Data Processing Addendum

This Addendum governs the processing of personal data contained in Client Data and Lead Data. It applies whenever TalkToLeads processes personal data on the Client’s behalf in the course of providing the Services.

Where this Addendum conflicts with the Terms of Service on the subject of data protection, this Addendum is intended to take precedence — subject to section 16.

• The Client is usually the Controller / Data Fiduciary in respect of Lead Data.
• TalkToLeads is usually the Processor / Data Processor in respect of that data.
• Roles may differ depending on applicable law and the actual processing carried out in a given case.
• The Client remains responsible for instructions, customer notices, legal grounds for processing, and responding to data-subject requests, unless the parties agree otherwise in writing.

Subject matter: lead response, qualification, routing, human handoff, follow-up, maintenance, support, reporting and troubleshooting.

Duration: the term of the Services, plus the closure and deletion period described in section 13, plus any period for which retention is required by law.

• Configuring and operating Workflows.
• Receiving, storing and processing enquiry data.
• Sending communications according to Client instructions.
• Routing and handing off conversations to Client personnel.
• Monitoring Workflow health.
• Generating operational reports.
• Providing support and troubleshooting.
• Preventing abuse and security incidents.

• Lead name and contact data (name, phone, email, messaging identifier).
• Enquiry details and message content.
• Location, budget, timeline and stated business needs.
• Consent and opt-out records.
• Technical and log data associated with the conversation.

• Prospects and enquirers.
• Existing customers of the Client.
• Website visitors to Client properties where a Workflow is connected.
• Buyers, sellers, tenants, renters and investors, for real-estate clients.
• Project prospects, for interior design and architecture clients.
• Borrowers and loan prospects, for mortgage and loan-advisory clients.
• Client employees and business contacts.
• Other individuals as instructed by the Client.

• TalkToLeads processes personal data only on the Client’s documented instructions, including as set out in this Addendum, the Order, and the agreed Workflow configuration.
• If TalkToLeads believes an instruction infringes applicable law, it will inform the Client where legally permitted, and may pause the affected processing.
• The Client warrants that it has all rights, permissions and legal bases necessary for the processing it instructs, and for the data it provides.

• Personnel authorised to process Client Data are bound by confidentiality obligations.
• Access is granted on a least-privilege basis and only to personnel who need it to deliver the Services.
• Access is removed when it is no longer required.

TalkToLeads uses reasonable technical and organisational safeguards designed to protect personal data. The specific measures are set out in Annex 2.

• The Client authorises TalkToLeads to engage the subprocessors necessary to provide the Services. The current list is published at Subprocessors and reproduced in Annex 3.
• Where required by law or by contract, TalkToLeads will give notice of material subprocessor changes before they take effect.
• The Client may object to a new subprocessor on reasonable data-protection grounds under the process at [INSERT OBJECTION WINDOW AND PROCESS].
• TalkToLeads remains responsible for its subprocessors’ performance of the applicable obligations, to the extent required by applicable law and the agreement.

Taking into account the nature of the processing and the information available to us, TalkToLeads will provide reasonable assistance with:

• Responding to data-subject rights requests relating to Lead Data we process for the Client.
• Data protection impact assessments and prior consultations, where applicable law requires them.
• Regulatory queries relating to the processing we perform.
• Providing security information reasonably necessary to demonstrate compliance.

Assistance that falls outside the standard scope of the Services, or that requires significant engineering effort, may be chargeable at rates agreed in advance.

• TalkToLeads will notify the Client without undue delay after becoming aware of a confirmed personal data breach affecting Client Data.
• The notification will include the information reasonably available at the time, and will be updated as the investigation progresses.
• TalkToLeads will take reasonable steps to contain and remediate the breach, and will cooperate with the Client’s reasonable investigation.
• Unless applicable law or the agreement provides otherwise, the Client remains responsible for notifications to regulators and affected individuals.

• On termination of the Services, or on documented request, TalkToLeads will return and/or delete Client Data within 30 days, unless retention is required by applicable law or by legitimate backup and security constraints.
• Backup copies are deleted or overwritten on our standard backup cycle rather than immediately.
• The Client is responsible for exporting any data it needs before the closure window ends. We will confirm the closure date in writing.
• On request, TalkToLeads will confirm deletion in writing where operationally feasible.

• TalkToLeads will make available information reasonably necessary to demonstrate compliance with this Addendum.
• Requests are handled first through documentary and remote means — written responses, security questionnaires, and available reports.
• An on-site audit may be considered where documentary means are genuinely insufficient, subject to [INSERT NOTICE PERIOD, FREQUENCY LIMIT, SCOPE, CONFIDENTIALITY AND COST-ALLOCATION TERMS].
• Audit rights are subject to confidentiality, the security of other clients’ data, and reasonable limits on frequency and cost.

Primary storage is in Japan and hosting is in the United States. The database and authentication run on Supabase in AWS ap-northeast-1 (Tokyo); the application runs on Vercel in the United States. Client Data and Lead Data are therefore processed outside the country in which they were collected for every Client we currently serve.

Where applicable law requires a transfer mechanism, appropriate safeguards will be put in place.

Liability under this Addendum is intended to be governed by the limitation of liability in the Terms of Service. Where this Addendum and the Terms conflict on data protection, this Addendum is intended to prevail.

The authoritative, continuously maintained list is published at Subprocessors. That page is incorporated into this Annex by reference, including provider name, service, purpose, data categories and status.

A provider marked *planned*, *optional* or *client-selected* on that page is not an active subprocessor for a given Client unless that Client has selected it or been notified of it.

Subprocessor objections and DPA queries can also be raised through the privacy and requests page.