Terms of Service

Last Updated: August 6, 2026

These Terms of Service (“Terms of Service” or “Terms”) are a legally binding agreement between you (“you” or “your”) and Breakthrough Sales Corp d/b/a Breakthrough, (“Breakthrough,” “we,” “our,” or “us”) governing your use of the Service and your relationship with us.

You accept and agree to these Terms of Service, Data Processing Addendum and Privacy Policy by:

• Accessing or using the Service;
• Clicking to accept these Terms of Service, or
• Accepting these Terms of Service in any other way.

If you do not agree to these Terms of Service, you shouldn't access (and you don't have our permission to access) the Service.

Important: Please note sections 7 and 8 of these Terms which include important information regarding Personal Information you provide to us or receive from us. Please also note section 11, which contains arbitration provisions that impact certain rights you might otherwise have regarding disputes.

We may modify these Terms of Service (except for section 11) in our sole discretion by posting updated versions of these Terms of Service on the Website or otherwise providing notice to you. All such changes shall become effective upon the posting of the revised Terms of Service on the Website or upon notice to you, as applicable.

1. Definitions

• “Account Information” means information provided by you to create, support and maintain an account enabling access to the Service
• “Breakthrough Platform” means the software or other technology provided by us to you under these Terms. The Breakthrough Platform does not include Third-Party Products,
• “Beta Services” means products, services, integrations, functionality or features that Breakthrough may make available to you to try at your discretion, which may be described as “alpha,” “beta,” “pilot,” “limited release,” “developer preview,” “non-production,” “early-stage”, or other similar description,
• “Customer Data” has the meaning given in the Privacy Statement and the DPA, and includes Recordings, transcripts, CRM records, and other content and materials you submit for processing on your behalf. Customer Data is a subset of Submitted Data,
• “Customer Representative Data” means Personal Information about you and your representatives that we process as a controller, as described in the Privacy Statement,
• “Data Processing Addendum” or “DPA” means the Breakthrough Data Processing Addendum attached as Exhibit A to these Terms and incorporated by reference,
• “Data Provider” means a third-party data or enrichment vendor that we may engage, on your behalf and at your direction, to look up, match, verify, or append information (such as professional profile information) relating to your contacts,
• “Privacy Statement” means the Breakthrough Privacy Statement, available at https://www.breakthroughsales.io/privacy, as we may update it from time to time,
• “Recordings” has the meaning given in the Privacy Statement, and includes recordings, transcripts, and automated summaries of sales calls, meetings, or other interactions, together with associated metadata and the names, voices, and images of participants,
• “Breakthrough Database” means the aggregated, de-identified, anonymized, and/or benchmark data that we may derive from use of the Service and maintain for our own purposes as permitted under Section 6 and the DPA. For the avoidance of doubt, the Breakthrough Database does not consist of, and we do not resell, identifiable Submitted Data (including Recordings) or Customer Data,
• “Output Data” means the enrichment, insights, knowledge resources, and other results that we make available to you through the Breakthrough Platform in connection with your own Submitted Data and account, together with any aggregated or de-identified data described above. Output Data is exclusive of the Submitted Data,
• “Order Form” means an ordering document, including an order receipt, related to your ordering of the Service and specifying the details of your subscription and any fees to be paid by you,
• “Personal Information” includes any substantially similar terms to “personal information” such as “personal data” or “personally identifiable information” and as to each, shall have the meaning given to such terms under applicable law,
• “Service” means the Output Data, the Service Metadata, the Breakthrough Platform and any data contained therein, the Beta Services and any accompanying or related infrastructure, functionality, technology or analytics, including any services or add-ons described in an Order Form,
• “Service Metadata” means information collected or inferred by us in the course of delivering emails (including without limitation information about deliverability and system operations) or otherwise providing the Service,
• “Submitted Data” means all data, information, text, recordings, and other content and materials that are collected, submitted, provided, or otherwise transmitted or stored by you in connection with your use of the Service. Submitted Data may vary depending on the products or features used as well as your particular use of such products or features. Submitted Data does not include Output Data or Service Metadata, Submitted Data includes the “Customer Data” (including “Recordings”) described in the Privacy Statement and the DPA.
• “Third-Party Products” means products, services, websites, applications or other technology, and any related content, that you choose to integrate with or use in connection with the Service. Third-Party Products are not owned or operated by us,
• “UK/EU GDPR” means the General Data Protection Regulation (Regulation (EU) 2016/679) and equivalent requirements in the United Kingdom including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation,
• “Website” means any website or webpage on which these Terms appear,

2. Your Account; Eligibility Restrictions; Beta Services; Third-Party Products

• Account information. You will need to set up an account in order to access the Service, including to receive Output Data. You must only provide Account Information that is your own and that is accurate. You must also keep your contact information up to date, so that we may contact you if needed, such as to deliver any important notices.
• Eligibility restrictions. You shall ensure that only your employees or service providers, or the employees or service providers of your wholly or majority owned subsidiaries who have been expressly authorized by you to use the Service in accordance with this Terms of Service, shall use or otherwise access the Service (“Authorized Users”). You may not use the Service if you or any of your Authorized Users are a competitor of Breakthrough (as determined by us in our sole discretion). You shall ensure that all Authorized Users are at or above the age of majority in their jurisdiction. You must comply with any other eligibility restrictions on Authorized Users set forth in the Order Form and ensure that your Authorized Users comply with these Terms.
• Account security. We make no representations or promises regarding the security of the Service. Despite our security efforts, it is possible that unauthorized individuals will obtain your information, such as through web-scraping tools (even though we do not authorize and in fact prohibit that behavior). You agree and understand that you will be liable for any activity that occurs through your account and further acknowledge and agree that you and your Authorized Users:
  • are solely responsible for maintaining the confidentiality and security of your Account Information and account credentials such as your username and password.
  • may not share your account credentials and must restrict access to your computer and other devices.
  • must access the Service and our network, systems, or applications only through encrypted connections.
  • must maintain up-to-date OS (operating system) patching and active anti-malware on the end-user devices used to connect to the Service or our environment.
  • must ensure that all terminated employees or other users have their access revoked to the Service within 24 hours of termination.
  • must notify us promptly (and in any event within 72 hours) of security incidents that could have implications to us (e.g. users with compromised credentials or lost or stolen devices with access to the Service, compromised networks or systems including malware worm or ransomware, etc.).
  • will reach out to our vulnerability discovery program at support@breakthroughsales.io if you suspect any vulnerabilities with our Service.
• Beta Services. From time to time, Breakthrough may offer you access to Beta Services, which are optional for you to use. The Beta Services are not made generally available and may contain bugs, errors, defects, or harmful components. Beta Services may be subject to additional terms which may supplement, but not supersede the terms of these Terms of Service. Breakthrough may terminate access to Beta Services at any time without notice, and may discontinue Beta Services at any time in its sole discretion. NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED HEREIN, BETA SERVICES ARE PROVIDED ‘AS IS’ WITHOUT ANY COMMITMENTS, INDEMNITY OR WARRANTY BY BREAKTHROUGH OF ANY KIND AND BREAKTHROUGH SHALL HAVE NO LIABILITY WHATSOEVER FOR ANY DAMAGE OR HARM ARISING FROM OR RELATED TO BETA SERVICES.
• Third-Party Products. You may procure and use Third-Party Products in connection with the Service. You acknowledge and agree that if you or your users view, access or otherwise interact with Third-Party Products, you or your users, as the case may be, do so at your own risk and we have no liability arising from such access or use. You (and your users, as applicable) are responsible for complying with all terms, conditions and policies imposed by a provider of a Third-Party Product. We cannot guarantee the continued availability of integrations of Third-Party Products with the Service and may cease providing interoperation with a Third-Party Product without entitling you to any refund, credit, or other compensation, if, for example and without limitation, the provider of a Third-Party Product ceases to make the Third-Party Product available for interoperation with the Service in a manner acceptable to us.

3. Account Types; Credits and Payment Terms

• Free Beta Service Trial. We may provide the entire Service as a limited term free Beta Service
• Subscriptions or customized service accounts. We may provide the Service through paid accounts, such as by offering a monthly or annual subscription, or through customized provision of service and payment terms (as further set forth under an Order Form or separate agreement). If you wish to enter into such an agreement, please contact us at support@breakthroughsales.io.
• Paid and unpaid self-serve accounts. The Service may also be offered as a paid or unpaid account on a “self-serve” basis, in which case you will have the opportunity to click-through these Terms and select the aspects of the Service you want to use, including an amount of credits that can be used toward the Service. You may not open multiple accounts for your use under a self-serve offering or otherwise take any actions which would allow you to circumvent the credit or rate limits which apply to self-serve offerings. Should we discover you doing so, we may in our sole discretion terminate your account immediately, with no right to refund or reinstatement.
• Fair use policy. We offer limited credit plans for both our paid, unpaid accounts and Beta Services. These plans operate under a fair use policy in order to prevent potential abuse. For non-paying customers using an email address with a valid and verified (by us in our sole discretion) corporate domain, we have implemented a credit limit of 25 credits per user license per day to prevent abuse.

