Data Processing Addendum

1.Introduction, parties and precedence

1.1 Parties. This Data Processing Addendum (the "Addendum") is entered into between BiopharmaWatch LLC, the operator of SDRclose ("SDRclose", "we", "us"), and the customer that has accepted the Terms of Service ("Customer"). SDRclose and Customer are each a "party" and together the "parties".

1.2 Incorporation and acceptance. This Addendum forms part of the Agreement and applies automatically whenever SDRclose processes Prospect Data on Customer's behalf. No signature is required. Customer accepts this Addendum by accepting the Terms of Service or by using the Service to process Prospect Data, whichever happens first. A countersigned copy is available on request through the contact form. A countersigned copy does not change the terms of this Addendum unless the parties agree otherwise in a signed writing.

1.3 Order of precedence. If documents conflict, the following order applies: a signed order form or enterprise agreement; then this Addendum; then the Terms of Service; then the Acceptable Use Policy; then the Privacy Policy and the Cookie Policy, which are notices rather than contracts. Where the Standard Contractual Clauses or the UK Addendum apply under section 13, they prevail over this Addendum to the extent of any conflict.

1.4 Account Data. This Addendum governs Prospect Data. Account Data, which SDRclose processes as a controller, is governed by the Privacy Policy and is outside this Addendum except where a clause says otherwise.

1.5 Earlier agreements. This Addendum replaces any earlier data processing agreement between the parties for the Service, unless a signed agreement between the parties expressly states that it takes precedence.

2.Definitions

2.1 Capitalized terms not defined in this Addendum have the meaning given in the Terms of Service. The following terms have the meanings set out below.

Agreement

The Terms of Service, this Addendum, the Acceptable Use Policy and any signed order form or enterprise agreement between the parties.

Account Data

Personal data that identifies and administers Customer's account, including the account holder's name and email address, credentials, plan, billing status, credit balance, support correspondence and product usage. SDRclose is the controller of Account Data.

Authorized User

A person Customer allows to use its account under Customer's supervision, as described in the Terms of Service.

Connected Mailbox

An email account that Customer connects to the Service so that messages can be sent from it and replies detected in it.

Customer Data

All data that Customer submits to the Service or that the Service generates for Customer, including Prospect Data, sequences, drafts, sent messages, replies, research notes, lists, tags and activity records.

Prospect Data

Personal data within Customer Data relating to the people Customer identifies, researches, contacts or follows up with through the Service, and to the people who reply to or are copied on those messages. Customer is the controller of Prospect Data and SDRclose is the processor.

Data Protection Laws

All laws that apply to the processing of personal data under this Addendum, including the GDPR, the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection (the "Swiss FADP"), the California Consumer Privacy Act as amended (the "CCPA") and other United States state privacy laws, in each case as amended or replaced.

Controller, processor, data subject, personal data, processing, special categories of personal data, supervisory authority

These terms have the meanings given in the applicable Data Protection Laws. "Business", "service provider", "consumer", "sell" and "share" have the meanings given in the CCPA where the CCPA applies.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data processed by SDRclose or its sub-processors.

Restricted Transfer

A transfer of Prospect Data protected by the Data Protection Laws of the European Economic Area, the United Kingdom or Switzerland to a country that those laws do not recognize as providing adequate protection, where the transfer would be unlawful without a transfer mechanism.

Standard Contractual Clauses

The standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914, as amended or replaced.

UK Addendum

The International Data Transfer Addendum to the Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced.

Service

The SDRclose web application and the features made available through it, as described in the Terms of Service.

Sub-processor

A third party engaged by SDRclose, or by another sub-processor, to process Prospect Data on Customer's behalf.

Suppression Record

A record of an email address that has opted out of, or must not receive, messages sent through the Service, together with the date and source of the opt-out.

3.Roles and scope of processing

3.1 Prospect Data. As between the parties, Customer is the controller of Prospect Data and SDRclose is the processor. SDRclose processes Prospect Data only to provide the Service, only on Customer's documented instructions and for no purpose of its own.

3.2 Customer as processor. Where Customer processes Prospect Data on behalf of its own clients, for example as an agency, Customer acts as a processor and SDRclose acts as its sub-processor. In that case Customer warrants that its instructions to SDRclose are authorized by the relevant controller, that the controller has authorized the engagement of SDRclose and of the sub-processors described in section 7, and that Customer will flow down any obligation the controller requires. References in this Addendum to Customer's obligations as a controller are read accordingly, and Module 3 of the Standard Contractual Clauses applies under section 13.

