Data Protection Addendum (DPA)

This Data Protection Addendum ("DPA") is incorporated into the Intent Leads Terms of Service at https://intentleads.si/terms, or any other agreement for Intent Leads (the "Agreement"), between the customer that accepts the Agreement ("Customer") and DBEE, Inc. ("Vendor") (each a "Party" and together the "Parties"). It applies from when Customer accepts the Agreement, with no separate signature: accepting the Terms of Service accepts this DPA, including Schedule 1 where it applies. An executed copy with Customer's details is available in the dashboard under Settings → Legal.

1. Definitions

For the purposes of this DPA:

"Data Protection Laws" means all applicable laws, regulations and other legal or self-regulatory requirements in any jurisdiction relating to privacy, data protection, data security, breach notification, or the Processing of Personal Data, each as amended from time to time, including, to the extent applicable: the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 (together the "CCPA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act and its regulations, the Utah Consumer Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act, and the other US state comprehensive privacy laws (collectively, "U.S. Privacy Laws"); and any applicable privacy law that draws a distinction between a data "controller" and a data "processor". If a Party's activities involving Personal Data are not within the scope of a given Data Protection Law, that law does not apply for the purposes of this DPA.

"Customer Data" means the Personal Data Customer submits to Intent Leads, such as exclusion lists, company lists, and the names and emails in its settings.

"Pixel Data" means the data the Intent Leads website snippet collects from browsers visiting Customer's websites, such as pages visited, time, browser and device data, cookie identifiers, hashed identifiers and IP address.

"Output Data" means the data Vendor delivers to Customer through Intent Leads, including intent leads, Search results and identified website visitors, with their contact, company and signal fields.

"Personal Data Breach" means the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or exfiltration of, or access to, Personal Data.

"Personal Data" means (i) any information relating to an identified or identifiable individual, within the meaning of applicable Data Protection Law; and (ii) any other information constituting "personal information" as defined in the CCPA (regardless of whether the CCPA applies).

"Process" and "Processing" mean any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Services" means Intent Leads as described in the Agreement.

"Subprocessor" means any Vendor affiliate or subcontractor engaged by Vendor to Process Customer Data.

The terms "Business", "Consumer", "Controller", "Data Subject", "Processor", "Share", "Sell", "Service Provider" and "Third Party" have the meanings given in Data Protection Laws. "Controller" also refers to "Business", "Processor" also refers to "Service Provider", and "Data Subject" includes "Consumer". Capitalized terms not defined here have the meanings given in the Agreement.

2. Scope and roles of the Parties

This DPA applies both to the Personal Data Vendor receives from Customer and to the Personal Data Vendor provides to Customer. Data Protection Laws give each Party different roles depending on the category and function of the Personal Data. For the purposes of this DPA and the Agreement:

i. When Processing Customer Data, Vendor acts as a Service Provider (Processor). For the avoidance of doubt, Customer Data is used to select and suppress the people and companies included in Customer's Output Data, and to run Customer's account.

ii. When Processing Pixel Data, Vendor acts as a Third Party and an independent Controller, using Pixel Data to identify US website visitors and deliver them to Customer as Output Data.

iii. When Processing, handling or licensing Output Data, each Party acts as an independent Controller when and to the extent the Output Data is in its possession or control. Section 5 applies to Output Data.

3. Customer's instructions to Vendor for Customer Data

Vendor will Process Customer Data only to provide the Services, unless the law requires otherwise; in that case Vendor will tell Customer of that legal requirement before the Processing unless the law forbids it. In addition:

