Data Processing Addendum

1. Purpose and scope

This Data Processing Addendum ("DPA") is part of the agreement between Closelio AI LLC, a {{ENTITY_STATE}} limited liability company ("Closelio," "we," "us"), and the Customer ("you") under our Terms of Service (the "Terms"). It applies whenever we process Customer Personal Data in providing the Service.

This DPA is written for US privacy laws. That includes the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA") and the comprehensive consumer privacy laws of other US states (together with the CCPA, "US Privacy Laws"). The Service is offered only in the United States.

Terms used but not defined here have the meanings given in the Terms or in the applicable US Privacy Law.

2. Definitions

• "Customer Personal Data" means personal information that you or your Users submit to the Service, or that we receive through the Service on your behalf, including data about your Contacts. Examples are Contact names, phone numbers, email addresses, lead form details, consent records, notes, message content, call recordings and call transcripts.
• "Process" means any operation performed on data, such as collecting, storing, using, transmitting, transcribing or deleting it.
• "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in our or our subprocessors' systems.
• "Subprocessor" means a third party we engage that processes Customer Personal Data.

This DPA does not cover information about you and your Users that we collect for our own business purposes, such as account, billing and usage data. Our Privacy Policy covers that information.

3. Roles of the parties

For Customer Personal Data, you are the "business" under the CCPA and the "controller" under other US Privacy Laws. Closelio is your "service provider" under the CCPA and your "processor" under other US Privacy Laws.

You decide which Contacts to upload, which Contacts to message or call, what to say, which features to turn on, and how long to keep the data. You are responsible for:

• having a lawful basis and any required notices and consents to collect Customer Personal Data and to let us process it as described in this DPA;
• the accuracy of the data and the lawfulness of how you obtained it, including data from lead vendors;
• complying with the laws that apply to you as the sender of messages and the caller, as set out in our Communications Compliance Addendum.

4. Processing instructions

We will process Customer Personal Data only to provide, maintain, secure and support the Service for you, as described in the Terms and the Service documentation, and as directed by your configuration and use of the Service. Your agreement to the Terms, your settings in the app, and your actions in the Service (for example, starting a campaign, turning on an AI voice agent, or enabling call recording) are your complete instructions to us. Any other instruction must be agreed in writing.

We may also process Customer Personal Data when US law requires us to. If that happens, we will tell you first unless the law prohibits us from doing so.

If we believe an instruction from you violates US Privacy Laws, we will tell you. We are not required to carry out an instruction we reasonably believe is unlawful.

The categories of Customer Personal Data, the categories of individuals, and the nature and purpose of the processing are described in Annex A.

5. Restrictions on our use

We will not:

• sell Customer Personal Data, or share it for cross-context behavioral advertising or targeted advertising;
• retain, use or disclose Customer Personal Data for any purpose other than the business purposes set out in this DPA and the Terms, including for any commercial purpose of our own, except as US Privacy Laws allow;
• retain, use or disclose Customer Personal Data outside the direct business relationship between you and us;
• combine Customer Personal Data with personal information we receive from or on behalf of other persons, or collect from our own interactions with individuals, except as US Privacy Laws allow a service provider to do;
• use Customer Personal Data to train our own foundation models, or provide it to third parties for the purpose of training their foundation models.

US Privacy Laws allow service providers to use personal information for some internal purposes, such as maintaining and fixing the Service, detecting security incidents, protecting against fraud and illegal activity, and building or improving the Service without building profiles of individuals for other businesses. We may process Customer Personal Data for those permitted purposes. We may also create and use aggregated or de-identified data that cannot reasonably be linked to any individual, and if we do, we will take reasonable measures to keep it de-identified and will not try to re-identify it.

We certify that we understand and will comply with the restrictions in this section. We will tell you if we determine we can no longer meet our obligations under US Privacy Laws. In that case, or if you reasonably believe we are using Customer Personal Data in an unauthorized way, you may take reasonable and appropriate steps to stop and remedy the unauthorized use, including by contacting us at privacy@closelio.ai.

6. Confidentiality of personnel

We will make sure that our employees and contractors who may access Customer Personal Data are bound by a duty of confidentiality and access it only as needed to provide, secure or support the Service, or to meet legal requirements.

7. Security

We will maintain reasonable administrative, technical and physical safeguards designed to protect Customer Personal Data, appropriate to the nature of the data and the risks involved. At a general level these include:

• encryption of data in transit over public networks;
• access controls, so that people and systems can reach Customer Personal Data only as needed (least privilege);
• logging and monitoring of activity on our systems, including error monitoring;
• use of established hosting and infrastructure providers.

{{TODO: confirm encryption at rest per vendor}}

We may update our security measures over time, as long as the overall level of protection is not materially reduced. No security measure is perfect, and we do not guarantee that a Security Incident will never occur.

You are responsible for the security measures within your control, including protecting account credentials, managing which Users have access to your workspace and with what role, and configuring the Service appropriately.

8. Subprocessors

You authorize us to engage Subprocessors to help provide the Service. Our current Subprocessors, and what each one does, are listed on our Subprocessor List. If you connect an optional integration, such as a lead ads or calendar account, the provider of that integration is involved only because you chose to connect it.

We will have a written agreement with each Subprocessor that requires it to protect Customer Personal Data in a way that is at least as protective, in substance, as this DPA for the services it provides. We remain responsible for our Subprocessors' compliance with those obligations.

