Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the TopReach Terms of Service between Inkris Technologies Inc. ("TopReach", "we" or "us") and the customer that accepted them ("Customer" or "you"). It takes effect automatically when you accept the Terms, so you don't need to sign it. If you need a countersigned copy for your records, email support@gettopreach.com.

This DPA applies when we process Customer Personal Data for you. If it conflicts with the Terms, this DPA controls for the processing of Customer Personal Data. Otherwise, the Terms apply, including their limits on liability. Words defined in the Terms mean the same thing here.

In this DPA:

• "Customer Personal Data" means personal information in Customer Data that we process for you, such as your contacts' details, call recordings, texts, voicemails and emails.
• "Data Protection Laws" means the privacy and data protection laws that apply to the processing of Customer Personal Data. Depending on the situation, they may include PIPEDA, Canadian provincial privacy laws including Quebec's Law 25, US state privacy laws such as the California Consumer Privacy Act, and the GDPR and UK GDPR.
• "Security Incident" means a breach of security that results in the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Customer Personal Data in our systems. It doesn't include unsuccessful attempts that don't compromise Customer Personal Data, such as pings, port scans or failed sign-in attempts.
• "Sub-processor" means a third party we engage that processes Customer Personal Data.
• "Controller", "processor", "business", "service provider", "personal information" and "processing" have the meanings given in Data Protection Laws.

You are the controller (or "business") of Customer Personal Data. We are your processor (or "service provider").

We are an independent controller of personal information about your account owners and users, and of the records we keep for our own legitimate purposes, such as billing, security, preventing fraud and abuse, meeting carrier and legal requirements and responding to tracebacks. Our Privacy Policy covers that information, and this DPA doesn't apply to it.

You are responsible for:

• having a lawful basis, giving the notices and getting the consents that Data Protection Laws and communications laws require for us to process Customer Personal Data, including consent to calls, texts, emails and call recording;
• making sure your instructions to us comply with the law;
• the accuracy and quality of Customer Personal Data and how you use the Services;
• not giving us the sensitive information section 12.4 of the Terms prohibits;
• handling requests from individuals and regulators about Customer Personal Data, with our help as section 10 describes;
• keeping your account credentials and API keys secure.

Our processing rules

• We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, how you use and configure the Services (including your settings, automations and API requests), and any other written instructions we agree to.
• We may also process Customer Personal Data where the law requires us to. If so, we'll tell you first unless the law prohibits it.
• We'll tell you if we believe an instruction breaks Data Protection Laws, and we may decline to follow it. We don't have to review your instructions for legal compliance.
• Annex A sets out the details of the processing.

Where the California Consumer Privacy Act or a similar US state law applies, we will:

Service provider terms

• not sell or share Customer Personal Data, as those laws define selling and sharing;
• not keep, use or disclose Customer Personal Data for any purpose other than the business purposes in the Terms and this DPA, or outside our direct business relationship with you, except as those laws allow;
• not combine Customer Personal Data with personal information we get from others, except as those laws allow;
• comply with those laws and give Customer Personal Data the level of privacy protection they require;
• tell you if we can no longer meet our obligations under those laws;
• let you take reasonable steps to stop and fix any unauthorized use of Customer Personal Data.

Our business purposes are providing, maintaining, securing and supporting the Services; detecting and preventing security incidents, fraud, spam and illegal activity; fixing errors; and improving the Services, as those laws allow.

Everyone who processes Customer Personal Data for us, including our staff and contractors, is bound by a duty of confidentiality and gets access only as their work requires.

We implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the nature of the data and the risks of the processing. They include the measures in Annex B. We may update our measures, as long as we don't materially reduce the overall level of protection.

9.1 Authorization

9.2 Our obligations

9.3 Notice of new Sub-processors

9.4 Objections

9.5 Carriers

If we receive a request from an individual about Customer Personal Data, we'll tell them to contact you or forward the request to you. We won't respond to it ourselves except as the law requires.

You can use the features of the Services to access, correct, export and delete Customer Personal Data. If you need more help to respond to a request, we'll give reasonable help. We may charge for help beyond what those features provide.

Based on the information available to us, we'll give you reasonable information to help you carry out privacy impact assessments (including the assessments Quebec law requires for transfers outside Quebec), data protection impact assessments and consultations with regulators about the Services. We may charge for help beyond the documentation we make generally available.

If a Security Incident happens:

• We'll notify you without undue delay after we confirm a Security Incident affecting Customer Personal Data.
• Our notice will describe, as far as we know at the time, what happened, the data and individuals affected, the likely consequences, and what we've done or plan to do. We'll update you as we learn more.
• We'll take reasonable steps to contain the incident, fix its cause and reduce its harm.
• We'll send notices to the account owner's email address.
• You decide whether to notify regulators and individuals, and you're responsible for doing so, unless the law requires us to. We'll give you reasonable help.
• Our notice or response isn't an admission of fault or liability.

When your subscription ends, you can export Customer Personal Data during the export window in section 30 of the Terms. After that, we'll delete it as the Terms describe, including from backups as they expire in our normal cycle, unless the law requires us to keep it. We'll keep any data we must retain confidential and process it only for the purpose the law requires. On request, we'll confirm the deletion in writing.

14.1 Information on request

14.2 Audits

14.3 Sub-processors

We and our Sub-processors process Customer Personal Data in Canada, the United States and other countries where they operate. We'll protect transferred data as this DPA requires.

For data about people in Quebec, we'll give you the information you reasonably need for your assessment of transfers outside Quebec.

If the data protection laws of the European Economic Area, the United Kingdom or Switzerland apply to a transfer to a country without an adequacy decision, the parties will rely on the European Commission's standard contractual clauses, with the UK Addendum where relevant. We'll sign them with you on request.

Each party's liability under this DPA is subject to the limits and exclusions of liability in the Terms. This DPA doesn't create a separate or additional cap.

This DPA lasts as long as we process Customer Personal Data. Its obligations continue until that data is deleted.

Our measures include:

• Encryption of data in transit over public networks, and encryption of stored data using our cloud providers' encryption at rest.
• Role-based access controls and least-privilege access for staff, with access removed promptly when it's no longer needed.
• Strong authentication for staff access to production systems.
• Logical separation of each customer's data.
• Logging and monitoring of access to production systems.
• Regular backups, with restore procedures.
• Patching and vulnerability management for our systems and software dependencies.
• Secure storage of credentials and secrets.
• Confidentiality obligations and security awareness for staff.
• Security reviews of, and data protection terms with, Sub-processors.
• Incident response procedures.
• Secure development practices, including code review before release.