4. Term; Renewal

• Free Beta Service Trial. Breakthrough may terminate access to Beta Services at any time without notice, and may discontinue Beta Services at any time in its sole discretion.
• Paid subscription. If you have signed up for paid subscription, your subscription is for the initial service term as specified in the Order Form and shall be automatically renewed for additional periods of the same duration as the initial service term, unless either party requests non-renewal and/or cancels the subscription (i) at least thirty (30) days prior to the end of the then-current term for annual subscriptions or (ii) prior to 11:59 p.m. Pacific Time on the day before your next recurring billing date for monthly subscriptions. Subscriptions are non-cancelable during the term specified in the Order Form.

5. Ownership of the Service; Your License to Use the Service

• Ownership. As between you and us, all rights, title and interest in and to the Service and the Output Data (including, for avoidance of doubt, all Output Data generated or verified in connection with the licenses you grant us in Section 6(b)), including without limitation the patents, copyrights, trademarks, trade names, service marks, trade secrets and other intellectual property rights, and any goodwill associated therewith, are owned by us. For instance, we own any design, compilation or product features inherent in the Service, such as the way that data is organized, curated, presented and delivered, and any know-how or other intellectual property inherent in the way we create, provide, display or make available the Service. These Terms of Service do not grant you any ownership right, title or interest in any of the above. You therefore may not use the Service, including any Output Data, to create any derivative work, service or product, on your own or on behalf of any other organization, and you may not resell or re-license the Output Data in any manner or form.
• License to you. Subject to your compliance with these Terms and any Order Forms, you are granted a non-exclusive, revocable, non-assignable and non-sublicensable license, throughout the term of your subscription to: (i) use the Service solely for your personal and/or internal business purposes; and (ii) store, print or make a copy of Output Data solely for your personal or internal business purposes.
• License restrictions. You represent and warrant that you will comply with the following restrictions. Additional rules or policies may be displayed or put in place through the Service, including any portal through which you submit or receive data; those rules or policies are incorporated by reference into these Terms of Service and you agree to adhere to them.

Service restrictions:

• You may not resell, distribute or otherwise disclose or make available the Service, including any functionally similar or equivalent version of the Output Data (hereinafter the “Resale Restriction”). For the avoidance of doubt, you may contact us if you wish to do the foregoing, in which case we may, in our sole discretion, enter into a separate agreement with you permitting resale.
• You may not access the Service, including any functionally similar or equivalent version of the Output Data, on behalf of any third-party entity or organization.
• You may not transmit information to or through the Service that is fake or fictitious, impersonate any person or entity, or falsely state or otherwise misrepresent your affiliation with a person or entity in connection with your use of the Service.
• You may not develop any service, product, toolset, dataset or derivative work from the Service, whether in aggregated or non-aggregated form, and whether in identified or de-identified form.
• You may not reverse engineer, decompile or disassemble the Service (in whole or in part).
• You may not access the Service or extract data from the Service in a way that exceeds your authority from us or violates these terms or other policies or restrictions we have implemented (whether such implementation is verbal or technical in nature).
• You may obtain Output Data solely through the APIs and interfaces provided by us. You shall not use any other manual or automated means, (including “data scraping,” crawlers or bots) in order to access or obtain the Service.
• You may not leverage, consult with, use, review (in trial, free, or paid form) or rely upon the Service to develop or create a product or feature that is competitive with the Service (or any portion thereof).

Restrictions on the use of Output Data: You may not use the Service (including use of the Service to send email, mail, SMS, push notifications, fax phone or other communications):

• in a manner that violates any applicable laws (including, without limitation any marketing or data privacy and security laws) or industry best practices or that would cause us to violate applicable law. In particular you agree not to use the Service in a manner that would violate the U.S. CAN-SPAM Act of 2003, the Canadian Anti-Spam Legislation (CASL), the U.S. TCPA, the Telemarketing Sales Rules or any similar such laws.
• to advertise or promote any illegal service or product (or send any other communications) that are illegal in the place offered or consumed.
• to advertise or promote tobacco products, firearms, ammunition or other weapons, counterfeit or pirated goods or services, adult content or services (such as pornography or escort services), unlicensed gambling, investment schemes (including promotion of “pink slip” stocks), astrology or psychic services, lotteries, credit repair services, payday loan services, or any type of hate speech (targeting any societal group).
• to violate any securities or commodities regulations (such as to support a “pump and dump” scheme).
• to defraud, deceive, mislead, discriminate against, harass, libel or defame any person, group or entity.
• to violate or promote any violation of any person’s or entity’s intellectual property rights.
• to threaten, promote or commit violence or fraud, or to violate any person’s or entity’s rights.
• Restrictions on use of Email Services: These restrictions apply only where and to the extent email-sending or other outbound-communication features are enabled for your account; such features are not enabled by default and are made available only where expressly provisioned for your account. The following are provided as examples of practices which are not permitted from the Service. Such practices will be considered a violation of the license restrictions hereunder. These practices are subject to change.
  • Sending of emails from a group distribution email such as hello@ or marketing@ etc.
  • Failing to include appropriate opt out mechanisms in commercial emails or failing to comply with applicable laws or best practices related to opt-outs or user choice and control principles.
  • Using a fictional identity, pseudonym or alias to send emails.
  • Sending emails that generate an unacceptable (as determined in our reasonable discretion) level of bounces, spam or complaints
  • Transmitting material that contains or links to virus, trojan horse, worms or any malicious or harmful software program.
  • Using our Service in conjunction with any unsolicited or harassing messages (commercial or otherwise) including but not limited to unsolicited emails, text messages or phone calls.
• Notice of violation; suspension. In the event you are aware of or suspect a violation of these restrictions and policies, please notify us at support@breakthroughsales.io. We will determine compliance with these restrictions at our sole discretion. In the event that we confirm or reasonably suspect that you have failed to comply with these Terms or have otherwise used the Service in an abusive or fraudulent manner or in a manner intended to circumvent our stated policies or rules, we may immediately terminate your access to the Service, and, upon our written demand, you shall cease all use of the Service and the Output Data.
• Our marks. The Breakthrough names and logos are trademarks of ours, and may not be copied, imitated or used, in whole or in part, without our prior written permission.

6. Ownership of the Submitted Data; Our License to Use and Share the Submitted Data

• Ownership. As between you and us, all right, title and interest in and to Submitted Data is owned by you.
• The Licenses You Grant To Us. You agree to and hereby do grant us a license to:
  • (a) host, access, copy, use, transfer, and process the Submitted Data for the purpose of providing, developing and improving the Service and supporting you under these Terms.
  • (b) analyze Submitted Data, including through the use of techniques such as machine learning, in order to provide, develop and improve the Service. For the avoidance of doubt, you retain all ownership of Submitted Data and we retain all ownership in and to all system performance data, machine learning algorithms, and aggregated results of such machine learning.
  • (c) use the Submitted Data solely in aggregated, de-identified, or anonymized form in order to grow, enrich and verify the Output Data ; provided that we will not publicly refer to or associate you with any such Submitted Data.
  • (d) use, share, sublicense, display, copy, publish and distribute the Submitted Data in aggregated, de-identified form for any purpose, in any medium.

The license grants in subsections (a) and (b) above, as they apply to identifiable Submitted Data (including Customer Data and Recordings), are limited to the term of your subscription; upon expiration or termination, we will return or delete such identifiable Submitted Data in accordance with the DPA (Exhibit A). The license grants in subsections (c) and (d) above, and any license to Submitted Data in aggregated, de-identified, or anonymized form, are worldwide, non-exclusive, irrevocable, perpetual, and royalty-free, and we may sublicense, assign, or transfer those licenses at our discretion. In the event of any conflict between this Section 6 and the DPA with respect to Customer Data, the DPA controls.

• The Representations You Make To Us. You represent and warrant that:
  • you have all necessary rights, permissions, and authority to provide and license the Submitted Data to us (in whole and in part) for our use as described hereunder, and that doing so will not put you in violation of any contracts you have signed or any laws.
  • the Submitted Data is true, accurate, and of living persons and does not contain any sensitive information or sensitive Personal Information, including any information about individuals under the age of 18.
  • providing the Submitted Data to us does not violate the U.S. HIPAA law: for instance, it is not (in whole or in part) a list of hospital or doctor's patients, or a similar dataset consisting of patients or clients of an entity subject to HIPAA (this might include, for instance, a doctor, dentist, chiropractor, acupuncturist, pharmacist or other health professional). Similarly, you agree not to provide us with Submitted Data consisting of a list of clients of an entity covered by the GLBA, which applies to many types of financial institutions including banks, hedge funds, investment advisers and insurance companies.
  • where any Submitted Data includes call or meeting Recordings, transcripts, or the voices or images of participants, you have provided all notices to, and obtained all consents from, such participants required under applicable recording-consent and data-protection laws, and you are responsible for maintaining records of such consents.

