Data Processing Addendum (DPA)

2.1. Controller and Processor Allocation. Because GEDZU PTE. LTD. does not maintain a pre-compiled multi-tenant contact database and executes automated extraction and AI Signal-Scoring strictly upon Client’s commission and according to the target criteria, geography, and buying signals defined in Client’s Playbook, the Parties acknowledge and agree that Client acts as the Data Controller (or “Business” under the CCPA), as Client determines the purposes and essential means of the processing by commissioning the Order and specifying the Playbook, and GEDZU PTE. LTD. acts strictly as the Data Processor (or “Service Provider / Contractor” under the CCPA / “Data Intermediary” under the Singapore PDPA), processing Personal Data solely on behalf of and in accordance with Client’s documented instructions.

2.2. Statutory Exemptions Applicable to Processing. If and to the extent that specific data records processed under an Order are exempt from or outside the scope of a given Data Protection Law—including: (a) pure corporate data relating to legal persons under Recital 14 GDPR; (b) Business Contact Information (BCI) exempt from Parts 3 to 6 of the Singapore PDPA under Section 4(5) PDPA; or (c) Publicly Available Information excluded from the definition of Personal Information under Cal. Civ. Code § 1798.140(v)(2)—this DPA shall apply only to the extent required by mandatory applicable law.

3.1. Processing on Documented Instructions (Art. 28(3)(a) GDPR). GEDZU PTE. LTD. shall process Personal Data solely in accordance with Client’s documented instructions as set forth in the Agreement, this DPA, and the mutually confirmed Playbook, unless required to do otherwise by applicable law, in which case Processor shall inform Client of that legal requirement before processing (unless prohibited by law on important grounds of public interest).

3.2. CCPA Service Provider Certification. With respect to any Personal Data subject to the CCPA, GEDZU PTE. LTD. certifies that it acts as a Service Provider and shall not: (a) “sell” or “share” (for cross-context behavioral advertising) Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than the specific business purpose of performing the Services specified in the Agreement; (c) retain, use, or disclose the Personal Data outside of the direct business relationship between GEDZU PTE. LTD. and Client; or (d) combine the Personal Data extracted for Client with personal information received from or on behalf of another person to build a multi-tenant data broker product.

3.3. Confidentiality of Personnel (Art. 28(3)(b) GDPR). GEDZU PTE. LTD. shall ensure that all personnel and contractors authorized to process Personal Data have committed themselves to written confidentiality obligations or are under an appropriate statutory obligation of confidentiality.

3.4. Technical and Organizational Security Measures (Art. 32 GDPR & PDPA s. 24). GEDZU PTE. LTD. shall implement and maintain appropriate technical and organizational measures (“TOMs”) designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, as detailed in Annex II to this DPA.

3.5. AI Zero-Training Guarantee. When routing unstructured public web text or Playbook parameters through third-party Large Language Model APIs (such as the Google Gemini API), GEDZU PTE. LTD. utilizes exclusively enterprise/paid commercial API endpoints that contractually prohibit the LLM provider from using customer payloads to train or improve foundation models.

4.1. Lawfulness of Instructions and Legitimate Interest Assessment. Client warrants that its Playbook instructions comply with all applicable Data Protection Laws. Where Client relies on Article 6(1)(f) GDPR (Legitimate Interests) for commissioning B2B lead extraction and scoring, Client is responsible for maintaining its internal Legitimate Interest Assessment (LIA).

4.2. Downstream Transparency and Outreach Compliance (Art. 14 GDPR & § 7 UWG). Once GEDZU PTE. LTD. delivers the single-tenant Deliverable to Client, Client acts as the sole Data Controller determining whether and how to contact any listed Data Subject. Client is solely responsible for: (a) providing any required data protection transparency notices to Data Subjects at the time of first communication pursuant to Article 14(3)(b) GDPR; (b) ensuring all outreach channels comply with § 7 of the German UWG, the US CAN-SPAM Act / TCPA, and the Singapore PDPA Eighth Schedule; and (c) honoring all Data Subject opt-out or objection requests under Article 21 GDPR.

5.1. General Written Authorization. Client grants GEDZU PTE. LTD. general written authorization to engage one or more of the sub-processors listed in Annex III (“Authorized Sub-Processors”) as needed to support the execution of the commissioned Playbook modules.