• Vendor will not retain, use, disclose or otherwise Process Customer Data in a way inconsistent with its role in performing services for Customer, and will use Customer Data only to provide the requested Services to Customer;
• Vendor will not use or disclose Customer Data outside the direct business relationship between Customer and Vendor;
• Vendor will not Sell Customer Data (regardless of whether any Data Protection Law applies);
• Vendor will not Share Customer Data as defined in the CCPA, except that Customer understands that the website visitor identification it requests may constitute "sharing" of Pixel Data on Customer's behalf;
• Vendor will not add Customer Data to any database it licenses to others, or use it to train AI models;
• Vendor will comply with any restrictions under Data Protection Law on combining Customer Data with Personal Data that Vendor receives from or on behalf of anyone else, or collects from its own interactions with a Data Subject;
• Vendor will provide the same level of protection for Customer Data subject to the CCPA as the CCPA requires;
• Vendor will notify Customer as soon as legally permissible if it determines it can no longer meet its obligations under applicable Data Protection Laws;
• Customer has the right to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Data;
• Customer will not instruct Vendor to Process Customer Data in violation of Data Protection Laws;
• The Agreement, this DPA, and Customer's configuration of the Services' settings and API calls are Customer's complete and final instructions to Vendor for Processing Customer Data.

4. Vendor's use of Subprocessors

Vendor may subcontract the Processing of Customer Data in compliance with Data Protection Law to provide the Services. Before a Subprocessor Processes Customer Data, Vendor will impose contractual obligations on it that comply with Data Protection Laws and are substantially the same as those imposed on Vendor under this DPA. A Subprocessor's security obligations are substantially the same if they provide a commercially reasonable level of security.

Vendor's current Subprocessors are listed at https://intentleads.si/subprocessors (the "Subprocessor List"). When Vendor engages a new Subprocessor, it will make an updated Subprocessor List available at least 15 days before the new Subprocessor Processes any Customer Data, by posting it there and, on the same day, emailing the owners of Customer's organization (the "Update").

If Customer has a reasonable basis for objecting to a Subprocessor, it may send Vendor written notice of that basis within 10 days of the Update, including a termination date no earlier than 15 days after the Update. If Vendor cannot accommodate the objection to Customer's reasonable satisfaction by that date, the Agreement will terminate on that date and Vendor will refund any unused prepaid balance.

Vendor remains liable for its Subprocessors' performance to the same extent as for its own, consistent with the limitations of liability in the Agreement.

5. CCPA "Third Party" provisions

This Section 5 applies to the extent Vendor provides Output Data to Customer:

• Customer shall use Output Data only for sales and marketing to businesses and to consumers (including, for consumers, the duties in "Marketing to consumers" in section 7 of the Terms of Service), for itself and for clients as the Agreement allows, and to evaluate the effectiveness of that marketing, and not for any purpose the Agreement prohibits. Vendor shall use Pixel Data only to identify US website visitors, deliver them to Customer, and maintain the accuracy of the Services.
• Each Party shall provide legally sufficient consumer notice and choice mechanisms, including (for California residents) "opt-out" and "notice at collection" disclosures and mechanisms in compliance with the CCPA and other applicable state privacy laws. Each Party will sufficiently disclose how it uses Personal Data (including as contemplated in the Agreement). Each Party will, as required by Data Protection Law, provide a link on its website to "Your Privacy Choices", "Do Not Sell or Share My Personal Information" or similar opt-out functionality. Customer will include the language required by the Agreement on any website that runs the Intent Leads snippet.
• When either Party makes available to the other a list of people who have asked to opt out or to have their personal information deleted, the receiving Party shall comply with those requests to the extent required by law. Customer shall delete or suppress people in Vendor's removal notices within 10 business days, as the Agreement requires.
• Each Party may take reasonable and appropriate steps to ensure the other Party uses the Personal Data provided to it only as set out in the Agreement and in compliance with the CCPA, and, on reasonable notice, may take reasonable and appropriate steps to stop and remediate the other Party's unauthorized use of that Personal Data.
• Each Party shall notify the other within five (5) business days if it determines it can no longer meet its legal obligations under the CCPA for the Personal Data the other Party provided.