3.3 Account Data. SDRclose is the controller of Account Data and processes it as described in the Privacy Policy, including to operate the account, bill for the Service, provide support and meet legal obligations.

3.4 SDRclose's own outreach. Where SDRclose uses the Service to contact prospects for its own product, BiopharmaWatch LLC is the controller of that outreach. That processing is outside this Addendum and is described in the Privacy Policy.

3.5 Details of processing. The subject matter, duration, nature and purposes of the processing, the categories of data subjects and the categories of personal data are set out in Annex 1.

3.6 No independent use. SDRclose does not sell Prospect Data, does not disclose it for advertising and does not use it to build or enrich any dataset of its own. SDRclose does not train models on Customer Data or Prospect Data. Language-model and research providers are engaged only on terms under which the data submitted to them is not used to train their models.

3.7 Automated features. The Service researches prospects, drafts messages and classifies replies. Where Customer switches the relevant autopilot options on for a sequence, the Service also sends approved copy, answers replies and books meetings. Until Customer switches autopilot on, every message waits in a review queue for approval. Customer decides which automated features to use, configures them and remains responsible for the messages sent from its mailboxes. The Service does not make decisions that produce legal or similarly significant effects on data subjects.

4.Customer instructions and Customer obligations

4.1 Documented instructions. Customer's documented instructions consist of: the Agreement, including this Addendum; the settings Customer applies in the Service, such as the sequences it creates, the prospects it adds, the mailboxes it connects, the writing controls it sets and the autopilot options it enables; and any further written instruction the parties agree. An instruction that requires processing outside the functionality of the Service may be declined or may be subject to a fee agreed in advance.

4.2 Compliance with instructions. SDRclose processes Prospect Data only on Customer's documented instructions, unless processing is required by a law to which SDRclose is subject. In that case SDRclose informs Customer of the legal requirement before processing, unless the law prohibits that on important grounds of public interest.

4.3 Infringing instructions. SDRclose informs Customer without undue delay if, in its opinion, an instruction infringes Data Protection Laws. SDRclose may suspend the processing concerned until the instruction is withdrawn or amended and is not obliged to carry it out.

4.4 Customer obligations. Customer is responsible for the lawfulness of its processing of Prospect Data. Customer represents and warrants that it: has a lawful basis and, where required, consent for contacting each data subject through the Service; has provided any notice that Data Protection Laws require; is entitled to submit Prospect Data to the Service, whether obtained from the prospect data provider, by CSV import or by manual entry; keeps its data accurate and removes data it is no longer entitled to process; respects opt-outs and does not attempt to circumvent Suppression Records; and complies with the Acceptable Use Policy and with the anti-spam and electronic marketing laws that apply to its messages.

4.5 Prohibited data. Customer must not submit to the Service special categories of personal data, personal data relating to criminal convictions or offenses, personal data of children, payment card data, government identifiers, or any other data whose processing by SDRclose would require a safeguard not provided by this Addendum. The Service is designed for business contact data and business correspondence.

4.6 Connected Mailboxes. Customer authorizes SDRclose to access each Connected Mailbox to send messages, detect replies and manage warmup mail as Customer configures. Customer is responsible for its right to connect the mailbox, for complying with the mailbox provider's terms and for disconnecting a mailbox when access should end.

4.7 Assessment by Customer. Customer has assessed, and is responsible for continuing to assess, whether the Service, the measures in Annex 2 and the sub-processors in Annex 3 are appropriate for the Prospect Data it processes and the risks to the data subjects concerned.

5.Confidentiality of personnel

5.1 Confidentiality obligations. SDRclose ensures that every person it authorizes to process Prospect Data, whether an employee or a contractor, is bound by a written confidentiality obligation or is under an appropriate statutory obligation of confidentiality.

5.2 Need-to-know access. Access to Prospect Data is restricted to personnel who need it to provide, support, secure or improve the Service, and is granted on the basis of role. Access rights are reviewed when a person's role changes and are removed when the person leaves.

5.3 Awareness. Personnel with access to Prospect Data are informed of the confidential nature of the data and of their responsibilities under this Addendum and Data Protection Laws.