7. Required Consumer Consents and Permissions; Your Responsibilities

• Responsibility for your use of Output Data. You acknowledge and agree that you are solely responsible and liable for your use of the Output Data and any communications made in connection with your use of the Output Data.
• Notice and consent. You acknowledge that in some countries, U.S. states or other jurisdictions, you may be required to obtain consent, provide notice or complete some other action in order to lawfully conduct certain types of marketing activities or processing of Personal Information. You understand that we have not provided any notices nor obtained any rights or consents on your behalf. Therefore, to the extent that any law or regulation may require that you provide notice, obtain consent or complete some other action in order to lawfully market to any person or process their Personal Information, you represent and warrant that you shall obtain such notices or consents or otherwise complete such action on your own behalf.
• Legal bases for processing. In connection with the Services, you may access, receive or otherwise process Output Data which is subject to various privacy and security laws governing Personal Information such as the UK/EU GDPR. If you do so, you agree that you will only access, use or otherwise process such Output Data:
  • pursuant to explicit consent from the data subject of the Output Data, sufficient to comply with the consent requirements of applicable laws, or
  • pursuant to any other legal basis (or substantively similar term) for processing under applicable law. For example, in accordance with the EU/UK GDPR, you may use Output Data for purposes that you have established are necessary to pursue your legitimate interests under the EU/UK GDPR, such as use of the Output Data in order to perform reasonable and actual data validation or hygiene or updating of your own legally obtained customer database.
• Compliance with law. You shall comply with all laws applicable to your use of the Service. Notwithstanding anything herein (including any permissions granted by us herein), you are solely responsible for your own understanding of, and compliance with, all applicable laws. We make no representation (and you should not rely on any representation by us) regarding what applicable law might or might not require (including with respect to data subject notices, consents and permissions).

Enrichment; Data Providers; Data-Broker Disclosures.

As part of the Service, and at your direction, we may submit identifiers you provide or that are contained in your Submitted Data (such as a business email address or a professional profile URL) to third-party Data Providers in order to look up, match, verify, or append professional information (such as a contact’s current employer, role, or public professional profile) and to associate a contact with a buyer persona. We perform this enrichment solely as your service provider and processor, on your documented instructions and for your benefit, and not for our own independent purposes. By using these features, you acknowledge and agree that:

• you authorize us to disclose the relevant identifiers and Submitted Data to Data Providers for the purpose of performing the enrichment described above;
• you have provided all notices to, and obtained all authorizations, consents, and lawful bases from, the individuals and entities whose information is submitted, as required under applicable law, to permit that disclosure and enrichment;
• certain Data Providers may retain, reuse, or further process the data you submit in accordance with their own terms, including by incorporating it into their own databases, and may act as independent controllers or joint controllers (rather than as our subprocessors) with respect to such use;
• to the extent applicable law treats any such disclosure as a “sale” or “sharing” of personal information, you — and not Breakthrough — are the party that determines to make that disclosure, and you are responsible for providing any “Do Not Sell or Share” or other opt-out mechanism and disclosures required of you (for example, under the California Consumer Privacy Act), including identifying the Data Provider in your own privacy notice where required;
• you will disclose in your own privacy notice that information may be shared with third-party Data Providers, and if any individual opts out of the sale or sharing of their information, or otherwise objects, you will promptly instruct us to exclude that individual from enrichment; and
• you will not instruct us to submit to any Data Provider any data that you are not permitted to disclose, and you will comply with the Data Providers’ applicable terms.

8. Data Privacy and Security

• Data Processing Addendum. The Breakthrough Data Processing Addendum, attached as Exhibit A, is hereby incorporated by reference into these Terms. The parties shall comply with the terms of the Breakthrough Data Processing Addendum as it relates to all processing of Personal Information in connection with these Terms. We act as a processor (or “service provider”) with respect to Customer Data that we process on your behalf — including Recordings, transcripts, and CRM records — and as a controller only with respect to Customer Representative Data, each as described in the Privacy Statement and the DPA. Your acceptance of these Terms constitutes your acceptance of the DPA, and no separate signature is required.
• Privacy Statement. You acknowledge the collection, use, disclosure and other handling of information, including Personal Information, described in our Privacy Statement (available at https://www.breakthroughsales.io/privacy), which we may update from time to time.

9. Disclaimers

YOUR USE OF THE SERVICE IS AT YOUR OWN RISK. THE SERVICE (AND ALL OUTPUT DATA PROVIDED THEREIN) ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS. WE DISCLAIM ALL WARRANTIES AND REPRESENTATIONS, EITHER EXPRESS OR IMPLIED, WITH RESPECT TO THE SERVICE, INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES (1) OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, (2) OF INFORMATIONAL CONTENT OR ACCURACY, (3) OF NON-INFRINGEMENT, (4) OF PERFORMANCE, (5) OF TITLE, (6) THAT THE SERVICE WILL OPERATE IN AN ERROR FREE, TIMELY, SECURE, OR UNINTERRUPTED MANNER, IS CURRENT AND UP TO DATE AND ACCURATELY DESCRIBES ANYTHING, OR IS FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS, (7) THAT ANY DEFECTS OR ERRORS IN THE SERVICE WILL BE CORRECTED, (8) THAT THE SERVICE IS COMPATIBLE WITH ANY PARTICULAR HARDWARE OR SOFTWARE PLATFORM, OR (9) THAT WE WILL ENFORCE THE TERMS OF SERVICE AGAINST OTHERS TO YOUR SATISFACTION. EFFORTS BY US TO MODIFY THE SERVICE SHALL NOT BE DEEMED A WAIVER OF THESE LIMITATIONS OR ANY OTHER PROVISION OF THESE TERMS OF SERVICE.

Some jurisdictions limit or do not allow the disclaimer of implied warranties. In such states, these warranties will be disclaimed only to fullest extent permitted by law.

10. Limitation of Liability

APART FROM CUSTOMER’S INDEMNIFICATION OBLIGATIONS HEREIN, NEITHER PARTY (NOR ITS RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES, REPRESENTATIVES, AFFILIATES, PARENTS, SUBSIDIARIES, SUBLICENSEES, SUCCESSORS AND ASSIGNS, INDEPENDENT CONTRACTORS, AND RELATED PARTIES) SHALL BE LIABLE TO THE OTHER PARTY FOR ANY LOSS OF PROFITS, LOSS OF USE, LOSS OF DATA, INTERRUPTION OF BUSINESS, OR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN ANY WAY CONNECTED WITH THE USE OF THE SERVICE OR WITH THE DELAY OR INABILITY TO USE SAME, OR FOR ANY BREACH OF SECURITY, OR FOR ANY CONTENT, PRODUCTS, AND SERVICES OBTAINED THROUGH OR VIEWED ON THE SERVICE, OR OTHERWISE ARISING OUT OF THE USE OF SAME, WHETHER BASED ON CONTRACT, TORT, STRICT LIABILITY, REGULATION, COMMON LAW PRECEDENT OR OTHERWISE, EVEN IF THE RESPECTIVE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES AND EVEN IF SUCH DAMAGES RESULT FROM A PARTY’S ENTITY’S NEGLIGENCE OR GROSS NEGLIGENCE.

IN NO EVENT SHALL OUR AGGREGATE LIABILITY FOR ANY CLAIM UNDER OR RELATING TO THESE TERMS OR THE SERVICE EXCEED THE TOTAL OF THE AMOUNT PAID BY YOU TO US DURING THE 12 MONTHS PRIOR TO THE DATE ON WHICH THE CLAIM AROSE.

ADDITIONAL DISCLAIMERS FROM US MAY APPEAR WITHIN THE SERVICE AND ARE INCORPORATED HEREIN BY REFERENCE. TO THE EXTENT ANY SUCH DISCLAIMERS PLACE GREATER RESTRICTIONS ON YOUR USE OF THE SERVICE OR THE MATERIAL CONTAINED THEREIN, SUCH GREATER RESTRICTIONS SHALL APPLY.

Some jurisdictions restrict or do not allow some of the foregoing limitations of liability in contracts, and as a result the contents of this section may not apply to you. In cases where such laws apply, our liability shall be limited to the fullest extent permitted by law.

11. Arbitration, Class Action Waiver and Applicable Law

PLEASE READ THIS SECTION CAREFULLY. IT MAY SIGNIFICANTLY AFFECT YOUR LEGAL RIGHTS.

Arbitration and class-action waiver.

