Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the LeadNova AI Terms of Service when you process personal data subject to GDPR, UK GDPR, LGPD, or analogous laws. 1. Roles. You are the controller; LeadNova AI is the processor for the workspace data you upload or import into the Service. 2. Subject matter & duration. We process personal data only to provide and support the Service for the term of your subscription, plus any retention period required by law. 3. Categories of data subjects. Your end users (contacts, leads, message recipients) and the team members you invite to your workspace. 4. Categories of personal data. Names, contact details, conversation content, message metadata, and any other personal data you choose to store or process. 5. Sub-processors. Current list is published at leadnova.app/legal/dpa-subprocessors and updated in advance of any change. You may object to a new sub-processor for material reasons within 30 days; if not resolvable we will allow you to terminate the affected portion of the Service for a pro-rata refund. 6. Security. We implement technical and organisational measures appropriate to the risk: encryption in transit and at rest, role-based access, audit logging, vulnerability management, vendor due diligence, incident response. 7. International transfers. Where personal data is transferred outside the EEA / UK we rely on the EU Standard Contractual Clauses (Module Two) and the UK Addendum. 8. Sub-processor liability. We remain liable for the acts and omissions of our sub-processors as if performed by us. 9. Data subject rights & assistance. We will assist you in responding to data subject requests within statutory time limits. 10. Breach notification. We notify you without undue delay (and in any event within 72 hours of becoming aware) of a confirmed personal data breach affecting your data. 11. Audits. Once per 12-month period, on 30 days' notice, you may audit our compliance via written questionnaire or, where required, on-site review during business hours. 12. Deletion / return. On termination we will delete or return personal data within 30 days, except where retention is required by law. 13. Counter-signed copies. Email legal@leadnova.app with your entity name to request a counter-signed PDF.