6. Data security

Vendor will help Customer comply with its security obligations under Data Protection Laws, as relevant to Vendor's role in Processing Customer Data, taking into account the nature of the Processing and the information available to Vendor, by implementing appropriate technical and organizational measures, including those in the Information Security Addendum at https://intentleads.si/compliance, which is incorporated into this DPA.

Vendor will ensure that the personnel it authorizes to Process Customer Data are subject to an appropriate written confidentiality obligation.

Vendor will comply with the Personal Data Breach obligations that apply to it under Data Protection Laws. Taking into account the nature of the Processing and the information available to Vendor, Vendor will help Customer comply with those that apply to Customer by informing Customer of a confirmed Personal Data Breach affecting Customer Data or Output Data in Vendor's systems without undue delay, and in no case more than 48 hours after becoming aware of it. To the extent available, the notice will include Vendor's then-current assessment of the following, which may be based on incomplete information:

i. the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned;

ii. the likely consequences of the Personal Data Breach; and

iii. the measures taken or proposed by Vendor to address the Personal Data Breach, including, where applicable, measures to mitigate its possible adverse effects.

Nothing in this DPA requires Vendor to violate, or delay compliance with, any legal obligation it has for a Personal Data Breach or other security incident.

7. Assistance responding to Consumers

Taking into account the nature of the Processing, Vendor will reasonably assist Customer in honoring requests by individuals to exercise their rights under Data Protection Law for Customer Data (such as rights to access their Personal Data). Vendor will promptly notify Customer of any such request, or any Personal Data complaint from an individual, that Vendor receives and determines relates to Customer Data, and in any case within 3 business days when Vendor receives it through the contact details in its Privacy Policy.

8. Assistance with data protection assessments

Taking into account the nature of the Processing and the information available to Vendor, Vendor will reasonably assist and cooperate with Customer in any data protection assessment of the Processing of Customer Data involving Vendor.

9. Audits

Vendor will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA for its Processing of Customer Data, including answers to Customer's reasonable written security questionnaire once a year, and will allow for and contribute to audits, including inspections, by Customer or an independent auditor bound by confidentiality, at Customer's expense, on at least 30 days' notice and no more than once in any 12 months, unless a Personal Data Breach or a regulator requires otherwise.

10. Return or destruction

At Customer's choice, Vendor will return and/or destroy all Customer Data in its possession within 30 days after Customer's use of the Services ends, except to the extent Data Protection Law requires Vendor to keep it, or as otherwise agreed by the Parties.

11. U.S. data only

The Agreement and this DPA contemplate the provision of Output Data and Pixel Data solely about persons, browsers and devices located in the United States. Should Customer be established in, or provide Customer Data from, other locations, including the European Union, the European Economic Area, Switzerland or the United Kingdom, Schedule 1 (UK, EEA and Swiss terms) applies to that extent, with no separate step.

Schedule 1: UK, EEA and Swiss terms

This Schedule applies only to the extent the UK GDPR, the EU GDPR or the Swiss Federal Act on Data Protection applies to Customer's use of Intent Leads (for example, because Customer is established in the United Kingdom, the European Economic Area or Switzerland). Where it applies, it forms part of this DPA. If it conflicts with the rest of this DPA or the Terms, it wins on matters within its scope, and the Transfer Clauses (section 9 of this Schedule) win over everything else. Section, Part and Annex numbers in this Schedule refer to this Schedule.

It has three parts: Part A for Customer Data (DBEE as processor), Part B for Output Data (independent controllers), and Part C for website visitor ID (joint controllers for collecting Pixel Data).

1. Definitions

Capitalized words not defined here have the meaning given in the rest of this DPA, the Terms or Data Protection Law.