• Federal Arbitration Act. You agree that these Terms of Service affect interstate commerce and that the Federal Arbitration Act governs the interpretation and enforcement of these arbitration provisions.
• Initial Dispute Resolution. Most disputes can be resolved without resorting to litigation. You and we agree to use reasonable efforts to settle any dispute or claim, and good faith negotiations shall be a condition to either party initiating a lawsuit or arbitration, other than lawsuits or arbitration for injunctive relief from alleged intellectual property infringement. To commence this procedure, you agree to contact our support department at support@breakthroughsales.io, or we may contact you using the last available information we have for you.
• Binding Arbitration. If we do not reach an agreed-upon solution within a period of ten (10) days from the time informal dispute resolution is initiated under the Initial Dispute Resolution provision above, then we both agree to resolve by arbitration any and all controversies, claims, or disputes arising out of, relating to, or resulting from (1) your relationship with the us, (2) these Terms of Service, (3) any other aspect of the Service. These Terms of Service are intended to require arbitration of every claim or dispute that lawfully can be arbitrated, except for those claims and disputes which by the terms of these Terms of Service are expressly excluded from section 11.
• Governing Arbitration Rules. All claims subject to arbitration shall be finally settled by binding arbitration administered by JAMS in accordance with the JAMS rules in effect at the time the arbitration is initiated, excluding any rules or procedures that would permit class actions or other representative actions. The arbitrator, and not any federal, state, or local court or agency, shall have exclusive authority to resolve all disputes arising out of or relating to the interpretation, applicability, enforceability, or formation of these Terms of Service including but not limited to any claim that all or any part of these Terms of Service (such as this section 11) is void or voidable, or whether a claim is subject to arbitration, except that the arbitrator shall have no authority to find that a claim may proceed on a class basis or as part of another representative action: only a court may address disputes regarding the validity or enforceability of the Class Action Waiver section below, section 11(A)(v). The arbitrator shall be empowered to grant whatever relief would be available in a court under law or in equity. The arbitrator’s award shall be written and shall be binding on the parties and may be entered as a judgment in any court of competent jurisdiction. To start an arbitration, unless there are conflicting rules at www.jamsadr.com, you must do the following: (A) Write a Demand for Arbitration that includes a description of the claim and the amount of damages you seek to recover. You may find a copy of a Demand for Arbitration at www.jamsadr.com; (B) Send three copies of the Demand for Arbitration, plus the appropriate filing fee, to JAMS, Two Embarcadero Center, Suite 1500, San Francisco California 94111; and (C) Send one copy of the Demand for Arbitration to us at 440 N Barranca Ave #4750, Covina, CA 91723. To the extent the filing fee for the arbitration exceeds the cost of filing a lawsuit, we will pay the additional cost. If the arbitrator finds the arbitration to be non-frivolous, we will pay all of the actual filing and arbitrator fees for the arbitration, provided your claim does not seek more than $75,000. The arbitrator shall have the power to award any remedies available under applicable law, and the arbitrator shall award attorneys’ fees and costs to the prevailing party, except as prohibited by law. The parties understand that, absent this mandatory provision, they would have the right to sue in court and have a jury trial. They further understand that, in some instances, the costs of arbitration could exceed the costs of litigation and the right to discovery may be more limited in arbitration than in court. If you are a resident of the United States, arbitration may take place at any reasonable location within the United States convenient for you. For residents outside the United States, arbitration shall be initiated in San Francisco County, California, United States of America, and you and we agree to submit to the personal jurisdiction of any court in San Francisco County, California, in order to compel arbitration, to stay proceedings pending arbitration, or to confirm, modify, vacate, or enter judgment on the award entered by the arbitrator.

Class Action Waiver. The parties agree that the arbitration shall be conducted in their individual capacities only and not as a class action or other representative action, and the parties expressly waive their right to file a class action, seek relief on a class basis, or join or serve as a member of a class action. YOU AND BREAKTHROUGH AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR OUR INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING. If for any reason the proper decision maker determines that the waiver of class and representative actions set forth in this paragraph is void or unenforceable or that an arbitration can proceed on a class or representative basis, then section 11(A) and section 11(B) shall be deemed null and void in their entirety and the parties shall be deemed to have not agreed to arbitrate disputes.

30-Day Right to Opt Out. You have the right to opt out and not be bound by this version of section 11 by sending written notice of your decision to opt out to support@breakthroughsales.io with the subject line, “ARBITRATION AND CLASS ACTION WAIVER OPT-OUT.” The notice must be sent within thirty (30) days of the first date that you agree to any version of these Terms of Service that contains this version of section 11. If you do not opt out, you will be bound to arbitrate disputes in accordance with the terms of this section 11. You have the right to consult with counsel of your choice concerning this section 11. You understand that you will not be subject to retaliation if you exercise your right to opt out of coverage under this section 11. If you opt out of section 11, we also will not be bound by it in disputes with you.

Changes to this Section. We will provide (60) days notice of any changes to this section. Changes will become effective on the sixtieth (60th) day, and will apply prospectively only to claims arising after the sixtieth (60th) day. If a court or arbitrator (in either case, with the authority to make such decision) decides that this subsection on “Changes to This Section” is not enforceable or valid, then this subsection shall be severed from Section 11 and the court or arbitrator shall apply the first Arbitration and Class Action Waiver section you agreed to.

Survival. This section 11 shall survive any termination of these Terms of Use.

• Limitations to this agreement to arbitrate. This section (Arbitration and Class Action Waiver) shall be limited as follows:

Intellectual Property Claims. Notwithstanding the parties’ decision to resolve all disputes through arbitration, either Party may bring an action on an individual (not class or representative action) basis in state or federal court or in the U.S. Patent and Trademark Office to protect its patents, copyrights, moral rights, trademarks, and trade secrets, but not privacy or publicity rights.

Small Claims Court. Notwithstanding the parties’ decision to resolve all disputes through arbitration, either Party may seek relief in a small claims court on an individual (not class or representative action) basis for disputes or claims within the scope of that court’s jurisdiction.

• Applicable Law. The Terms of Service and the relationship between us shall be governed in all respects by the laws of the State of California, without regard to its conflict of law provisions. Any claim or dispute either of us may have against the other that is not subject to arbitration must be resolved by a court located in San Francisco County, California (or by a small claims court located elsewhere in the United States when section 11(b)(ii) applies). We both agree to submit to the personal jurisdiction of the courts located within San Francisco County, California (or a small claims court located elsewhere in the United States when section 11(b)(ii) applies), for the purpose of litigating all such claims or disputes that are not subject to arbitration.

12. Indemnification

You agree to indemnify, defend and hold us, our affiliates, directors, officers, employees, contractors and agents, and our suppliers, licensors, and service providers harmless from and against any actual or threatened loss, liability, claim, demand, damages, costs or expenses, including reasonable attorneys’ fees and expenses (collectively, “Claims”), arising out of or in connection with: (1) Your use of the Service; (2) Your breach of these Terms of Service; (3) Your violation of any applicable law or rights held by any third party; (4) the Submitted Data; (5) Your failure to obtain any consents or provide any notices required under applicable recording-consent or data-protection laws in connection with call or meeting Recordings, as described in Section 6; or (6) Your or our submission of Submitted Data to, or disclosure of Submitted Data by, any third-party Data Provider for enrichment purposes, as described in Section 7.

We will have the right, but not the obligation, to participate through counsel of our choice in any defense by you of any Claims as to which you are required to defend, indemnify, or hold us harmless. You may not settle any Claims in a manner that may impose any obligation upon us, without our prior written consent. The members of our corporate family, and its agents, partners, employees, contractors and advertisers, are third-party beneficiaries of this paragraph. Other than such parties, there are no other third-party beneficiaries of the Terms of Service. Should you not in a timely manner agree to indemnify and defend us upon our notice to you of a covered Claim, we may retain our counsel, for whose reasonable fees you shall be liable, and we may settle any such Claim, for which you likewise shall be liable.

13. Changes to the Service

We may change the features and functionality of the Service at any time. This may include adding, modifying or removing any features or functionality of the Service or altering the amount of Output Data or other access we provide. The Terms of Service will apply to any changed version of the Service. We may also suspend or stop the Service altogether. In addition, we may impose or alter fees for new or existing aspects of the Service, including updating our credit conversion policies at any time.

