Data Processing Addendum (DPA)

This Addendum is entered into between:

1. V1CE Limited, a company registered in England and Wales (Company No. 12681711) ("Processor"); and
2. The Customer, who uses the V1CE Client Capture OS and enrichment services ("Controller").

1. Purpose and Scope

This DPA applies where V1CE processes "Lead Data" (Personal Data) on behalf of the Customer as part of the V1CE Client Capture OS services, including lead enrichment via third-party providers (Apollo.io and Bright Data).

2. Roles and Instructions

• Roles: The Customer is the Data Controller and V1CE is the Data Processor.
• Instructions: V1CE shall only process Lead Data in accordance with the Customer's documented instructions (e.g., triggering an "Enrich" command in the dashboard) unless required by law.
• Compliance: The Customer warrants that they have a lawful basis (e.g., Legitimate Interest or Consent) to process and enrich the Lead Data they upload to V1CE.

3. Security and Confidentiality

V1CE shall implement appropriate technical and organizational measures to protect Lead Data, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2+).
• Ensuring that personnel authorized to process Lead Data have committed themselves to confidentiality.

4. Sub-Processors

• Authorization: The Customer provides general authorization for V1CE to engage sub-processors for data enrichment.
• Approved Sub-Processors: The Customer specifically approves the use of Apollo.io (Apollo Global Corp) and Bright Data Ltd.
• Liability: V1CE remains liable for the performance of its sub-processors' data protection obligations.

5. Data Subject Rights

V1CE shall, insofar as is possible, assist the Customer in responding to requests from individuals (Leads) exercising their rights under GDPR (e.g., requests for deletion or access).

6. International Transfers

Where Lead Data is transferred outside the UK/EEA (e.g., to Apollo.io servers in the USA), V1CE ensures such transfers are governed by the UK Addendum or Standard Contractual Clauses (SCCs) to ensure an adequate level of protection.

7. Data Breach Notification

V1CE shall notify the Customer without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach affecting the Customer's Lead Data.

8. Deletion or Return of Data

Upon termination of the Service or at the Customer's request, V1CE shall delete or return all Lead Data, unless required by UK or EU law to retain certain records.

Annex 1: Details of Processing

• Subject Matter: Provision of networking and lead management services via the V1CE Client Capture OS.
• Duration: For the duration of the Customer's subscription.
• Nature of Processing: Storage, management, and enrichment of professional contact data.
• Data Types: Name, Job Title, Employer, Professional Email, LinkedIn URL, and Company Firmographics.
• Data Subjects: Leads, prospects, and business contacts of the Customer.