5.4 Duration. Confidentiality obligations continue after a person's engagement ends and after this Addendum terminates.

6.Security measures

6.1 Technical and organizational measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to data subjects, SDRclose implements and maintains the technical and organizational measures described in Annex 2. These measures are designed to protect Prospect Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure and unauthorized access.

6.2 Changes to measures. SDRclose may update the measures as technology and threats evolve, provided that an update does not materially reduce the overall level of protection during the term of the Agreement. The Security page describes the current measures at a level suitable for public disclosure.

6.3 Customer's part. The Service operates within the boundary Customer defines. Customer is responsible for the strength and secrecy of its credentials, for controlling which Authorized Users can access the account and for changing the password when access should end, for the security of each Connected Mailbox and its provider account, for the retention period it sets and the tracking options it enables, and for reviewing generated copy before approving it where the review queue is in use.

6.4 Incidents on Customer's side. Customer notifies SDRclose promptly through the contact form if it believes that its account, an Authorized User's credentials or a Connected Mailbox has been compromised, so that SDRclose can help contain any effect on Prospect Data.

7.Sub-processors

7.1 General authorization. Customer gives SDRclose a general authorization to engage sub-processors to process Prospect Data in the following categories: infrastructure and hosting provider; payment processor; language-model and research providers; prospect data provider; scheduling and calendar provider; transactional email provider; professional advisers. The canonical list is the Sub-processors page. The named list, identifying each sub-processor and the processing it performs, is provided on request through the contact form and forms Annex 3 as a schedule to this Addendum.

7.2 Sub-processor terms. SDRclose engages each sub-processor under a written contract that imposes data protection obligations no less protective than those in this Addendum, to the extent applicable to the service the sub-processor performs. Where a sub-processor processes Prospect Data outside the jurisdiction it came from, SDRclose puts in place a transfer mechanism described in section 13. SDRclose remains fully liable to Customer for the performance of each sub-processor's obligations.

7.3 Notice of changes. SDRclose gives Customer at least 30 days' notice by email to the account address before a new sub-processor processes Customer Data. The notice identifies the sub-processor and the processing it will perform. Changes are also recorded on the Sub-processors page.

7.4 Right to object. Customer may object on reasonable data-protection grounds within the notice period by written notice through the contact form. The parties discuss the objection in good faith. If the objection is not resolved, Customer may terminate the affected part of the Service by written notice before the change takes effect and receive a pro rata refund of prepaid fees for that part. Continued use of the affected part after the change takes effect constitutes acceptance of the new sub-processor.

7.5 Recipients chosen by Customer. The providers of the mailboxes Customer connects, the calendar accounts Customer links and the recipients of Customer's messages are recipients that Customer selects. They are not sub-processors of SDRclose, and their processing is governed by their own terms with Customer.

8.Data subject requests

8.1 Responsibility. Customer, as controller, is responsible for responding to requests from data subjects to exercise their rights, including access, rectification, erasure, restriction, portability and objection, within the time Data Protection Laws allow.

8.2 Assistance through the Service. SDRclose assists Customer through the features of the Service: export of Customer Data in a machine-readable format, deletion of individual leads and their associated messages, the account-wide Suppression Record that prevents a person from being contacted again through any sequence or mailbox, and the optional retention sweeper. Where a request cannot be met with those features, SDRclose provides further reasonable assistance on written request, taking into account the nature of the processing and the information available to it.

8.3 Requests received by SDRclose. If a data subject contacts SDRclose directly about Prospect Data, SDRclose does not respond substantively, except to acknowledge the request and, where it is able and permitted to do so, to identify Customer as the controller. SDRclose forwards the request to Customer without undue delay. SDRclose responds directly only where Data Protection Laws require it.

8.4 Opt-out requests. An unsubscribe, a reply asking not to be contacted, or an opt-out received through the Privacy Center is treated as a standing instruction from Customer. The Service records a Suppression Record for the address and stops further sending to it. This is the one category of request that SDRclose actions without referring it to Customer first.

8.5 Information for recipients. Recipients of Customer's messages can find information about the processing, their rights and the routes available to them in the Privacy Policy and the Privacy Center.

9.Assistance with impact assessments and consultations

9.1 Assistance. Taking into account the nature of the processing and the information available to it, SDRclose provides reasonable assistance to Customer with data protection impact assessments, and with prior consultations of a supervisory authority, that Customer is required to carry out under Data Protection Laws in connection with the Service.