• Data Protection Law: every law on privacy and personal data that applies to a party's processing under the Terms, including the UK GDPR and the UK Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), the EU GDPR (Regulation 2016/679) and EU member state laws, the Swiss Federal Act on Data Protection, and US federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), each as amended or replaced.
• Output Data: personal data that DBEE supplies to Customer through Intent Leads: intent leads, Search results, identified website visitors, and the contact, company and signal fields that come with them, plus samples and re-downloads of them. Output Data comes from DBEE's licensed data providers (see the Data Sources Statement at https://intentleads.si/data-sources).
• Customer Data: personal data that Customer, or its users, put into Intent Leads (such as exclusion and company lists) and that DBEE processes on Customer's behalf. Annex I, Part A lists it.
• Pixel Data: the page-visit events the Intent Leads website snippet collects from browsers visiting Customer's websites. Part C covers it.
• Account Data: names, emails, login and billing details of Customer's users, which DBEE processes as a controller under its Privacy Policy (https://intentleads.si/privacy) to run the account. Account Data is outside Part A of this Schedule.
• Sub-processor: a third party DBEE engages that processes Customer Data.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data or Output Data while in DBEE's systems.
• controller, processor, data subject, personal data, processing, supervisory authority, business, service provider, third party, sell and share have the meanings given in the applicable Data Protection Law.

2. Roles

2.1 Customer Data. For Customer Data, Customer is the controller (or a processor acting for its own client, who is then the controller) and DBEE is Customer's processor and, under the CCPA, its service provider. Part A applies.

2.2 Output Data. For Output Data, DBEE and Customer are each an independent controller. Neither processes Output Data on the other's behalf, and they are not joint controllers. Under the CCPA, DBEE sells Output Data to Customer as a third party. Part B applies.

2.3 Website visitors. When Customer puts the Intent Leads snippet on a website, Customer and DBEE are joint controllers of the collection of page-visit events from that website's visitors and their transmission to DBEE (the "Collection"), because Customer decides to embed the snippet and DBEE provides it. After the Collection, DBEE processes the events as an independent controller to identify US visitors and deliver them to Customer, and the identity and contact details returned for an identified visitor are Output Data. Part C sets out each party's responsibilities.

2.4 Customer's clients. Where Customer uses Intent Leads for its own clients (for example in a client workspace), Customer acts for those clients and is responsible for having the authority to give DBEE instructions for them. A workspace transferred to a client under the Terms takes this Schedule with it unless the client signs its own.

Part A: DBEE as processor

3. Processing on instructions

3.1 DBEE processes Customer Data only on Customer's documented instructions, unless a law DBEE is subject to requires otherwise; in that case DBEE tells Customer before processing, unless that law forbids telling it. The Terms, this Schedule and Customer's use of Intent Leads settings, API calls and support requests are Customer's complete instructions. Annex I, Part A describes the processing.

3.2 DBEE tells Customer promptly if it believes an instruction breaks Data Protection Law. DBEE need not follow that instruction while the parties resolve it.

3.3 CCPA. As a service provider, DBEE will not: (a) sell or share Customer Data; (b) retain, use or disclose it for any purpose other than the business purposes set out in Annex I, or outside the direct business relationship with Customer; or (c) combine it with personal data DBEE receives from or for anyone else, or collects itself, except as the CCPA allows a service provider to do (for example to detect security incidents, or to apply Customer's exclusions and suppressions before Customer is charged). DBEE will comply with the CCPA as it applies to service providers, give Customer the same level of privacy protection the CCPA requires, and tell Customer if it can no longer meet these obligations. Customer may take reasonable and appropriate steps to stop and remedy unauthorized use of Customer Data. DBEE certifies that it understands these restrictions.

4. Confidentiality and security

4.1 DBEE ensures that everyone it authorizes to process Customer Data is bound by a duty of confidentiality.

4.2 DBEE maintains the technical and organizational measures in Annex II (the Information Security Addendum at https://intentleads.si/compliance). DBEE may change them, but not in a way that materially lowers the protection of Customer Data.

5. Sub-processors

5.1 Customer gives DBEE general authorization to use the Sub-processors listed in Annex III and at https://intentleads.si/subprocessors.

