Data Processing Addendum

1. Introduction

This Data Processing Addendum ("DPA") is incorporated into and forms part of the Sendbound Terms of Service (or other written agreement) between Sendbound, Inc. ("Sendbound," "Processor") and the Customer ("Controller"). Together, these are the "Agreement."

This DPA applies where and only to the extent that Sendbound processes Personal Data on behalf of the Customer in the course of providing the Services. It is intended to ensure compliance with Regulation (EU) 2016/679 (GDPR), the UK GDPR, the Swiss Federal Data Protection Act, the California Consumer Privacy Act (CCPA), and all other applicable data protection laws.

Enterprise customers may request a countersigned version of this DPA by contacting privacy@sendbound.com. By using the Services, you agree to the terms of this DPA as published.

2. Definitions

Capitalised terms not defined here have the meaning given in the Agreement or applicable data protection law.

• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Sendbound on behalf of the Customer.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Subject" means the individual to whom Personal Data relates.
• "Controller" means the Customer, who determines the purposes and means of Processing Personal Data.
• "Processor" means Sendbound, who processes Personal Data on behalf of and under the instructions of the Controller.
• "Subprocessor" means any third party engaged by Sendbound to assist in Processing Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the clauses approved by the European Commission for transfers of personal data to third countries (Commission Decision 2021/914/EU).
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

3. Scope and Role of the Parties

3.1 Controller Responsibilities

The Customer is the Controller of Personal Data submitted to the Services. The Customer warrants that: (a) it has a lawful basis to transfer Personal Data to Sendbound; (b) it has provided all required notices and obtained all required consents from Data Subjects; and (c) its instructions to Sendbound comply with applicable law.

3.2 Processor Responsibilities

Sendbound acts as a Processor and will only process Personal Data: (a) on documented instructions from the Customer; (b) as necessary to provide the Services; or (c) as required by applicable law. Sendbound will promptly notify the Customer if, in its opinion, an instruction infringes applicable data protection law.

3.3 Nature of Processing

Subject matter: Email delivery, API access, contact management, analytics, and related services as described in the Agreement. Duration: For the term of the Agreement plus any retention period described in Section 11. Purpose: Performance of the Services. Types of Personal Data: Email addresses, names, and any other data included in email content or contact lists submitted by the Customer. Categories of Data Subjects: End users and email recipients of the Customer.

4. Processing Instructions

Sendbound shall process Personal Data only on documented instructions from the Customer, including with regard to transfers of Personal Data to a third country, unless required by applicable law. In such cases, Sendbound shall, to the extent permitted by law, inform the Customer of that legal requirement before processing.

The Customer's instructions are set out in the Agreement and this DPA. The Customer may provide additional written instructions from time to time, and Sendbound shall comply provided such instructions are within the scope of the Agreement and technically feasible. Sendbound may charge for additional work required to comply with out-of-scope instructions.

Sendbound will ensure that persons authorised to process Personal Data are committed to confidentiality obligations and are trained on data protection requirements.

5. Security Measures

Sendbound shall implement and maintain appropriate technical and organisational security measures to protect Personal Data against Security Incidents. These measures include, at minimum:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256)
• Pseudonymisation and anonymisation where appropriate
• Ongoing confidentiality, integrity, availability, and resilience of processing systems
• Ability to restore availability and access to Personal Data in a timely manner after an incident
• Regular testing, assessing, and evaluating of technical and organisational measures (including annual penetration testing)
• Role-based access controls and least-privilege principles
• Multi-factor authentication for all administrative access to production systems
• SOC 2 Type II certification — available upon request under NDA

Sendbound will, upon request, make available information reasonably necessary for the Customer to verify compliance with this Section, subject to confidentiality restrictions.

6. Subprocessors

6.1 General Authorisation

The Customer provides general authorisation for Sendbound to engage Subprocessors to assist in providing the Services. Sendbound will: (a) enter into a written agreement with each Subprocessor imposing equivalent data protection obligations as this DPA; and (b) remain liable to the Customer for the acts or omissions of its Subprocessors.

6.2 Current Subprocessors

Sendbound's current Subprocessors include:

• Amazon Web Services (AWS) — Cloud infrastructure and hosting (US, EU, AP regions)
• Stripe, Inc. — Payment processing and billing data
• PostHog — Product analytics and session recording
• Intercom — Customer support and in-app messaging
• Cloudflare — DDoS protection, CDN, and DNS
• Datadog — Infrastructure monitoring and log management

An up-to-date list of Subprocessors is available at sendbound.com/legal/subprocessors.

6.3 Change Notification

Sendbound will provide at least 14 days' prior written notice before adding or replacing a Subprocessor. The Customer may object to such changes in writing within 14 days. If Sendbound cannot accommodate the objection, the Customer may terminate the Agreement for the affected Service without penalty.

