processor changes. A change required by law or a regulator may take effect sooner. Governing law and disputes follow the Agreement except where the SCCs, UK Addendum or Data Protection Law require otherwise.

ANNEX I. Description of processing (for the SCCs and the DPA)

A. List of parties

Data exporter (controller or, for Module 3, processor): Customer, as named in its Workspace369 account. Contact and, where applicable, representative: as given in the account (Settings, Privacy contact). Role: controller (Module 2) or processor (Module 3). Signature and date: by accepting the Agreement. Data importer (processor): Workspace369 LLC, 8225 Emerald Winds Circle, Boynton Beach, FL 33473, USA. Contact: support@workspace369.com (subject "DPA"). Data protection officer: none appointed (not required). EU/UK representative: none appointed. Role: processor.

B. Description of transfer

C. Competent supervisory authority

As in section 9.2 (Clause 13).

ANNEX II. Technical and organisational measures

ANNEX III. Authorised sub-processors

The list at workspace369.com/sub-processors on the date this DPA is accepted, as updated under section 7.