5.2 DBEE gives Customer at least 15 days' notice (by email to Customer's organization owners, and on that page) before adding or replacing a Sub-processor. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If they can't resolve it, Customer may stop using the part of Intent Leads that depends on the new Sub-processor, or end the Terms, and DBEE refunds any unused prepaid balance for the stopped part.

5.3 DBEE puts each Sub-processor under a written contract with data protection obligations no less protective than this Part A, to the extent they apply to the service it provides. DBEE stays responsible to Customer for its Sub-processors' performance of those obligations.

6. Help with data subjects, assessments and breaches

6.1 Data subject requests. Taking into account the nature of the processing, DBEE helps Customer, by appropriate technical and organizational measures, to answer requests from data subjects to exercise their rights over Customer Data. If DBEE receives such a request directly, it passes it to Customer within 3 business days and does not answer it except on Customer's instruction or where the law requires.

6.2 Assessments. DBEE gives Customer the information it reasonably needs, and that DBEE has, for data protection impact assessments, legitimate interests assessments, transfer risk assessments and prior consultations with a supervisory authority, about Customer's use of Intent Leads.

6.3 Personal Data Breach. DBEE notifies Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Data, Pixel Data or Output Data in DBEE's systems. The notice says, as far as then known, what happened, the categories and approximate numbers of data subjects and records, the likely consequences, and what DBEE has done or proposes to do. DBEE adds information as it learns it, takes reasonable steps to contain and remedy the breach, and does not name Customer in any public statement about it without Customer's consent unless the law requires. A notice is not an admission of fault.

7. Deletion, audits and records

7.1 Deletion. Within 30 days after the Terms end, or earlier when Customer deletes a workspace or asks DBEE in writing, DBEE deletes Customer Data from its own systems, unless the law requires DBEE to keep it, and instructs its Sub-processors to delete it. Copies in backups are deleted when those backups expire in their normal cycle and are not restored in the meantime except for disaster recovery. DBEE's data providers delete website visit data within 90 days of DBEE's request, and keep raw visit data for no more than 13 months from collection in any case. Customer can export its data from the dashboard or API at any time before deletion.

7.2 Information and audits. DBEE makes available to Customer the information reasonably needed to show compliance with this Schedule. Once a year (and after any Personal Data Breach), on request, DBEE will: (a) answer Customer's reasonable written security and privacy questionnaire; and (b) provide its current Information Security Addendum and Sub-processor list. If that is not enough to show compliance, or a supervisory authority requires it, Customer (or an independent auditor bound by confidentiality and not a competitor of DBEE) may audit DBEE's processing of Customer Data, on at least 30 days' written notice, during business hours, at Customer's cost, no more than once in 12 months (except after a Personal Data Breach or at a regulator's request), and without access to other customers' data or to DBEE's data providers' systems.

7.3 Records. DBEE keeps the records of processing that Data Protection Law requires of a processor.

Part B: Output Data (independent controllers)

8. Each party's duties

8.1 Both parties comply with Data Protection Law as independent controllers for their own processing of Output Data, and each is responsible for its own notices, lawful basis, records, security and answers to data subject requests.

8.2 DBEE:

• (a) gets Output Data only from data providers that are contractually bound to comply with applicable law, and supplies only data about business people located in the United States; DBEE does not identify website visitors located in the UK, the EEA or Switzerland, or browsers that send the Global Privacy Control signal;
• (b) applies the opt-out and deletion requests it and its data providerss receive (including through California's Delete Request and Opt-out Platform) before Output Data is supplied, and passes on removal notices as section 8.4 describes;
• (c) does not knowingly supply special category data, criminal offence data, or data about children under 16, refuses custom intent topics that would reveal an individual's health, religion, sexual life or orientation, political opinion, union membership, racial or ethnic origin, or financial hardship, and removes any such topic from Intent Leads when it becomes aware of it;
• (d) gives Customer the information about the sources and nature of Output Data it needs for its own transparency duties, as set out in the Data Sources Statement, and keeps it up to date;
• (e) keeps a record of what Output Data it supplied to Customer and when, so that removal notices can be matched.