14. Confidentiality

• Confidential Information. From time to time under these Terms, either Party (the “Disclosing Party”) may disclose or make available to the other Party (the “Receiving Party”), non-public, proprietary, or confidential information of Disclosing Party that is clearly designated by Disclosing Party as confidential or which Receiving Party should reasonably understand Disclosing Party would expect to be treated as confidential (collectively “Confidential Information”); provided, however, that Confidential Information does not include any information that: (i) is or becomes lawfully and generally available to the public other than as a result of Receiving Party’s breach of this section 14 or any other duty or obligation of confidentiality owed to the other Party, (ii) is or becomes available to Receiving Party on a non-confidential basis from a third-party source, provided that such third-party is not and was not prohibited from disclosing such Confidential Information, (iii) was in Receiving Party’s possession prior to Disclosing Party’s disclosure hereunder as evidenced by its records, or (iv) was or is independently developed by Receiving Party without using any Confidential Information. Without limitation, the ”Output Data” is Breakthrough’s Confidential Data.
• Obligations. Receiving Party will: (i) protect and safeguard the confidentiality of Disclosing Party’s Confidential Information with at least the same degree of care as Receiving Party would protect its own Confidential Information, but in no event with less than a commercially reasonable degree of care, (ii) not use Disclosing Party’s Confidential Information, or permit it to be used, for any purpose other than to exercise its rights or perform its obligations under these Terms, and (iii) not disclose any such Confidential Information to any person or entity, except to Receiving Party’s employees, agents, contractors, attorneys or representatives (“Representatives”) acting in the course of their obligations and rights hereunder.
• Required Disclosure. If Receiving Party is required by applicable law or legal process to disclose any Confidential Information, it will, prior to making such disclosure, use commercially reasonable efforts to notify Disclosing Party of such requirements to afford Disclosing Party the opportunity to seek, at Disclosing Party’s sole cost and expense, a protective order or other remedy and Receiving Party must only disclose or furnish that portion of Confidential Information as such Receiving Party or the applicable Representative is legally obligated or compelled to so produce or disclose.
• Return or Destruction. At the Disclosing Party’s request, the Receiving Party will return or destroy any Confidential Information Receiving Party obtained from the Disclosing Party. However, nothing contained herein will be construed to prohibit Receiving Party from retaining electronic information maintained in compliance with its digital data retention and automated backup procedures provided that; such Confidential Information will remain subject to the confidentiality obligations set forth herein.
• Remedies. In the event of a breach of this section 14, the Receiving Party understands and agrees that direct money damages may not be an adequate remedy for any breach of these Terms by it and that the Disclosing Party may be entitled (without exclusion of other remedies herein) to seek specific performance and injunctive or other equitable relief as a remedy for any such breach. The Receiving Party further agrees to waive any requirement for the Disclosing Party to secure or post any bond in connection with such remedy.
• Conflicting Obligations. The provisions of this section 14 supersede and replace in whole any previous confidentiality, non-disclosure or similar agreement between the Parties.

15. Equitable Relief

In the event of a breach of the Resale Restriction in section 5, the Parties agree that money damages may not be an adequate remedy. Accordingly, in the event of such breach, you agree that we will be entitled (without exclusion of other remedies herein, including monetary remedies) to seek specific performance and injunctive or other equitable relief as a remedy for any such breach, including disgorgement of profits. You further agree to waive any requirement that Breakthrough secure or post any bond in connection with such remedy. You further agree that should we prevail in a suit in which we assert violation of the Resale Restriction, you will pay our reasonable attorneys’ fees and costs, including costs of investigation.

16. Miscellaneous

• Complete Agreement and Understanding. These Terms of Service are the entire and exclusive understanding and agreement between us and you regarding the Service as well as the Submitted Data.These Terms supersede and replace any and all prior oral or written understandings or agreements between us and you regarding such topics (including, with respect to the subject matter hereof, any non-disclosure or confidentiality agreement previously entered into between us), provided that any modification in an Order Form shall govern and supersede any conflicting provision in these Terms. The DPA (Exhibit A) and, where referenced, the Privacy Statement are part of these Terms and are incorporated by reference.
• Our Relationship With You. The relationship between you and us is that of independent contractors, and nothing in these Terms of Service shall be construed to create or imply any other relationship (such as a partnership or an employer/employee or agency relationship).
• Assignment. We may assign these Terms at our discretion. You may not assign, sublicense or transfer these Terms (or our license grant to you herein) in whole or in part to anyone else.
• Severability. If any provision of these Terms is determined by a court to be invalid, illegal or unenforceable, that determination will not affect the validity or enforceability of the remaining provisions of the Terms, and each provision shall be considered as separate, severable and distinct from each other.
• Waiver. If we (or you) don't enforce any part of these Terms, it won't be considered a waiver. No waiver of any obligation or right of either party shall be effective unless in writing, executed by the party against whom it is being enforced.
• Notice. Legal notices to us (including but not limited to termination notices) must be sent to support@Breakthroughsales.io. We will send legal notices to you via a method of our choosing that is reasonably intended to provide such notice to you, including without limitation via the Service or to the email or other address you have provided to us.

Termination.

Termination for cause. In addition to any other remedies it may have, either party may terminate these Terms, effective immediately, if (A) the other party breaches these Terms and fails to cure such breach within thirty (30) days of its receipt of a written notice identifying the breach in reasonable detail (or ten (10) days in the case of non-payment), or (B) subject to applicable law, upon the other party’s liquidation, commencement of dissolution proceedings or assignment of substantially all of its assets for the benefit of creditors, or if the other party becomes the subject of bankruptcy or similar proceeding that is not dismissed within sixty (60) days. If the Agreement is terminated as a result of a material breach by you, then you shall pay in full all remaining fees payable through the remainder of any outstanding Order Form; or if you have prepaid any fees, then those fees are nonrefundable.

Termination for convenience. In addition to the right to terminate for cause, (a) for paid subscriptions, we may terminate these Terms for convenience by providing you at least thirty (30) days' prior written notice; and (b) for unpaid accounts only, either party may terminate these Terms, effective immediately, by providing the other party written notice. For paid subscriptions, you will pay in full for the Service up to and including the last day on which the Service is provided.

Effect of termination. If these Terms terminate, you will no longer be authorized to access the Services (except as provided under section 4 hereunder).

Inactivity. For non-paying customers, if there is no activity in your account for six (6) months or more, Breakthrough reserves the right to deactivate your account, delete data from your account and/or restrict access to certain functionality in your account, at Breakthrough's sole discretion.

Survival. Sections 1 and 5-12, 14-16 of these Terms will survive termination.

• Force Majure. We will not be deemed responsible or liable for any failure to perform or delay in performance under these Terms (or any Order Form) where such delay or failure is beyond our control, including, without limitation, where caused by strikes or labor disputes, internet or telecommunications failures, shortages of or inability to obtain labor, energy, or supplies, war, terrorism, riot, acts of God or governmental action, natural disasters including floods, earthquakes and hurricanes, acts by hackers or other malicious third parties and problems with the Internet generally, and such performance shall be excused to the extent that it is prevented or delayed by reason of any of the foregoing.
• Monitoring. We, or service providers working with us, may monitor the Service for any legitimate business purpose, including to monitor compliance with these Terms or evaluate how the Service is being accessed and used. We will be the sole and final arbiter as to whether the Service is being misused or these Terms are being violated. If we believe you have violated these Terms (or any law) we may terminate your account and access to the Service immediately and without notice. In such a situation we also may seek civil, criminal or injunctive relief, at our sole discretion and without obligation, to enforce this Terms of Service and the law.

EXHIBIT A — DATA PROCESSING ADDENDUM

DATA PROTECTION ADDENDUM

This Data Protection Addendum ("Addendum") forms part of the Agreement ("Agreement") between Breakthrough Sales Corp. ("Breakthrough" or “Data Processor”) and the Party identified as Data Controller in the Agreement (“Data Controller”) and applies where, and to the extent that, Breakthrough processes Personal Data on behalf of Data Controller when providing Services under the Agreement.

By entering into the Agreement that incorporates this Addendum by reference, the parties are deemed to have signed this Addendum, including without limitation, all Attachments, Exhibits, Annexes, Schedules, and Appendices to this Addendum where applicable.

The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. Except as modified below, the terms of the Agreement shall remain in full force and effect.

In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Agreement. Except where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement as amended by, and including, this Addendum.

Definitions

In this Addendum, the following terms shall have the meanings set out below:

• "Affiliate" means an entity that directly or indirectly controls, is controlled by or is under common control with another entity.
• “Applicable Laws" means all data protection and privacy laws applicable to the processing of Personal Data under the Agreement, including, where applicable: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) and any data protection laws in any EU or EEA Member State including laws implementing such Regulation and (ii) the GDPR as incorporated into United Kingdom (“UK”) law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019 (“UK GDPR”); (iii) Federal Act on Data Protection of Switzerland (“FADP”) and (iv) the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. ("CCPA"); and (v) Regulation (EU) 2024/1689 of the European Parliament and of the Council on artificial intelligence (the "EU AI Act"), to the extent applicable to the Processing of Personal Data under this Addendum, including as each may be replaced, revised or amended from time to time.
• "EEA" means the European Economic Area;
• "EU Standard Contractual Clauses" means the standard contractual clauses for the transfer of Personal Data, in accordance with Applicable Laws, to Controllers and Processors established in Third Countries, the approved version of which is in force at the date of signature of this Agreement that are in the European Commission's Decision 2021/914 of 4 June 2021 ((referencing Module Two: Transfer Controller to Processor, and/or other modules as applicable), as such standard contractual clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en, and as may be amended or replaced by the European Commission from time to time. The EU Standard Contractual Clauses also apply to cross-border transfers of Personal Data of Data Subjects located in Switzerland, as set forth herein;
• "Personal Data" means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable natural person (a “Data Subject”). Personal Data includes “Personal Information” as defined in Section 1798.140(o) of the CCPA;
• "Services" means the services and other activities to be supplied to or carried out by or on behalf of Data Processor for Data Controller pursuant to the Agreement;
• "Subprocessor" means any person (including any third party and any Data Processor Affiliate, but excluding an employee of Data Processor or any of its sub-contractors) appointed by or on behalf of Data Processor or any Data Processor Affiliate to Process Personal Data on behalf of any Data Controller in connection with the Agreement; and
• "UK Addendum" shall mean the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clause, attached here to as Appendix 4.