9.2 Information already available. This Addendum, Annex 1, Annex 2, the Security page and the GDPR page are intended to give Customer the information it needs for most assessments. SDRclose completes reasonable written security and privacy questionnaires on request.

9.3 Additional assistance. Assistance beyond the information referred to in 9.2 is provided on written request through the contact form. SDRclose may charge a reasonable fee, agreed with Customer in advance, for assistance that requires material effort.

10.Personal data breach notification

10.1 Notification. SDRclose notifies Customer without undue delay and, where feasible, within 72 hours after it confirms a Personal Data Breach affecting Customer Data. Notice is sent by email to the account address and to any additional contact Customer has nominated in writing.

10.2 Content of the notice. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point for further information. Where all of that information is not available at once, it is provided in phases without undue further delay.

10.3 Cooperation and remediation. SDRclose takes reasonable steps to contain, investigate and remediate the breach, and provides Customer with the information reasonably necessary to meet its own obligations to notify supervisory authorities and data subjects. SDRclose does not notify a supervisory authority or data subjects on Customer's behalf unless Customer requests it in writing or the law requires it.

10.4 Customer's decisions. Customer decides whether and how to notify authorities and data subjects and is responsible for the content of any notification. Customer does not name SDRclose in a public statement about a breach without prior consultation, except as required by law.

10.5 No admission. A notification under this section is not an acknowledgment of fault or liability by either party.

10.6 Unsuccessful attempts. Unsuccessful attempts or activities that do not compromise the security of Customer Data, such as blocked sign-in attempts, network scans or denial-of-service attacks that do not result in unauthorized access, are not Personal Data Breaches and are not notified under this section.

11.Return and deletion of Customer Data

11.1 During the term. Customer controls its data throughout the term. From Settings > Privacy & Data, Customer can export a machine-readable copy of its Customer Data, delete individual leads, and switch on the optional retention sweeper, which purges the bodies and subjects of older replies, sent messages and finished drafts on a schedule Customer sets between 7 and 730 days. The sweeper is off by default, and Customer sets a retention period that fits its own obligations.

11.2 On account deletion. When Customer deletes its account, Customer Data is deleted from the live service. Residual copies persist in routine backups, which are overwritten on a rolling basis and fall out of retention within 30 days. Backup copies are not restored to active use except to recover from a service failure, and in that case data deleted before the failure is deleted again.

11.3 Non-paid accounts. After cancellation or a lapsed trial, Customer can sign in, view and export Customer Data and resume a subscription; sending, mining, research, drafting and other metered features are unavailable. SDRclose may delete the data of an account that remains in a non-paid state for twelve months, after 30 days' notice by email to the account address. Customer should export its data before that date.

11.4 Suppression Records. Suppression Records are retained after deletion of the lead, the sequence or the account, and are used only to prevent a person who has opted out from being contacted again through the Service. This retention is necessary to comply with the legal obligation to honor opt-outs and is permitted by Article 17(3)(b) of the GDPR and equivalent provisions of other Data Protection Laws. A Suppression Record contains the address concerned and the date and source of the opt-out, and nothing else.

11.5 Legal retention. SDRclose may retain Customer Data to the extent required by law. Data retained on that basis remains protected by this Addendum and is processed only for the purpose that requires its retention.

11.6 Confirmation of deletion. On written request made within 30 days after account deletion, SDRclose confirms in writing that deletion has taken place in accordance with this section.

12.Audit and demonstrating compliance

12.1 Information. SDRclose makes available to Customer the information reasonably necessary to demonstrate compliance with this Addendum and with Article 28 of the GDPR, including completed security questionnaires and its security documentation, under confidentiality obligations where appropriate.

12.2 Audit right. Customer may audit SDRclose's compliance with this Addendum once in any twelve-month period, on 30 days' written notice through the contact form. An audit proceeds first by written questionnaire and review of documentation. An on-site or remote inspection takes place only where a questionnaire cannot reasonably answer the concern, during business hours, subject to confidentiality obligations and SDRclose's security policies, and at Customer's cost.

12.3 More frequent audits. An audit may take place more often than 12.2 allows only where a supervisory authority requires it or following a Personal Data Breach affecting Customer Data.

12.4 Conduct of audits. An audit must not disrupt the Service or expose the data of other customers. Customer may use an independent auditor that is not a competitor of SDRclose and that is bound by a written confidentiality agreement. Customer provides SDRclose with a copy of the audit findings, and the parties agree a reasonable plan to address any material non-compliance identified.