New Subprocessors. We will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data by updating the Subprocessor List. {{TODO: confirm notice mechanism, e.g. email or in-app subscription to Subprocessor List updates}}

Objection. You may object to a new Subprocessor on reasonable grounds related to data protection by emailing privacy@closelio.ai during the notice period. If you object, we will discuss your concerns in good faith. If we cannot resolve the objection within a reasonable time, you may terminate the affected part of the Service by written notice. Termination is your sole remedy for an unresolved objection. If you terminate under this section, we will refund any prepaid fees for the terminated part of the Service covering the period after termination. {{TODO: confirm refund treatment matches Terms}}

In an emergency, such as when a Subprocessor stops providing service unexpectedly, we may need to replace it on shorter notice. If so, we will update the Subprocessor List as soon as we reasonably can, and your objection right will still apply.

9. Help with consumer requests

Your Contacts may have rights under US Privacy Laws, such as the right to access, delete or correct their personal information, or to opt out of certain uses. You are responsible for responding to those requests.

The Service gives you tools to find, export, update and delete Contact records, and to record opt-outs. If you need more help, we will provide reasonable assistance, taking into account the nature of the processing and the information available to us.

If we receive a request directly from one of your Contacts, we will not respond to it on the merits except to direct the person to you, unless the law requires otherwise. Where we can reasonably identify you as the relevant Customer, we will forward the request to you without undue delay.

We will also give you reasonable information you need to complete any data protection assessment that US Privacy Laws require of you, to the extent the information is about our processing and is not otherwise available to you.

10. Security Incidents

If we become aware of a Security Incident, we will notify you without undue delay and in any case within {{TODO: hours}} hours. Our notice will describe what we know at the time, such as the nature of the incident, the types of data involved, and the steps we are taking. We will update you as we learn more.

We will take reasonable steps to contain and investigate the incident and reduce its effects. We will reasonably cooperate with you so that you can meet any obligation you have to notify individuals or regulators. Unless the law requires otherwise, you are responsible for deciding whether to notify individuals or regulators.

Our notice of or response to a Security Incident is not an admission of fault or liability.

11. Return and deletion

You can export and delete Customer Personal Data using the Service while your account is active.

After your account ends, we will delete Customer Personal Data from our active systems within {{TODO: days}} days, unless you ask us in writing before then for help exporting it. Data held in backups will be deleted as those backups expire under our normal cycle, and will stay protected under this DPA until then.

We may keep Customer Personal Data longer when the law requires it, or where needed to resolve a dispute, enforce our agreements, or respond to a legal claim, complaint or regulatory inquiry. This includes records of messages, calls, consent and opt-outs that may be needed to show compliance with communications laws. Anything we keep remains subject to this DPA, and we will process it only for the purpose for which it was kept.

12. Audits and information

When you ask in writing, we will give you information reasonably needed to show our compliance with this DPA, such as written answers to a reasonable security questionnaire and a description of our security practices. You may make such a request no more than once in any 12-month period, unless a Security Incident has occurred or a regulator requires more.

Any information we provide is our confidential information. We are not required to disclose information about other customers, information that would put our security at risk, or information protected by legal privilege.

13. Data location

We process and store Customer Personal Data in the United States. We will not move Customer Personal Data to another country for processing without first updating this DPA and the Subprocessor List and giving notice as described in Section 15.

14. Liability

Each party's liability under or related to this DPA is subject to the limitations and exclusions of liability in the Terms. This DPA does not create any separate or extra liability beyond what the Terms provide, and nothing in this DPA gives rights to any third party.

15. Term, changes and order of precedence

This DPA lasts for as long as we process Customer Personal Data for you, including after the Terms end until the data is deleted as described in Section 11.

We may update this DPA, including to reflect changes in US Privacy Laws or the Service. If we make a material change, we will notify you by email, in the app, or both, and continued use of the Service will require you to accept the updated DPA in the app.

If this DPA conflicts with the Terms, this DPA controls as to the processing of Customer Personal Data. If this DPA conflicts with our Communications Compliance Addendum, that addendum controls as to your obligations as a sender of messages and a caller. In all other respects, the Terms control.

Questions about this DPA can be sent to privacy@closelio.ai or legal@closelio.ai.

Annex A. Description of processing

Categories of individuals. Your Contacts (prospects, leads, applicants, policyholders and clients), and any other people whose information you or your Users submit or receive through the Service, such as people who call or text your numbers.

Categories of Customer Personal Data. Identifiers and contact details (name, phone number, email address, postal address); demographic and insurance-interest details supplied in lead forms or by you, which may include date of birth and health-related answers; consent and opt-out records; notes, tags, pipeline stages and appointment details; policy and commission details you record; text message content; call audio, call recordings and transcripts; call and message metadata (times, durations, outcomes, delivery status).

Sensitive data. The Service is not designed to require sensitive personal information. You decide whether to collect or upload it, and you are responsible for any additional notice, consent or legal requirements that apply to it.

Nature and purpose of processing. Storing and organizing Contact records; sending and receiving SMS and email; placing and receiving phone calls, including through the Power Dialer and AI voice agents; generating AI-written replies, speech, transcripts and summaries; recording calls when enabled; importing leads from uploads, webhooks and connected integrations; scheduling appointments and syncing calendars; applying opt-out, do-not-call and other compliance tools you configure; reporting; and supporting, securing and maintaining the Service.

Duration. For the term of your use of the Service and afterward as described in Section 11.