8.3 Customer:

• (a) uses Output Data only for business-to-business sales and marketing, for itself and for its clients as the Terms allow, and not for any purpose the Terms forbid (including decisions on credit, insurance, employment or housing, and building a competing data product);
• (b) has its own lawful basis for its processing of Output Data (for business-to-business outreach this is usually legitimate interests, supported by a documented assessment), and gives data subjects the information Article 14 of the UK GDPR requires, including the source of the data, within the time it requires;
• (c) complies with the marketing rules that apply to each contact it makes, including PECR (which generally requires prior consent for marketing email to an individual's personal address), CAN-SPAM, the TCPA and do-not-call rules (the do-not-call flags DBEE supplies are informational and do not replace Customer's own checks), and state telemarketing laws;
• (d) honors opt-outs it receives and does not re-contact people who have opted out;
• (e) never mentions in outreach that a person was identified through their reading activity or a website visit;
• (f) keeps Output Data secure with measures appropriate to the risk, and keeps it only as long as it needs it for the permitted purpose;
• (g) gives Output Data only to clients that are bound by the Terms as the Terms require, and is responsible for those clients' compliance.

8.4 Removals. When DBEE processes a removal notice for a person supplied to Customer, DBEE tells Customer through the dashboard, the API (GET /api/v1/suppressions), the removals webhook and email. Customer deletes or suppresses that person in its systems, and has its clients do the same, within 10 business days of DBEE's notice.

8.5 Data subject requests about Output Data. Each party answers requests made to it. If a request also needs the other party to act (for example a deletion or opt-out request that should reach DBEE and its data providerss, or a request about Customer's own outreach), the party that received it passes it to the other within 5 business days. Customer sends these to privacy@intentleads.si. DBEE passes deletion and opt-out requests on to its data providerss.

8.6 Breaches. Each party tells the other without undue delay, and in any case within 72 hours, after becoming aware of a breach of security affecting Output Data that the other party may need to act on.

8.7 CCPA terms for sold data. Customer: (a) uses Output Data only for the limited and specified purposes in section 8.3(a); (b) complies with the CCPA and gives the personal information the same level of privacy protection the CCPA requires of businesses; (c) gives DBEE the right to take reasonable and appropriate steps to ensure Customer uses it consistently with DBEE's CCPA obligations; (d) tells DBEE if it can no longer meet its CCPA obligations; and (e) gives DBEE the right, on notice, to take reasonable and appropriate steps to stop and remedy unauthorized use, including suspension under the Terms.

8.8 Data providers. DBEE's data providers are intended third-party beneficiaries of sections 8.3 and 8.4, as the Terms provide.

Part C: Website visitor ID (joint controllers for the Collection)

8A. Responsibilities

8A.1 This Part C is the arrangement between joint controllers that Article 26 of the UK GDPR and the EU GDPR requires for the Collection.

8A.2 Customer is responsible for:

• (a) deciding which websites and pages run the snippet, and keeping it off the pages the Cookie Consent requirements (https://intentleads.si/cookie-consent) exclude;
• (b) giving visitors the information Articles 13 and 14 require about the Collection, in its website privacy notice, naming Intent Leads (DBEE, Inc.) as a third party and linking to DBEE's Privacy Policy;
• (c) obtaining any consent the law requires before the snippet loads (under PECR and the EU ePrivacy rules this means prior opt-in consent, which Customer must obtain for every visitor where the website is operated from the UK or the EEA, and for UK, EEA and Swiss visitors in any case), recording it, and loading the snippet only when it has been given;
• (d) honoring opt-outs on its website, including the Global Privacy Control signal and any "Do Not Sell or Share" choice;
• (e) following the Cookie Consent requirements (https://intentleads.si/cookie-consent), which form part of this Schedule.

