Data Processing Agreement

Effective date: 28 September 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between Klovis Technologies Ltd, company number 17296963, 434-436 Liverpool Road, London, N7 8NL, United Kingdom ("Klovis", the "Processor"), and the Customer (the "Controller"). It applies whenever Klovis processes personal data on the Customer's behalf in providing the Service. If this DPA and the Terms conflict on data protection, this DPA wins.

1. Definitions

• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (each as amended, including by the Data (Use and Access) Act 2025), and, where it applies to the Customer's processing, the EU GDPR (Regulation (EU) 2016/679).
• Customer Personal Data means personal data in Customer Data (as defined in the Terms) that Klovis processes on the Customer's behalf.
• Sub-processor means a third party Klovis engages to process Customer Personal Data.
• Personal Data Breach, controller, processor, data subject and processing have the meanings given in the UK GDPR.

2. Roles

The Customer is the controller and Klovis is the processor of Customer Personal Data. The Customer is responsible for having a lawful basis for the processing, for giving data subjects the information the law requires, and for the lawfulness of its instructions.

Klovis is a controller, not a processor, for data about the Customer's own account, Users and billing, which is covered by the Klovis Privacy Policy.

3. Klovis's obligations

Klovis will:

1. Instructions. Process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country. The Terms, this DPA and the Customer's use and configuration of the Service are those instructions. If the law requires Klovis to process the data otherwise, Klovis will tell the Customer first, unless the law forbids it. Klovis will tell the Customer straight away if it believes an instruction breaks Data Protection Law.
2. Confidentiality. Make sure everyone authorised to process Customer Personal Data is under a duty of confidentiality.
3. Security. Implement the technical and organisational measures in Annex 2.
4. Sub-processors. Follow section 4.
5. Data subject requests. Taking into account the nature of the processing, help the Customer respond to requests from data subjects, mainly through the Service's own features for finding, exporting, correcting and deleting records. If Klovis receives a request directly, it will pass it to the Customer and will not respond itself, except to direct the person to the Customer.
6. Assistance. Help the Customer, as reasonably needed, with security, breach notification, data protection impact assessments and consultation with regulators, taking into account the information available to Klovis.
7. Breaches. Notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Klovis will give the information the Customer reasonably needs to meet its own obligations, as it becomes available, and take reasonable steps to contain the breach.
8. Return or deletion. When the Terms end, at the Customer's choice, return Customer Personal Data (by providing an export) or delete it, within the periods set out in section 9 of the Terms, unless the law requires Klovis to keep it.
9. Audits. Make available the information reasonably needed to show compliance with this DPA, and allow and contribute to audits and inspections by the Customer or an independent auditor it appoints. Klovis may first answer by providing written information, questionnaire responses or third-party certifications. If that information does not reasonably show compliance, the Customer may go ahead with the audit. Audits need at least 30 days' written notice (unless a regulator requires less, or after a Personal Data Breach), may take place no more than once in any 12 months (with the same exceptions), must happen during business hours, must be carried out by people bound by confidentiality, and are at the Customer's cost.

4. Sub-processors

The Customer gives general authorisation for Klovis to use Sub-processors. The current list is in Annex 3.

Klovis will:

• impose data protection obligations on each Sub-processor that are no less protective than this DPA;
• remain responsible to the Customer for its Sub-processors' performance;
• give the Customer at least 30 days' notice, by email to the workspace owner, before adding or replacing a Sub-processor.

The Customer may object on reasonable data protection grounds within that notice period. If the parties cannot resolve the objection, the Customer may cancel the affected part of the Service and receive a refund of fees prepaid for the unused period.

5. International transfers

Klovis and its Sub-processors may process Customer Personal Data outside the UK and the European Economic Area, including by remote access. Where a transfer is to a country without an adequacy decision, Klovis will make sure an approved safeguard is in place: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses (for transfers subject to the EU GDPR), or a certification under the EU-US Data Privacy Framework and its UK Extension.

6. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms.

7. Duration

This DPA lasts for as long as Klovis processes Customer Personal Data.

Annex 1: Details of processing

Subject matter and purpose. Providing the Service: a CRM and multi-channel outreach platform, with a unified inbox, campaigns, workflows, calendar and booking pages, website chat and help centres, and an API and agent endpoint.

Duration. The term of the Terms, plus the export and deletion periods in the Terms.

Nature of processing. Storing, organising, syncing, displaying, searching, sending, receiving, exporting and deleting data, as directed by the Customer's use of the Service.

Data subjects.

• The Customer's contacts, prospects, leads and customers.
• People who message, email or chat with the Customer through connected accounts or the website chat widget.
• Visitors to the Customer's website where the chat widget is installed, and to the Customer's help centre.
• People who book meetings through the Customer's booking pages.
• People on the Customer's suppression list.

Categories of personal data.

• Identity and contact details: name, job title, company, email address, phone number, and social media profile links and identifiers (such as LinkedIn and WhatsApp IDs).
• Profile photos copied from connected platforms.
• Message and conversation content, attachments, chat files and notes.
• Campaign and activity history, tags, deals and tasks.
• Meeting booking details.
• Website chat visitor data: name and email if given, pages viewed, referrer and campaign parameters, browser, device, language, time zone and country. The widget does not store IP addresses.
• Help centre views and searches.
• Email engagement data (opens and clicks, with IP address and device information) where the Customer switches on email tracking, and visits linked to personalised tracked links.
• Error reports and masked session recordings from booking pages and help centres.
• Opt-out and suppression records.

Special category data. None intended. The Customer must not submit special category data unless agreed in writing.

Annex 2: Security measures

• Encryption of data in transit (TLS), and encryption at rest by our database and file storage providers.
• Logical separation of each customer's data, enforced by database row-level security.
• Passwords and API keys stored only as one-way hashes.
• Klovis never stores passwords for connected messaging accounts. Those connections are held by our connectivity provider.
• Role-based access to workspaces, with scoped permission levels for API keys and AI agents. The Customer chooses whether an agent may delete or archive records directly or must ask for approval.
• Malware scanning of files uploaded and sent through website chat.
• Error monitoring configured to minimise personal data, and session recordings that mask all on-screen text, inputs and media.
• Audit logging of significant workspace actions and API-key changes, and recording of sign-in sessions with IP address and browser.
• Automatic deletion of technical logs and browsing data after set periods.
• Staff access to production data limited to what is needed to operate and support the Service.
• Regular updating of software dependencies and security patches.
• Point-in-time recovery of the database managed by our database provider.
• Regular review of these measures.

Annex 3: Sub-processors