The terms, "Commission", "Controller", "Data Subject", "Member State", "Personal Data Breach", "Processing" and "Supervisory Authority" shall have the same meaning as in Applicable Laws or the Agreement, and their cognate terms shall be construed accordingly.

Processing of Personal Data

Data Processor shall:

comply with all Applicable Laws in the Processing of Personal Data;

not Process Personal Data other than on the Data Controller’s documented instructions unless Processing is required by Applicable Laws to which the Data Processor is subject, in which case Data Processor shall to the extent permitted by Applicable Laws inform the Data Controller of that legal requirement before the Processing of that Personal Data; and

shall inform Data Controller if, in its reasonable opinion, an instruction infringes Applicable Laws.

upon Data Controller's reasonable written request, provide Data Controller with such technical and operational information about Data Processor's AI-enabled features as is reasonably necessary to enable Data Controller to fulfill its obligations as a deployer under the EU AI Act or any other applicable law governing artificial intelligence.

Notwithstanding any other provision of this Addendum, Data Processor may: (a) analyze Personal Data using artificial intelligence, machine learning, and similar techniques in order to provide, develop, and improve the Services; (b) aggregate, de-identify, or anonymize Personal Data such that it no longer constitutes Personal Data under Applicable Laws; and (c) use, share, publish, and distribute such aggregated, de-identified, or anonymized data for any purpose, including research, development, improvement of the Services, and creation of benchmark or industry insights..

Data Controller:

designates and instructs Data Processor (and authorises Data Processor to instruct each Subprocessor) to: Process Personal Data; and in particular, transfer Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with the Agreement;

shall ensure that (i) all instructions to Data Processor with respect to the Processing of Personal Data are at all times in accordance with Applicable Laws; (ii) all Personal Data provided to Data Processor has been collected in accordance with Applicable Laws and that Data Controller has all authorizations and/or consents necessary to provide such Personal Data to Data Processor, including any consents to enable Data Processor enrich Personal Data on behalf of Data Controller using data brokers or cooperative databases, recording consent laws and procuring consents required for the Submitted Data (defined in the Agreement) and Recordings (defined in the privacy statement) shared with Data Processor, including recordings of meeting participants whose Personal Data may be included in recordings or transcripts; and (iii) to the extent Data Controller deploys the Services within the European Union or European Economic Area, Data Controller, as deployer of Data Processor's AI-enabled platform under Regulation (EU) 2024/1689 (the "EU AI Act"), shall be responsible for fulfilling its own obligations as a deployer thereunder, including providing any required notices to individuals whose Personal Data is processed through the Services, and shall not instruct Data Processor to process Personal Data in a manner that would cause either party to violate the EU AI Act; and

acknowledges that it has access to and control over Personal Data of its Authorized Users and other Controller-provided data that is housed within Data Processor’s proprietary platform and the ability to request deletion of such Personal Data in accordance with Section 9 of this Addendum.

Appendix 1 to this Addendum provides a description of the Data Processor’s Processing of the Personal Data as required by Article 28(3) of the GDPR (and, possibly, equivalent requirements of other Applicable Laws).

Appendix 5 to this Addendum provides a description of the Parties’ obligations under the CCPA.

Data Processor Personnel

Data Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor who may have access to the Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Personal Data, as strictly necessary for the purposes of the Agreement, and to comply with Applicable Laws in the context of that individual's duties to the Data Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

Security

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Data Processor shall in relation to the Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

In assessing the appropriate level of security, Data Processor shall take account in particular of the risks that are presented by Processing, in particular from a Personal Data Breach. A description of Data Processor’s security measures is set forth in Appendix 2.

Subprocessing

Data Controller provides general written authorization for Data Processor (and each Subprocessor) to appoint Subprocessors in accordance with this Section and any restrictions in the Agreement. A list of Data Processor’s current Subprocessors is set forth in Appendix 3 of this Addendum. Any Sub-processor used must qualify as a service provider under the CCPA and Data Processor cannot make any disclosures to a Sub-processor that the CCPA would treat as a sale.

Data Processor may continue to use those Subprocessors already engaged by Data Processor as at the date of this Addendum, subject to Data Processor in each case as soon as practicable meeting the obligations set out in this Section 5.

Data Processor shall give Data Controller at least 15 day prior written notice of the appointment of any new or replacement Subprocessor, including full details of the Processing to be undertaken by the Subprocessor. If Data Controller reasonably objects in writing to a new or replacement Subprocessor within 10 calendar days after receipt of such notice, and the parties cannot resolve Data Controller’s reasonable objection within 14 calendar days after receipt of such objection, then Data Controller may terminate the Services impacted by the new or replacement Subprocessor on written notice to Data Processor without penalty and receive a pro-rata refund of any fees paid in advance.

Data Processor shall ensure that each Subprocessor performs and shall be responsible for the obligations under this Addendum as they apply to Processing of Personal Data carried out by that Subprocessor, as if it were party to this Addendum in place of Data Processor.

Inquiries and Data Subject Rights

Taking into account the nature of the Processing, Data Processor shall assist Data Controller by implementing appropriate technical and organizational measures as set forth on Appendix 2, for the fulfilment of the Data Controller’s obligations, as reasonably understood by Data Controller, to respond to requests to exercise Data Subject rights under the Data Protection Laws.

Further, Data Processor shall:

promptly notify Data Controller if it receives a request from a Data Subject under any Applicable Laws in respect of Personal Data; and

ensure that it does not respond to that request except on the documented instructions of Data Controller or as required by Applicable Laws to which the Data Processor is subject, in which case Data Processor shall to the extent permitted by Applicable Laws inform Data Controller of that legal requirement before the Data Processor responds to the request.

Data Processor shall notify Data Controller without undue delay if a Supervisory Authority or other competent legal authority makes any inquiry or request for disclosure of Personal Data.

Personal Data Breach

Data Processor shall notify Data Controller without undue delay, upon Data Processor becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of Data Controller, providing Data Controller with reasonably sufficient information to allow Data Controller to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Applicable Laws. For avoidance of doubt, Data Processor’s notice does not constitute an admission of fault by Data Processor or its Subprocessors for the Personal Data Breach.

Data Processor shall co-operate with Data Controller and take such reasonable commercial steps as are directed by Data Controller to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

Data Protection Impact Assessment and Prior Consultation

At Data Controller’s expense, Data Processor shall provide reasonable assistance to Data Controller with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Data Controller reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Personal Data by, and taking into account the nature of the Processing and information available to, the Data Processors.

Deletion or Return of Personal Data

Upon termination or expiration of the Agreement, at Data Controller’s request, Data Processor will either promptly (i.e., in no more than 30 days) return or destroy the Personal Data in its possession or control. This requirement shall not apply to the extent Data Processor is required by applicable law to retain some or all of the Personal Data, or to Personal Data it has archived on back-up systems, which Personal Data Data Processor shall securely isolate and protect from any further Processing, except to the extent required by applicable law. Data Processor shall extend the protections of the Agreement and this Addendum to such Personal Data and limit processing of such Personal Data to only those purposes required by applicable law, for so long as Data Processor retains the Personal Data.

Audit rights

At Data Controller’s expense and with a written request no more than once per year, Data Processor shall make available to Data Controller information directly relating to compliance with this Addendum and Applicable Laws and shall allow for reasonable audits of such information by Data Controller, or an auditor appointed by Data Controller, within 30 days’ of receipt of such written request.

Upon Data Controller’s request, and provided that the parties have an applicable NDA in place, Breakthrough will make available the certificates issued for the SOC 2 certification (or the certifications or other documentation evidencing compliance with such alternative standards as are substantially equivalent to SOC 2) (the “SOC 2”). Data Processor’s provision of its SOC 2 certification to Data Controller will be considered to satisfy an audit request by Data Controller.

Data Controller shall make (and ensure that each of its mandated auditors makes) reasonable endeavors to avoid causing any damage, injury or disruption to the Data Processors' premises, equipment, personnel and business while its personnel are on those premises in the course of such an audit or inspection.