8A.3 DBEE is responsible for:

• (a) processing the events only to identify visitors located in the United States, deliver them to Customer, bill, secure the service and comply with law, and not identifying visitors located in the UK, the EEA or Switzerland or browsers that send the Global Privacy Control signal;
• (b) the security of the events once received (Annex II), and keeping raw visit data for no more than 13 months;
• (c) answering data subject requests about the identification, and making the essence of this arrangement available in its Privacy Policy;
• (d) telling Customer if it changes how the snippet collects data in a way that affects Customer's notice or consent.

8A.4 DBEE's data providers provide the identification technology and, as their own controllers, may use visit events to keep their identity data accurate. Customer's notice must cover this (the suggested wording in the Cookie Consent requirements (https://intentleads.si/cookie-consent) does).

8A.5 Data subjects may exercise their rights against either party. Each party passes requests that concern the other within 5 business days. DBEE is the contact point for data subjects about the identification: privacy@intentleads.si.

8A.6 Each party is responsible for its own breaches of this Part C, and section 10.1 applies.

9. International transfers

9.1 Output Data is US data supplied by a US company. Its supply to Customer in the UK is not a restricted transfer under the UK GDPR. If Customer transfers Output Data out of the UK or the EEA itself, it is responsible for that transfer.

9.2 Customer Data and Pixel Data. DBEE is a US company. It stores Customer Data in the EU (Netherlands) and accesses it from outside the UK and EEA, and its data providers process Pixel Data in the United States. To the extent their transfer to DBEE is a restricted transfer:

• (a) from the EEA, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 ("EU SCCs") apply and are incorporated by reference: Module Two (controller to processor) for Customer Data, or Module Three (processor to processor) where Customer is itself a processor; and Module One (controller to controller) for Pixel Data under Part C. In each case: Clause 7 (docking) is included; for Modules Two and Three, Clause 9 Option 2 (general authorization) applies with the notice period in section 5.2; Clause 11's optional wording is omitted; Clauses 17 and 18 are governed by, and subject to the courts of, Ireland; and Annexes I to III of this Schedule are the Annexes of the EU SCCs;
• (b) from the UK, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022, as amended) ("UK Addendum") applies and is incorporated by reference, completed as set out in Annex IV;
• (c) from Switzerland, the EU SCCs apply as in (a) with references to the GDPR read as references to the Swiss FADP, the Swiss FDPIC as the competent supervisory authority for transfers under the FADP, and "member state" not read to exclude Swiss data subjects from suing where they habitually reside.

9.3 If a transfer mechanism in section 9.2 is invalidated or replaced, or if DBEE certifies under the EU-US Data Privacy Framework and its UK Extension (in which case DBEE may rely on that certification instead), the parties will work together in good faith to put in place a lawful replacement.

9.4 DBEE has assessed the transfers under section 9.2 and will share its transfer risk assessment summary (Annex IV, Part 3) on request.

10. General

10.1 Liability. Each party's liability under this Schedule is subject to the limitations and exclusions in the Terms, except that nothing limits a party's liability to data subjects under the Transfer Clauses, or any liability that cannot be limited by law.

10.2 Changes. DBEE may update this Schedule if Data Protection Law or a regulator's guidance requires it, or to add protection, and tells Customer at least 30 days before an update takes effect. An update cannot reduce the protection of Customer Data. Customer may end the Terms if an update materially harms it.

10.3 Governing law. This Schedule follows the governing law and jurisdiction of the Terms, except where Data Protection Law or the Transfer Clauses require otherwise.

10.4 Contact. Data protection questions and notices: privacy@intentleads.si. DBEE's contact for this Schedule: Nick Tomic, privacy@intentleads.si.

Parties and acceptance

The parties to this Schedule are DBEE (whose details are at the top of this DPA) and Customer, as identified in its Intent Leads account and in any legal details it gives in the dashboard under Settings → Legal. Customer accepts this Schedule, with the rest of this DPA, when it accepts the Terms. Each party agrees that this acceptance is a valid electronic signature and makes this Schedule, including the Transfer Clauses, binding, as Part 1 of the UK Addendum allows ("in any way that makes them legally binding"). An executed copy with Customer's details and the acceptance record is available in Settings → Legal.

