Data Processing Addendum

1. Parties and Scope

This Data Processing Addendum ("DPA") forms part of the MyLeadTeam Terms of Service between the Customer, as controller, and BuildFlow Angelika Kotarba, NIP 6711821792, as processor. It applies when MyLeadTeam processes personal data contained in Customer lead lists, campaigns, messages, and related records on the Customer's behalf. GDPR terms have the meanings given to them in Regulation (EU) 2016/679.

2. Processing Instructions

The processor will process Customer personal data only to provide, secure, support, and maintain the Service under the Terms and the Customer's documented configuration and instructions, unless Union or Member State law requires otherwise. The Customer instructs the processor to perform lead storage and enrichment, AI-assisted research and drafting, campaign delivery, suppression, engagement measurement where enabled, and related support operations. The Customer is responsible for the lawfulness, accuracy, and transparency of its instructions and source data.

3. Processing Details

• Duration: for the subscription term and deletion or return period described in the Terms and Privacy Policy.
• Data subjects: Customer users, business leads, prospects, senders, and message recipients.
• Data: identity and business contact data, company and role information, public-source enrichment, campaign content, suppression records, and delivery or engagement events.
• Purpose: providing the Customer-configured B2B outreach workflow and its security, support, and reliability functions.

4. Confidentiality and Security

Persons authorised to process Customer personal data are bound by confidentiality. The processor maintains technical and organisational measures appropriate to the risk, including encrypted transport, encrypted SMTP credentials, access controls scoped by organisation and role, credential hashing, service monitoring, backups, and incident response procedures. The processor will review these controls as the Service evolves.

5. Sub-processors and Transfers

The Customer grants general written authorisation for the sub-processors listed in the Privacy Policy. The processor will impose data-protection obligations appropriate to the services they provide and remains responsible for its obligations under this DPA. The processor will inform affected Customers of an intended material sub-processor change by email or an in-product notice where required, allowing a reasonable period to raise a substantiated data-protection objection. International transfers use an applicable adequacy decision, Standard Contractual Clauses, or another lawful Chapter V GDPR mechanism.

6. Assistance and Incidents

Taking into account the nature of processing and information available, the processor will reasonably assist the Customer with data-subject requests, security obligations, breach notifications, data-protection impact assessments, and prior consultations. The processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data and will provide available information needed for the Customer's response.

7. Return, Deletion and Audit Information

During an active account, the Customer may use available export functions. On account deletion, Customer data is removed from the active product database as described in the Privacy Policy, except where retention is required by law or applies to independent controller records. On reasonable written request, the processor will provide information necessary to demonstrate compliance with Article 28 GDPR and permit a proportionate audit where required, subject to confidentiality, security, reasonable advance notice, and avoidance of disruption or exposure of other customers' data.

8. Contact and Order of Precedence

Privacy and DPA requests may be sent to support@myleadteam.com. If this DPA conflicts with the Terms on processing Customer personal data, this DPA controls. The governing-law and liability provisions in the Terms otherwise apply.