Data Processor need not give access to its premises for the purposes of such an audit or inspection: (a) to any individual unless he or she produces reasonable evidence of identity and authority; or (b) outside normal business hours at those premises, unless the audit or inspection needs to be conducted on an emergency basis and Data Controller or the relevant Data Controller Affiilate undertaking an audit has given notice to Data Processor that this is the case before attendance outside those hours begins.

Taking into account the nature of the processing and the information available to Breakthrough, Breakthrough will assist Data Controller in complying with Data Controller’s obligations in respect of data protection impact assessments and prior consultation, at Data Controller’s expense and by providing the information Breakthrough makes available under this Section 10.

International Transfers

To the extent Data Processor’s processing of Personal Data includes Data Subjects in the EEA, UK and/or Switzerland, Data Controller and Data Processor acknowledge and agree that such Personal Data may be transferred to third countries, including countries that are not recognized by the European Commission, UK or Switzerland as providing an adequate level of protection for Personal Data. More specifically, Data Controller acknowledges and agrees that Personal Data may be transferred to Data Processor in the United States, which has not received an adequacy determination. Data Controller hereby consents to the transfer of Personal Data to Data Processor in the United States as set forth herein.

If, in fulfilling its obligations under the Agreement or pursuant to other lawful instructions from Data Controller, Personal Data is to be transferred from the EEA to any country that has not been recognized by the European Commission as providing an adequate level of protection for Personal Data, the parties agree to enter into and abide by the EU Standard Contractual Clauses, which are incorporated into this Addendum as follows:

Data Controller is the Data Exporter and Data Processor is the Data Importer;

Clause 7, the "Docking Clause (Optional)", shall be deemed incorporated;

In Clause 9, the parties choose Option 2, 'General Written Authorisation', with a time period of 15 days;

The optional wording in Clause 11 shall be deemed not incorporated;

In Clause 17, the Data Exporter and Data Importer agree that the EU Standard Contractual Clauses shall be governed by the laws of the Republic of Ireland and choose Option 1 to this effect;

In Clause 18, the Data Exporter and Data Importer agree that any disputes shall be resolved by the courts of the Republic of Ireland; and

Appendixes 1, 2 and 3 attached hereto serve as Annexes I, II and III of the EU Standard Contractual Clauses.

11.3 If, in fulfilling its obligations under the Agreement or pursuant to other lawful instructions from Data Controller, Personal Data is to be transferred from Switzerland to any country that has not been recognized by the Swiss federal government or Swiss Federal Data Protection and Information Commissioner as providing an adequate level of protection for Personal Data, the parties agree to enter into and abide by the EU Standard Contractual Clauses (as implemented herein) as follows:

The Swiss Federal Data Protection and Information Commissioner shall be the sole Supervisory Authority for the transfers exclusively subject to the FADP;

The terms “General Data Protection Regulation” or “Regulation (EU) 2016/679” as utilized in the Standard Contractual Clauses shall be interpreted to include the FADP with respect to the transfers;

References to Regulation (EU) 2018/1725 are removed;

References to the “Union”, “EU” and “EU Member State” shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of exercising their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU Standard Contractual Clauses;

In Clause 17 and Clause 18, the governing law and forum shall be Switzerland;

Where the transfers are exclusively subject to the FADP, all references to the GDPR in the EU Standard Contractual Clauses are to be understood to be references to the FADP;

Where the transfers are subject to both the Swiss FADP and the GDPR, all references to the GDPR in the EU Standard Contractual Clauses are to be understood to be references to the FADP insofar as the transfers are subject to the FADP.

11.4 If, in fulfilling its obligations under this Agreement or pursuant to other lawful instructions from Data Controller, Personal Data must be transferred from the United Kingdom to any country that has not been recognized by the UK Information Commissioner’s Office, UK Parliament or UK Secretary of State as providing an adequate level of protection for Personal Data, the parties agree that the UK Addendum, attached hereto as Appendix 4, shall apply to such cross-border transfers.

11.5 The parties further agree that if any of the EU Standard Contractual Clauses or the UK Addendum are updated, replaced or are no longer available for any reason, the parties will cooperate in good faith to implement updated or replacement EU Standard Contractual Clauses or UK Addendum, as appropriate, or identify an alternative mechanism(s) to authorize the contemplated cross-border transfers.

12. Limitation of Liability

12.1 The limitations of liability and exclusions of damages set forth in the Agreement, including any aggregate liability cap, exclusion of indirect, incidental, consequential, special, or punitive damages, and any other limitations or disclaimers of liability contained therein, apply in full to any claims, losses, damages, or liabilities arising out of or relating to the parties' activities under this Addendum, including any breach of this Addendum, as if such activities were expressly addressed in those provisions. Nothing in this Addendum shall be construed to expand either party's liability beyond the limits established in the Agreement.

12.2 Notwithstanding the foregoing, to the extent that Applicable Laws (including the GDPR) impose mandatory liability rules that cannot be limited or excluded by contract, those mandatory rules shall apply; provided, however, that the limitations of liability in the Agreement shall apply to the fullest extent permitted by Applicable Laws.

13. Governing law and jurisdiction

13.1 This Addendum will be governed by and construed in accordance with governing law set forth in the Agreement, unless required otherwise by Applicable Laws.

13.2 Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

IN WITNESS WHEREOF, this Addendum is entered into and becomes a binding part of the Agreement with effect from the date first set out above.

[Data Controller]

Signature ______________________________

Name _________________________________

Title __________________________________

Date Signed ____________________________

Breakthrough Sales Corp.

Signature ______________________________

Name _________________________________

Title __________________________________

Date Signed ____________________________

APPENDIX 1

GDPR DETAILS OF PROCESSING OF PERSONAL DATA

A. LIST OF PARTIES

1. Data exporter(s):

Name: Party identified as Data Controller in the Agreement.

Address: The Data Controller address as provided in the Agreement.

Contact Person’s name, position and contact details: The Data Controller’s contact information is provided in the Agreement.

Activities relevant to the data transferred under the EU Standard Contractual Clauses: To receive the Services from the Data Processor as set forth in the Agreement and this Addendum.

Where applicable, by signing below we agree to be bound by the UK Addendum to the EU Commission Standard Contractual Clauses as of the effective date of this Data Processing Agreement.

Signature and date: See the data exporter’s signature on this Addendum.

Role (controller/processor): Controller

2. Data importer:

Name: Breakthrough Sales Corp.

Address: 215 Palisades Ave, Santa Monica, CA 90402

Contact Person’s name, position and contact details: Data Processor’s contact information is provided in the Agreement.

Activities relevant to the data transferred under the EU Standard Contractual Clauses: To provide the Services to the Data Controller as set forth in the Agreement and this Addendum.

Where applicable, by signing below we agree to be bound by the UK Addendum to the EU Commission Standard Contractual Clauses as of the effective date of this Data Processing Addendum.

Signature and date: See the data exporter’s signature on this Addendum

Role (controller/processor): Processor

DESCRIPTION OF TRANSFER

Categories of data subjects whose Personal Data is transferred:

Controller employee first name, last name, email address

Controller Representatives/Authorized Users

Customer's corporate customers, prospects, and other contacts whose information is provided to Data Processor by the Controller

Categories of Personal Data transferred:

First name, Last Name

Email Mailing Address or general geographic location

Internet Protocol address

Data Controller Representatives/Authorized Users: Username and password for third-party platforms with which the Services integrate.

Customer Data (processed on behalf of the Controller): Name, voice, and image of meeting participants; attendee lists, meeting titles, notes, and annotations from sales call recordings and transcripts; CRM records and internal business documents; business email address; professional profile information including current employer, job title or role, and LinkedIn profile URL; and engagement patterns associated with professional role and employer.

• Sensitive data transferred: None

The frequency of the transfer

Continuous or as set forth in the Agreement

Nature and purpose of the processing

The nature and purpose of the processing is described in the Agreement. Data Processor will process Personal Data to provide the Services and to comply with the terms of the Agreement and this Addendum. Processing activities include: (i) collecting and managing Controller Representative and Authorized User account information; (ii) receiving and processing Customer Data — including sales call recordings, transcripts, and CRM records — on behalf of the Controller using AI and machine learning tools to generate knowledge resources; (iii) processing professional profile and contact information about the Controller's corporate customers, prospects, and contacts, including data obtained from third-party data providers, to enrich contact records within the Controller's account; and (iv) processing engagement pattern data to generate buyer persona profiles at the Controller's direction, solely as a processor acting on the Controller's documented instructions.

The period for which the personal data will be retained

The Personal Data will be retained so long as necessary to provide the Services and to comply with Applicable Laws.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

The subject matter and nature of transfers to sub-processors are to support Data Processor’s provisioning of the Services. Duration of transfers is same as the duration of the processing by Data Processor.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority is the Data Protection Commission of Ireland or the Federal Data

Protection and Information Commissioner of Switzerland, as applicable.