12.5 Supervisory authorities. Nothing in this section limits the powers of a supervisory authority under Data Protection Laws. SDRclose cooperates with a supervisory authority in the performance of its tasks and, where permitted, informs Customer of any inspection that affects Customer Data.

13.International transfers

13.1 Locations. SDRclose is established in the United States. A transfer of Prospect Data to SDRclose, and any onward transfer to a sub-processor operating outside the jurisdiction the data came from, is a Restricted Transfer where the applicable Data Protection Laws so provide, and takes place only under a transfer mechanism recognized by those laws, as set out in this section.

13.2 EU Standard Contractual Clauses. The Standard Contractual Clauses are incorporated into this Addendum and apply to every Restricted Transfer from the European Economic Area. Module 2 (controller to processor) applies where Customer is a controller. Module 3 (processor to processor) applies where Customer is itself a processor under 3.2. Customer is the data exporter and SDRclose is the data importer. The parties make the following selections: the optional docking clause is not used; for the engagement of sub-processors, the general written authorization option applies with the notice period of 30 days stated in 7.3; the optional wording that would let data subjects choose an independent dispute resolution body is not used; the competent supervisory authority is determined in accordance with the Standard Contractual Clauses by reference to the EU member state in which Customer is established or, where Customer is not established in the EU, in which the data subjects are located; and the governing law and forum are those of an EU member state that recognizes third-party beneficiary rights under the Standard Contractual Clauses, for which the parties select Ireland and the courts of Ireland. Annex 1, Annex 2 and Annex 3 of this Addendum complete the annexes of the Standard Contractual Clauses. The Standard Contractual Clauses are deemed signed by both parties on acceptance of this Addendum.

13.3 United Kingdom. For Restricted Transfers from the United Kingdom, the UK Addendum is incorporated and applies to the Standard Contractual Clauses as selected in 13.2. The tables of the UK Addendum are completed by reference to this Addendum: the parties and their details are those in Annex 1; the selected modules and options are those in 13.2; the appendix information is that in Annex 1, Annex 2 and Annex 3; and neither party may end the UK Addendum when the approved addendum changes, except as the UK Addendum itself permits. The UK Addendum is governed by the laws of England and Wales, and disputes under it are heard by the courts of England and Wales.

13.4 Switzerland. For Restricted Transfers from Switzerland, the Standard Contractual Clauses apply with the following adaptations: references to the GDPR are read as references to the Swiss FADP where the transfer is governed solely by the Swiss FADP, and to both where it is governed by both; the Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the Swiss FADP; the term member state is read to include Switzerland so that Swiss data subjects may bring claims in their place of habitual residence; and the Standard Contractual Clauses protect the data of legal entities to the extent the Swiss FADP does so.

13.5 Onward transfers. Where a sub-processor processes Prospect Data outside the jurisdiction it came from, SDRclose relies on the Standard Contractual Clauses (Module 3), the UK Addendum and the Swiss adaptations as appropriate, or on an adequacy decision or a transfer framework recognized by the relevant Data Protection Laws that applies to that sub-processor. The mechanism relied on for each sub-processor is stated in the named schedule described in Annex 3.

13.6 Government access requests. If SDRclose receives a legally binding request from a public authority for access to Prospect Data, it reviews the request for legality, notifies Customer where legally permitted, challenges the request where there are reasonable grounds to do so, and discloses only the minimum information required. SDRclose has no reason to believe that the laws and practices applicable to it prevent it from performing its obligations under the Standard Contractual Clauses, and it informs Customer promptly if that changes.

13.7 Alternative mechanisms. If a transfer mechanism relied on under this section is invalidated or amended, the parties cooperate in good faith to put an alternative mechanism recognized by Data Protection Laws in place. SDRclose may update this section to reflect a new or amended mechanism under 15.3. Customer may suspend the affected transfer, for example by declining to use the features that depend on a particular sub-processor, until an alternative is in place.

14.Liability

14.1 Terms of Service govern. Each party's liability arising out of or in connection with this Addendum, whether in contract, tort or otherwise, is subject to the exclusions and limitations of liability in the Terms of Service. This Addendum does not create liability beyond what the Terms of Service allow, except as 14.3 provides.

