Cleverlead — Data Processing Addendum

• Roles. With respect to Personal Data, you act as the data controller (determining the purposes and means of processing) or, where you process such data for a third party, as a processor. Cleverlead acts solely as your processor (or sub-processor, as applicable) and in no event as the controller of Personal Data.
• Instructions. You instruct us to process Personal Data as needed to provide the Service, in accordance with the Terms of Service and this DPA, which together constitute your complete and final instructions. Additional or deviating instructions require our prior written agreement.
• Your warranty. You warrant that all Personal Data submitted to the Service was collected lawfully, that you have all rights, permissions and lawful bases (including any required consents and notices to Data Subjects) to submit it and have it processed as described, and that your use complies with the Applicable Data Protection Laws (defined below) and with the sensitive-data restrictions in the Terms of Service.

• Applicable law. Each party will comply with the data protection laws applicable to it, which may include the Israeli Protection of Privacy Law, 5741-1981 and its regulations, the EU Regulation 2016/679 (GDPR), the UK GDPR, and applicable US state privacy laws such as the CCPA/CPRA (collectively, "Applicable Data Protection Laws").
• Processing. We process Personal Data solely to provide, secure, support and improve the Service in accordance with the Terms of Service. The nature, purposes and duration of processing, and the categories of Personal Data and Data Subjects, are determined by you through your use of the Service, as further described in Exhibit A. We may also process Personal Data in fully anonymized or aggregated form, as set out in the Terms of Service.
• Confidentiality. We ensure that persons authorized by us to process Personal Data are bound by confidentiality obligations and are informed of the confidential nature of the data.

The Service is built and operated on third-party infrastructure provided by Base44 (Base44, Inc. / Wix.com Ltd.) and its sub-processors. We rely on, and pass through to you, the technical and organizational security measures implemented by such providers, as described in Exhibit B, and we apply organizational measures on our side, including least-privilege access to Personal Data and confidentiality undertakings. You are responsible for reviewing this information, determining that the Service meets your requirements and legal obligations, properly configuring the Service (including roles and permissions), and maintaining the security of your credentials. By using the Service, you agree to the adequacy of these measures for your intended use.

• Authorization. You provide general authorization for us to engage sub-processors to process Personal Data in order to provide the Service. Our sub-processors are listed in Exhibit C and principally consist of Base44 (Base44, Inc. / Wix.com Ltd.; our platform, hosting and AI provider) and its own sub-processors, as well as messaging delivery providers where you use the Service to send communications.
• Flow-down and liability. Sub-processors are subject to data protection terms materially no less protective than this DPA (in the case of Base44, the Base44 Data Processing Addendum). We remain liable to you for any breach of this DPA caused by our sub-processors, subject to the limitations in the Terms of Service.
• Changes and objection. We will update Exhibit C (or the page it links to) within a reasonable time after we become aware of any addition or replacement of sub-processors. You may subscribe to change notifications by emailing info@avichainavi.com. You may object to a new sub-processor on documented, reasonable data-protection grounds within seven (7) days of notice by writing to info@avichainavi.com. If we cannot reasonably accommodate the objection within thirty (30) days, your sole remedy is to discontinue the affected Service and cancel your subscription, without prejudice to fees incurred before discontinuation. Absent a timely objection, the new sub-processor is deemed authorized.

Upon becoming aware of a confirmed incident in which Personal Data processed on your behalf was accidentally or unlawfully destroyed, lost, altered, or accessed or disclosed without authorization, we will notify you without undue delay, as required by Applicable Data Protection Laws. We will use reasonable efforts to include available information about the nature of the incident, the categories and approximate scope of affected data and Data Subjects, likely consequences, and measures taken or planned. Notification is not an acknowledgment of fault or liability. You acknowledge that you may have your own notification and mitigation obligations toward Data Subjects and authorities under Applicable Data Protection Laws.

• Requests to us. If we receive a request from a Data Subject concerning Personal Data processed on your behalf, we will promptly notify you and will not respond on your behalf beyond directing the Data Subject to you. Taking into account the nature of the processing, we will provide you with readily available information and use the tools available in the Service (such as search, edit, export and delete functions) to assist you in fulfilling your obligation to respond.
• Authorities. Unless legally prohibited, we will promptly notify you of any binding request from a governmental or law-enforcement authority to access Personal Data, and will limit any disclosure to what we reasonably believe is legally required.
• Records. To the extent required by Applicable Data Protection Laws, we will maintain records of our processing activities on your behalf and, upon reasonable request, provide information necessary to demonstrate compliance with this DPA.

