Data Processing Addendum

Effective August 17, 2026

This DPA applies where UNCLOSED processes personal data on behalf of a business customer.

1. Roles and Instructions

Customer is the controller/business and UNCLOSED is the processor/service provider with respect to Customer Personal Data, except where law assigns different roles. UNCLOSED processes such data only on documented instructions, including as necessary to provide the Services and comply with law.

2. Processing Details

Processing may include hosting, organizing, analyzing, scoring, classifying, summarizing, securing, supporting, returning, and deleting Customer-authorized business records concerning leads, prospects, customers, personnel, and business contacts.

3. Confidentiality, Security and Subprocessors

UNCLOSED will apply appropriate confidentiality obligations and reasonable technical and organizational safeguards. Customer provides general authorization for subprocessors necessary to provide the Services.

4. Rights and Compliance Assistance

UNCLOSED will provide reasonable assistance with legally valid data-subject requests and applicable compliance obligations, taking into account the nature of processing.

5. Security Incidents

UNCLOSED will notify Customer without undue delay after becoming aware of a confirmed breach of Customer Personal Data where notification is required by applicable law or this DPA.

6. Return, Deletion and Audits

Following termination, UNCLOSED will delete or return Customer Personal Data as required by law and technical capabilities, subject to limited backup, security, fraud-prevention, and legal-retention needs.

7. International and U.S. State Terms

Where required, international transfers will use a legally recognized mechanism. To the extent required by U.S. state privacy law, UNCLOSED will process Customer Personal Data only for permitted business purposes and will not sell it or use it for prohibited cross-context behavioral advertising.