Annex I: Description of the processing

Part A: Customer Data (DBEE as processor)

Part B: Output Data (independent controllers)

Part C: Pixel Data (joint controllers for the Collection, then DBEE as independent controller)

Annex II: Technical and organizational measures

The Information Security Addendum at https://intentleads.si/compliance (version 2026-11-11) forms this Annex. In summary:

• Hosting: the Intent Leads application, database and authentication run on Railway in its EU West region (Netherlands). Payment data is held by Stripe (US). DBEE's data providers process Pixel Data in the United States.
• Encryption and hashing: HTTPS for every connection; API keys and invite tokens stored only as SHA-256 hashes; emails and LinkedIn profiles in exclusion lists stored only as SHA-256 hashes.
• Access: database access denied to all client roles; server-only access scoped to the caller's organization and workspace; access to production limited to the personnel who need it.
• Keys and webhooks: standard and admin API keys, shown once, rotatable and revocable; webhooks signed (Standard Webhooks, HMAC-SHA256), public HTTPS endpoints only, private-network targets refused.
• Logging: audit trail of key, user, role and setting changes, visible to the customer.
• Incident response: written incident response plan; breach notice within 48 hours (section 6.3).
• Assurance: no SOC 2 or ISO 27001 certification today; security questionnaires answered on request.

Annex III: Sub-processors

The current list is at https://intentleads.si/subprocessors and, on the date of this Schedule, is:

DBEE's data providers also act as independent controllers of the Output Data they supply (see Part B).

Annex IV: UK Addendum and transfer risk assessment

Part 1: UK Addendum tables

• Table 1 (Parties): the exporter is Customer and the importer is DBEE, with the details in Customer's account, in Settings → Legal and in Annex I. Start date: the date Customer accepts the Terms.
• Table 2 (Selected SCCs, Modules and Clauses): the Approved EU SCCs, including the Appendix Information, with only the Module, clauses and optional provisions selected in section 9.2(a) of this Schedule.
• Table 3 (Appendix Information): Annex 1A (list of parties) and 1B (description of transfer): Annex I of this Schedule. Annex II (technical and organizational measures): Annex II of this Schedule. Annex III (list of sub-processors): Annex III of this Schedule.
• Table 4 (Ending this Addendum when the Approved Addendum changes): neither party.

Part 2: Mandatory clauses

Part 2 (Mandatory Clauses) of the Approved Addendum, being the template Addendum B1.0 issued by the ICO and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses.

Part 3: Transfer risk assessment (summary)

• What is transferred: Customer Data (mostly hashed emails and LinkedIn profiles, company domains and company LinkedIn pages, and settings) and Pixel Data. No special category data. Low sensitivity: business contact data, largely pseudonymized.
• Where: the Intent Leads database is in the EU (Netherlands); DBEE (a US company) and its data providers access and process it from outside the UK and EEA, including in the United States.
• Laws of the destination: US surveillance law (FISA section 702 and Executive Order 12333) could in theory reach US providers. DBEE has received no government request for customer data. The data is of low intelligence interest, and Executive Order 14086 and the Data Protection Review Court give UK and EU individuals redress. The UK has found the US adequate for organizations certified under the UK Extension to the EU-US Data Privacy Framework; DBEE is not certified today.
• Safeguards: the EU SCCs and UK Addendum in section 9; encryption in transit; SHA-256 hashing of uploaded personal identifiers; access limited to the personnel who need it; the measures in Annex II.
• Commitments: DBEE will challenge any government request it receives for Customer Data where it has grounds to, disclose the minimum required, and tell Customer unless prohibited.
• Conclusion: with these safeguards, the protection of Customer Data is not materially lower than under the UK GDPR (the UK "data protection test"), and the EU SCCs provide appropriate safeguards for the EU GDPR.