7. International Data Transfers

Sendbound is based in the United States. Where Personal Data is transferred from the EEA, UK, or Switzerland to a third country without an adequacy decision, Sendbound relies on:

• EU Standard Contractual Clauses (2021) — Module 2 (Controller to Processor) for transfers from the EEA to the US
• UK International Data Transfer Addendum — For transfers from the United Kingdom
• Swiss Standard Contractual Clauses — For transfers from Switzerland

By entering into this DPA, the parties are deemed to have executed the applicable SCCs. The SCCs are incorporated by reference and take precedence in the event of a conflict with this DPA solely with respect to the data transfers they govern.

Sendbound commits to promptly notify the Customer if it becomes aware of any government request for access to Personal Data and, to the extent permitted by law, provide the Customer with the opportunity to contest such request.

8. Data Subject Rights

Sendbound shall, to the extent legally permitted, promptly notify the Customer if it receives a request from a Data Subject exercising their rights under applicable data protection law (e.g., right of access, rectification, erasure, portability, or objection).

Sendbound shall not respond to such requests directly without the Customer's prior written authorisation, except to confirm that the request has been forwarded. Sendbound will provide commercially reasonable assistance to enable the Customer to comply with Data Subject requests within the applicable statutory timeframe.

Sendbound provides the following mechanisms to facilitate Data Subject rights: (a) data export via API and dashboard; (b) deletion endpoints available in the Sendbound API; and (c) contact suppression list management.

9. Security Breach Notification

Sendbound will notify the Customer without undue delay — and in any event within 72 hours of becoming aware — of a Security Incident affecting Personal Data processed under this DPA.

Such notification will include, to the extent then known: (a) a description of the nature of the incident; (b) the categories and approximate number of Data Subjects and records affected; (c) the likely consequences of the incident; and (d) the measures taken or proposed to address the incident.

Sendbound will cooperate with the Customer and take reasonable steps to mitigate the effects of the incident. Notification does not constitute an admission of fault or liability.

Security incidents should be reported to security@sendbound.com.

10. Audit Rights

Upon reasonable written notice (minimum 30 days), Sendbound will make available to the Customer all information necessary to demonstrate compliance with this DPA. Sendbound will also allow for and contribute to audits conducted by the Customer or an independent auditor mandated by the Customer, subject to:

• Reasonable confidentiality obligations on the auditor
• The audit being conducted during normal business hours with minimal disruption
• The Customer bearing the costs of any third-party auditor
• Audits being limited to once per year, unless a Security Incident has occurred

As an alternative to an on-site audit, Sendbound may provide its most recent SOC 2 Type II report, ISO 27001 certificate, or equivalent third-party audit report under NDA. The Customer agrees to accept such reports where they demonstrate sufficient compliance.

11. Return and Deletion of Personal Data

Upon termination or expiry of the Agreement, Sendbound will, at the Customer's election: (a) return a complete copy of all Personal Data in machine-readable format; or (b) securely delete all Personal Data — whichever the Customer requests in writing within 30 days of termination.

If the Customer does not make a request within 30 days, Sendbound will delete all Personal Data in accordance with its standard retention and deletion policies. Sendbound will certify deletion in writing upon request.

Sendbound may retain Personal Data where required by applicable law, for the duration required by such law only, and will continue to protect such data with the measures set out in this DPA.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the exclusions and limitations of liability in the Agreement. Where Sendbound is liable for damages suffered by a Data Subject due to a breach of this DPA, Sendbound may claim indemnification from the Customer to the extent Sendbound is not at fault.

Sendbound's total aggregate liability under this DPA shall not exceed the amount paid by the Customer to Sendbound in the 12 months preceding the claim, subject to applicable law. This limitation does not apply to Sendbound's indemnification obligations or to liability arising from gross negligence or wilful misconduct.

13. Term and Termination

This DPA is effective from the date the Customer first uses the Services and continues for the duration of the Agreement. It terminates automatically upon expiry or termination of the Agreement, subject to any obligations that survive termination (including Sections 9, 11, and 12).

Either party may terminate this DPA immediately by written notice if the other party materially breaches this DPA and fails to remedy the breach within 30 days of written notice.

14. Governing Law

This DPA shall be governed by the laws of the State of California, USA, except where applicable data protection law requires otherwise. For EEA/UK customers, mandatory provisions of GDPR and UK GDPR take precedence over conflicting provisions of this DPA.

Any dispute arising from this DPA shall be resolved in accordance with the dispute resolution mechanism in the Agreement, except that either party may seek urgent injunctive relief from any court of competent jurisdiction.

15. Contact

For questions about this DPA or to request a countersigned copy:

• Email: privacy@sendbound.com
• Mail: Sendbound, Inc., Attn: Data Protection Officer, 123 Market Street, San Francisco, CA 94105
• EEA Representative: eu-rep@sendbound.com