Upon your reasonable written request, no more than once every 12 months and subject to confidentiality undertakings, we will make available to you documentation reasonably available to us that demonstrates compliance with this DPA, including relevant reports, certifications or summaries made available by our platform provider and its sub-processors. To the extent such documentation does not satisfy a mandatory audit right you have under Applicable Data Protection Laws, we will reasonably cooperate with written questionnaires or other reasonable remote methods, at your expense and without imposing costs on us.

Personal Data may be transferred to and processed in countries other than the country in which it was collected, including the United States and the European Union, through our platform provider and its sub-processors. Any transfer of Personal Data originating from the EEA, the United Kingdom or Switzerland to a country not recognized as providing an adequate level of protection will be made under lawful transfer mechanisms implemented by us or our providers, such as adequacy decisions, the EU-US Data Privacy Framework (and its UK and Swiss extensions), or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 or 3 as applicable, which are incorporated by reference where they apply, with Clause 7 not applying, Clause 9 option 1 applying, and Ireland as the referenced Member State in Clauses 17 and 18; for UK and Swiss transfers, the applicable mandatory amendments apply mutatis mutandis. Transfers of Personal Data originating from Israel are made in accordance with the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

Upon termination of your subscription or upon your written request to delete your account, we will delete the Personal Data processed on your behalf, except for: (a) data we are required to retain by applicable law; and (b) residual copies held in routine backups by our infrastructure providers, which are erased in accordance with their scheduled backup cycles. Any Personal Data retained under these exceptions remains subject to this DPA and will not be used for any other purpose until deleted. Export tools are described in the Terms of Service; you are responsible for exporting Personal Data before termination.

To the extent US state privacy laws (including the CCPA/CPRA) apply to Personal Data, the terms "Personal Data", "Data Subject", "controller" and "processor" include "Personal Information", "Consumer", "Business" and "Service Provider" respectively. We will not: sell or share Personal Data; retain, use or disclose it for any purpose other than the business purposes specified in this DPA and the Terms of Service; combine it with information from other sources except as permitted for service providers; or engage sub-processors other than as described in this DPA. You may take reasonable steps, as set out in Section 7, to verify our compliance, and may terminate this DPA and delete your account upon unauthorized use of Personal Data.

• Notification of non-compliance. We will notify you if we determine that we can no longer meet our obligations under this DPA or Applicable Data Protection Laws.
• Liability. All liability arising under or in connection with this DPA, including any limitations and caps, is governed by the Limitation of Liability provisions of the Terms of Service.
• Amendments. We may amend this DPA from time to time by posting the amended version on our website; material changes will be notified in accordance with the Terms of Service. Continued use of the Service after the effective date constitutes acceptance.
• Order of precedence. In case of conflict regarding the processing of Personal Data, this DPA prevails over the Terms of Service; where the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.
• Severability. If any provision of this DPA is held invalid or unenforceable, it is deemed severed and the remaining provisions remain in effect.

• Nature and purpose: hosting, storage, organization, display, transmission, analysis and other processing of Personal Data as needed to provide the Cleverlead CRM Service and its features (including AI features and communications you send through the Service), to act on your instructions and support requests, to prevent and investigate security incidents, fraud and prohibited activity, and to comply with law.
• Duration: for the term of your subscription and until deletion in accordance with Section 9.
• Categories of Personal Data: determined by you through your use of the Service; typically contact and identification details (name, email, phone, company, role), communications, notes, transaction and deal information, and any other data you choose to store, subject to the sensitive-data restrictions in the Terms of Service.
• Categories of Data Subjects: determined by you; typically your existing and prospective customers, leads and end users, business partners, suppliers and their respective contact persons and employees, and any other individuals whose data you choose to store in the Service.

The Service is hosted and operated on the Base44 platform. The technical and organizational security measures applicable to the infrastructure processing Personal Data are those implemented and maintained by Base44, Inc. and its sub-processors, as described at https://base44.com/dpa/exhibitb (as updated from time to time). In addition, Cleverlead applies the following organizational measures: access to Personal Data is limited to personnel who need it to provide and support the Service; such personnel are bound by confidentiality obligations; administrative access is protected by strong authentication; and routine administrative monitoring is limited to usage metadata, with content accessed only for support, security or legal purposes as described in the Terms of Service.

• Base44 (Base44, Inc. / Wix.com Ltd.) — application platform, hosting, storage and AI capabilities — together with its own sub-processors, listed at https://base44.com/dpa/exhibitc (as updated from time to time).
• Messaging delivery providers — where you use the Service to send emails or messages to your contacts, delivery may be performed through the messaging capabilities of the Base44 platform or a dedicated delivery provider (such as Resend or a similar service), as indicated in the Service or on our website.