5.2. Sub-Processor Protections. GEDZU PTE. LTD. has entered into written data processing agreements with each Authorized Sub-Processor imposing data protection obligations substantially equivalent to those set forth in this DPA (including EU Standard Contractual Clauses where applicable). GEDZU PTE. LTD. remains liable to Client for the performance of each Authorized Sub-Processor’s data protection obligations in accordance with the Agreement.

5.3. Changes to Sub-Processors and Objection Right. GEDZU PTE. LTD. shall update the list of Authorized Sub-Processors on /dpa at least fourteen (14) calendar days prior to authorizing any new sub-processor to process Personal Data. Client may object to a new sub-processor on reasonable, documented data protection grounds within ten (10) calendar days of such update by notifying dpo@gedzu.net. If the Parties cannot resolve the objection within a reasonable time, Client may terminate the affected unexecuted Order prior to run initiation.

6.1. Assistance with Data Subject Requests (Art. 28(3)(e) GDPR). Taking into account the nature of the processing, GEDZU PTE. LTD. shall provide reasonable assistance to Client by appropriate technical and organizational measures, insofar as possible, for the fulfilment of Client’s obligation to respond to requests for exercising Data Subject rights under Chapter III of the GDPR (or analogous laws).

6.2. Personal Data Breach Notification (Art. 33(2) GDPR). GEDZU PTE. LTD. shall notify Client without undue delay—and in any event within forty-eight (48) hours—after becoming aware of any confirmed Personal Data Breach affecting Client’s single-tenant Deliverables or Playbook environment, providing sufficient information to enable Client to evaluate any regulatory notification duties.

7.1. Deletion upon Termination (Art. 28(3)(g) GDPR). Ephemeral extraction logs within cloud compute environments expire automatically within seven (7) to thirty (30) days of run completion. Within thirty (30) calendar days following the completion or termination of the Agreement (or immediately upon Client’s written request), GEDZU PTE. LTD. shall permanently delete its copies of the single-tenant Google Sheet Deliverables generated for Client, unless retention of specific billing metadata is required by Singapore statutory law.

7.2. Audit and Demonstration of Compliance (Art. 28(3)(h) GDPR). Upon Client’s written request (no more than once per twelve-month period), GEDZU PTE. LTD. shall make available to Client all information reasonably necessary to demonstrate compliance with this DPA, including responses to written security questionnaires and third-party compliance documentation (such as SOC 2 Type II / ISO 27001 reports published by its underlying cloud sub-processors).

8.1. Incorporation of EU Standard Contractual Clauses (Module Two). To the extent that the processing of Personal Data under this DPA involves a restricted transfer of Personal Data subject to the EU GDPR from the EEA or Switzerland to GEDZU PTE. LTD. in Singapore, the Parties agree that Module Two (Controller-to-Processor) of the EU SCCs (Commission Implementing Decision (EU) 2021/914) is hereby incorporated by reference and deemed executed between Client (as “data exporter”) and GEDZU PTE. LTD. (as “data importer”). Under Clause 7 (Docking Clause), the optional docking clause is included. Under Clause 9(a) (Use of Sub-processors), Option 2 (General Written Authorisation) applies, with a prior notice period of fourteen (14) calendar days. Under Clause 11(a) (Redress), the optional language requiring an independent dispute resolution body is omitted. Under Clause 17 (Governing Law), Option 1 applies, and the EU SCCs shall be governed by the laws of the Federal Republic of Germany (or, if Client is established in another EEA Member State, the laws of that Member State). Under Clause 18(b) (Choice of Forum and Jurisdiction), any dispute arising directly from the EU SCCs shall be resolved by the courts of the Federal Republic of Germany (or the EEA Member State in which the data exporter is established). For transfers subject to the Swiss FADP, references to the GDPR include the Swiss FADP, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC).

8.2. UK International Data Transfer Addendum. For transfers of Personal Data subject to the UK GDPR, the UK Addendum is incorporated by reference: Tables 1 to 3 of the UK Addendum are populated with the information in Annexes I, II, and III of this DPA, and in Table 4, either Party may end the UK Addendum in accordance with Section 19 thereof.