14.2 One aggregate cap. The limitation of liability in the Terms of Service applies to liability under the Terms of Service and this Addendum together. Liability under this Addendum is not a separate cap added to the cap under the Terms of Service, and a claim under both documents for the same event is counted once.

14.3 Cap for breach of this Addendum. For breach of this Addendum, each party's aggregate liability is limited to two times the standard cap in the Terms of Service, that is, two times the fees paid or payable by Customer in the twelve months before the event giving rise to the claim, or $200 where no fees have been paid.

14.4 Exclusions preserved. The carve-outs from the limitation of liability in the Terms of Service, including for fraud, gross negligence, willful misconduct and liability that cannot be limited by law, apply equally to this Addendum.

14.5 Claims by Customer's clients. Where Customer acts as a processor under 3.2, claims relating to this Addendum are brought by Customer. Customer's clients have no direct right of action against SDRclose except as Data Protection Laws or the Standard Contractual Clauses provide.

14.6 Data subjects. Nothing in this section limits the rights of data subjects under the Standard Contractual Clauses or under Data Protection Laws, or either party's liability to data subjects under them.

15.Term, termination and changes to this Addendum

15.1 Term. This Addendum takes effect on the effective date shown above or, if later, when Customer first processes Prospect Data through the Service, and continues for as long as SDRclose processes Prospect Data on Customer's behalf.

15.2 Termination and survival. This Addendum terminates automatically when the Agreement terminates and SDRclose has deleted Customer Data in accordance with section 11. Sections 5, 11 and 14 and this section, together with any provision that by its nature is intended to survive, remain in force after termination for as long as SDRclose retains any Customer Data or Suppression Records.

15.3 Changes. SDRclose may update this Addendum to reflect changes in Data Protection Laws, in approved transfer mechanisms, in the Service or in its sub-processors. A change that materially reduces SDRclose's commitments takes effect 30 days after notice by email to the account address; other changes take effect when published on this page. If Customer objects to a material change on reasonable data-protection grounds and the parties cannot resolve the objection, Customer may terminate the Agreement before the change takes effect and receive a pro rata refund of prepaid fees for the remaining term. Continued use of the Service after a change takes effect constitutes acceptance.

15.4 Conflicts within the data protection terms. In respect of the processing of personal data, this Addendum prevails over the Terms of Service, and the Standard Contractual Clauses and the UK Addendum prevail over this Addendum, as 1.3 sets out. Nothing in this Addendum reduces the protection that Data Protection Laws give to personal data.

15.5 Severability. If a provision of this Addendum is held invalid, the remainder continues in effect and the parties replace the invalid provision with one that achieves its purpose as closely as possible.

15.6 Governing law. Except where 13.2 to 13.4 provide otherwise for the Standard Contractual Clauses and the UK Addendum, this Addendum is governed by the governing law and dispute resolution provisions of the Terms of Service.

15.7 Notices. Notices from SDRclose under this Addendum are sent by email to the account address. Notices from Customer, including requests for a countersigned copy, the named sub-processor schedule or an audit, are sent through the contact form. Data protection matters are handled by the SDRclose team.

Annex 1: Details of processing

This Annex describes the processing carried out under this Addendum. It also completes the corresponding annex of the Standard Contractual Clauses and the corresponding table of the UK Addendum.

Parties and roles

Data exporter: Customer, the entity that accepted the Terms of Service, identified by the details held on its account, acting as controller or, under 3.2, as processor. Data importer: BiopharmaWatch LLC, a United States limited liability company and the operator of SDRclose, acting as processor or, under 3.2, as sub-processor. Contact details: the account address for Customer; the contact form on the SDRclose website for SDRclose.

Subject matter

The provision of the SDRclose outbound sales platform to Customer, including the processing of Prospect Data needed to discover, research, contact and follow up with Customer's prospects from Customer's own mailboxes.

Duration

The term of the Agreement and any period afterwards during which SDRclose retains Customer Data under section 11.

Nature and purposes of the processing

Collection of prospect records from the prospect data provider, by CSV import and by manual entry; storage and organization into lists, sequences and tags; enrichment; research from public web sources; drafting and generation of message copy; scheduling and sending messages from Connected Mailboxes; monitoring Connected Mailboxes for replies, bounces and automated responses and classifying them; optional automated replies and meeting booking in Customer's calendar; recording engagement events where Customer enables tracking; maintaining Suppression Records; reporting within the account; export and deletion at Customer's request.

