Data Processing Addendum

1. Scope & Applicability

This Data Processing Addendum (“DPA”) supplements the MarketingOS Terms of Service and applies whenever the Client (the “Controller”) instructs MarketingOS (the “Processor”) to process personal data on its behalf. In the event of a conflict, this DPA prevails over the Terms of Service with respect to data processing matters.

2. Definitions

“Personal Data” means any information relating to an identified or identifiable natural person, including lead names, email addresses, phone numbers, and any other contact data imported into MarketingOS.

“Processing” means any operation performed on Personal Data, including collection, storage, retrieval, use, and deletion.

3. Processor Obligations

The Processor shall: (a) process Personal Data only on documented instructions from the Controller; (b) ensure that persons authorized to process Personal Data are bound by confidentiality obligations; (c) implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk; (d) assist the Controller in fulfilling data-subject rights requests; and (e) delete or return all Personal Data upon termination of the service agreement, at the Controller's election.

4. Sub-Processors

The Processor may engage sub-processors to assist in providing the Service. The Processor will maintain a current list of sub-processors and will notify the Controller before adding or replacing a sub-processor, giving the Controller the opportunity to object. All sub-processors are bound by data protection obligations no less stringent than those in this DPA.

5. Data Export & Deletion

Upon the Controller's written request, the Processor will export the Controller's stored data in a machine-readable format (JSON). The Controller may also request permanent deletion of all stored data, which the Processor will complete within thirty (30) days of the request.

6. Security Measures

The Processor implements the following measures: encryption in transit (TLS 1.2+); encryption at rest; role-based access controls; regular vulnerability assessments; platform-admin-only access to raw personal data; and audit logging of data access operations.

7. Breach Notification

In the event of a Personal Data breach, the Processor will notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of the breach. The notification will include the nature of the breach, the categories and approximate number of records affected, and the measures taken or proposed to address the breach.

8. Audit Rights

The Controller may audit the Processor's compliance with this DPA upon reasonable notice (not less than 30 days). Audits shall be conducted during normal business hours and shall not unreasonably interfere with the Processor's operations. The Processor may satisfy this obligation by providing relevant third-party audit reports or certifications.

9. Term & Termination

This DPA remains in effect for the duration of the service agreement. Upon termination, the Processor will, at the Controller's election, return or delete all Personal Data in accordance with Section 5, and certify deletion in writing upon request.