Categories of data subjects

Customer's prospects and the recipients of its messages; Customer's Authorized Users, to the extent their details appear in Prospect Data, for example in message signatures; and people who reply to, forward or are copied on messages sent through the Service.

Categories of personal data

Business contact details (name, work email address, job title, employer, seniority, business phone number where supplied, business location, professional profile URL); firmographic attributes of the employer (industry, headcount, location, website and similar attributes supplied by the prospect data provider); research notes compiled from public sources; message content sent from Connected Mailboxes; reply content, including quoted history, and its classification; engagement events (delivery, bounce, reply, meeting booked, and open and click where Customer enables tracking); opt-out records; lead status, score, tags and list membership.

Special categories of personal data

None. Customer must not submit special categories of personal data or the other prohibited data described in 4.5.

Frequency of the processing

Continuous while the account is active, on the schedule set by Customer's sequences, mailbox limits and automation settings.

Retention

As described in the Terms of Service, the Privacy Policy and section 11: for the term of the Agreement, subject to Customer's retention settings; deleted from the live service on account deletion, with backups falling out of retention within 30 days; Suppression Records retained.

Transfers to sub-processors

Sub-processors in the categories listed in Annex 3 process Prospect Data for the purposes described there, for the duration of their engagement, under written contracts as described in section 7 and the transfer mechanisms described in section 13.

Competent supervisory authority

For the European Economic Area, determined in accordance with 13.2. For the United Kingdom, the Information Commissioner. For Switzerland, the Federal Data Protection and Information Commissioner.

Annex 2: Technical and organizational measures

SDRclose maintains the following measures to protect Customer Data. They are described at category level. Further detail sufficient for a security review is shared with customers and prospective customers on request through the contact form, under confidentiality obligations where appropriate. The Security page carries the current public description.

• Encryption in transit. All traffic between users, the Service and its components is encrypted in transit.
• Protection of credentials. Connected Mailbox credentials and access tokens are encrypted at rest and are never displayed back in plain text.
• Password storage. Passwords are stored only as salted hashes. Account holders who sign in through a supported identity provider have no password held by SDRclose.
• Identity verification. Email addresses are verified at signup before an account is activated.
• Authentication controls. Rate limiting and lockout protections apply to sign-in and other authentication endpoints. Single-purpose links, such as unsubscribe links, cannot be used to sign in.
• Network segregation. Production data stores are not exposed to the public internet and are reachable only by the application.
• Input validation. Every request to the Service is validated before it is processed, and error responses do not expose internal detail.
• Browser protections. Modern browser security headers are applied to the website and the application.
• Backups. Routine encrypted backups are taken and retained on a rolling basis, so that data can be recovered after a failure and deleted data falls out of retention within the period stated in section 11.
• Logging. Personal data, including email addresses, is masked in operational logs. Logs are used for security monitoring and troubleshooting.
• Access control. Access to production systems and to Prospect Data is restricted to authorized personnel who need it for their role and is removed when it is no longer needed. Personnel are bound by confidentiality obligations as described in section 5.
• Payment data. Payment card details are entered on the payment processor's hosted checkout and never touch SDRclose systems.
• Deletion controls. Account deletion requires re-authentication and is irreversible. Customer Data is deleted from the live service as described in section 11.
• Customer data controls. Open and click tracking is off by default and is enabled by Customer per sequence. An optional retention sweeper purges older message content on Customer's schedule. Per-lead deletion and full export are available at any time.
• Sub-processor management. Sub-processors are assessed before engagement and contracted under written data protection terms. Changes follow section 7.
• Incident response. Security events are triaged, contained and investigated, and Personal Data Breaches are notified under section 10.
• Vulnerability reporting. Suspected vulnerabilities can be reported through the contact form and are reviewed by the SDRclose team.

Annex 3: Sub-processors

The following categories of sub-processor process Prospect Data on SDRclose's behalf. The canonical, maintained list is the Sub-processors page. The named schedule, identifying each provider, its location and the transfer mechanism relied on, is provided to customers and prospective customers on request through the contact form and, once provided, forms part of this Annex. Changes follow section 7.

Annex 4: Regional terms

This Annex applies in addition to the body of this Addendum where Prospect Data is subject to the laws of the regions below. If a term in this Annex conflicts with the body of this Addendum, the term in this Annex prevails for that region.