Appendix 2

Technical and Organizational Measures

Data Processor will implement data protection by design and by default and data protection impact assessments under certain circumstances. In addition, Data Processor will maintain or ensure that is has implemented the following measures:

Policies or procedures requiring the incorporation of data protection mechanisms into the technical specifications of IT systems, networks, processing operations, and business practices.

Data protection impact assessments specifying the assessment information required by Article 35(7) of the GDPR.

Completed data protection impact assessments, audits, or other risk assessments which include:

identification of risks, including high-risk data processing;

risk mitigation plans;

identification of the lawful basis for processing Personal Data;

verification that data processing complies with Applicable Laws;

evidence that the organization integrated necessary safeguards into systems, networks, and processing operations;

evidence that the organization reviewed processing activities and risks considering changes to programs, systems, or processes; and

confirmation that Data Processor-made updates after program, system, or process changes affecting data protection risk.

Documentation showing consultation with the relevant supervisory authority in the case of high-risk processing.

Evidence of regular security measure testing and an evaluation of those measures’ effectiveness.

Detailed data privacy requirements for third parties that receive or access Personal Data such as Subprocessors, including contracts with third parties.

Undertake an analysis of the risks presented by Data Processor’s Processing, and use this to assess the appropriate level of security it needs to put in place.

Have an information security policy (or equivalent) and take steps to make sure the policy is implemented. Where necessary, have additional policies and ensure that controls are in place to enforce them.

Ensure that Data Procesor regularly reviews its information security policies and measures and, where necessary, improve them.

Understand that Data Processor may also need to put other technical measures in place depending on its circumstances and the type of personal data it processes.

Use encryption and/or pseudonymization where it is appropriate to do so.

Understand the requirements of confidentiality, integrity and availability for the Personal Data of Data Processor’s processes.

Make sure that Data Processor can restore access to personal data in the event of any incidents, such as by establishing an appropriate backup process.

Conduct regular testing and reviews of measures to ensure they remain effective, and act on the results of those tests where they highlight areas for improvement.

Where appropriate, implement measures that adhere to an approved code of conduct or certification mechanism.

Appendix 3 — Subprocessors

Data Processor engages the following Subprocessors to Process Personal Data in connection with the Services. Data Processor will give Data Controller notice of new or replacement Subprocessors as set out in the Subprocessing section above.

• Subprocessor — Company / Location — Purpose
• Google Cloud Platform (GCP) — Google LLC — Mountain View, CA, USA — Cloud hosting, database, storage, and encryption / key management
• Vercel — Vercel Inc. — Covina, CA, USA — Web application infrastructure
• Anthropic — Anthropic PBC — San Francisco, CA, USA — Foundation AI models
• OpenAI — OpenAI, L.L.C. — San Francisco, CA, USA — Foundation AI models
• Google (Gemini) — Google LLC — Mountain View, CA, USA — Foundation AI models
• LangSmith — LangChain, Inc. — San Francisco, CA, USA — LLM request / response monitoring
• Apollo — Apollo.io - USA — Data enrichment services
• Icypeas — Icypeas – Paris, France — Data enrichment services
• Enrichlayer — Vertical Int Inc. (d/b/a Enrich Layer) – USA — Data enrichment services
• Datadog — Datadog Inc – USA — Application user monitoring

Appendix 4

International Data Transfer Addendum to the EU Commission Standard Contractual Clause

VERSION B1.0, in force 21 March 2022

This International Data Transfer Addendum to the EU Commission Standard Contractual Clause (the "UK Addendum” or the “Addendum”) forms part of the EU Standard Contractual Clauses in this Appendix 4 to this Data Protection Addendum (this “DPA”).

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables

Table 1: Parties

Start date

Effective Date of the DPA.

The Parties

Exporter (who sends the Restricted Transfer) As set forth on Appendix 1

Importer (who receives the Restricted Transfer) As set forth on Appendix 1

Parties’ details

• Full legal name: As set forth on Appendix 1

Trading name (if different):

• Main address (if a company registered address): As set forth in the DPA
• Full legal name: As set forth on Appendix 1

Trading name (if different):

• Main address (if a company registered address): As set forth in the DPA

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs

The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information:

Date:

Reference (if any):

Other identifier (if any):

Or

the Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:

Module

Module in operation

Clause 7 (Docking Clause)

Clause 11 (Option)

Clause 9a (Prior Authorisation or General Authorisation)

Clause 9a (Time period)

Is personal data received from the Importer combined with personal data collected by the Exporter?

2

X

X

No

General Authorization

15 days

Yes

Table 3: Appendix Information – See Appendices 1-3 of the DPA

Table 4: Ending this Addendum when the Approved Addendum Changes

Ending this Addendum when the Approved Addendum changes

Which Parties may end this Addendum as set out in Section 0:

Importer

Exporter

neither Party

Part 2: Mandatory Clauses

Entering into this Addendum

Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.

Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

Addendum

This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.

Addendum EU SCCs

The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information.

Appendix Information

As set out in Table ‎3.

Appropriate Safeguards

The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.

Approved Addendum

The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 0.

Approved EU SCCs

The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

ICO

The Information Commissioner.

Restricted Transfer

A transfer which is covered by Chapter V of the UK GDPR.

UK

The United Kingdom of Great Britain and Northern Ireland.

UK Data Protection Laws

All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.

UK GDPR

As defined in section 3 of the Data Protection Act 2018.

This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.

If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.

If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.

If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.

Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 0 will prevail.

Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.

Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:

together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;

Sections 0 to 0 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and

this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

Unless the Parties have agreed alternative amendments which meet the requirements of Section 0, the provisions of Section 0 will apply.

No amendments to the Approved EU SCCs other than to meet the requirements of Section 0 may be made.

The following amendments to the Addendum EU SCCs (for the purpose of Section 0) are made:

References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;

In Clause 2, delete the words:

• “and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;

Clause 6 (Description of the transfer(s)) is replaced with:

• “The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;

Clause 8.7(i) of Module 1 is replaced with:

• “it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;

Clause 8.8(i) of Modules 2 and 3 is replaced with:

• “the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”

References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;

References to Regulation (EU) 2018/1725 are removed;

References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;

The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;

Clause 13(a) and Part C of Annex I are not used;

The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;

In Clause 16(e), subsection (i) is replaced with:

• “the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;

Clause 17 is replaced with:

• “These Clauses are governed by the laws of England and Wales.”;

Clause 18 is replaced with:

• “Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.

If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.

From time to time, the ICO may issue a revised Approved Addendum which:

makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or

reflects changes to UK Data Protection Laws;

The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.

If the ICO issues a revised Approved Addendum under Section 0, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:

its direct costs of performing its obligations under the Addendum; and/or

its risk under the Addendum,

and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.

APPENDIX 5

CCPA Additional Terms

In connection with the provision of Services, Data Controller will disclose Personal Information of California consumers or households to Data Processor, and Data Processor agrees to provide the services as a “service provider” as defined in CCPA Section 1798.140(v), as applicable.

In connection with the processing of Personal Information of California consumers or households by Data Processor as a Service Provider, the following terms apply:

Data Processor acknowledges and agrees that Data Controller discloses Personal Data to Data Processor solely for: (i) a valid business purpose; and (ii) to perform the Services as set forth in the Agreement, this Addendum and further detailed on Schedule 3.

2. Data Processor’s processing of Personal Data shall, at all times, be done in compliance with the CCPA, the Agreement, and this Addendum. Data Processor is prohibited from: (a) selling or sharing Personal Data; (b) retaining, using, or disclosing Personal Information for a commercial purpose other than providing the Services to Data Controller; (c) retaining, using, disclosing, or otherwise processing the Personal Data outside of the direct business relationship between Data Processor and Data Controller; or (d) combining or updating Personal Data with other personal information it obtains through other sources or directly from the consumer outside of the contract, except as permitted by Data Controller or otherwise allowed under the CCPA.

3. Data Controller will provide consumers and employees with a CCPA-compliant notice at collection when it collects personal information directly from individuals. If the Data Controller requires the Data Processor to collect personal information directly from individuals on the Data Controller’s behalf the Data Controller will provide the Data Processor with a notice at collection that pertains to the Data Controller’s CCPA notification requirements, to use for such purpose. The Data Processor will not modify or alter the notice in any way without the Data Controller’s prior written consent. The Data Processor is not responsible if the Data Controller-provided notice at collection does not comply with the applicable requirements of the CCPA.

4. If the CCPA permits, Data Processor may aggregate, deidentify, or anonymize personal information so it no longer meets the personal information definition, and may use such aggregated, deidentified, or anonymized data for its own purposes, including, without limitation, for the purposes of creating Benchmark Insights. Data Processor will not attempt to or actually re-identify any previously aggregated, deidentified, or anonymized data and will contractually prohibit downstream data recipients from attempting to or actually re-identifying such data.

Data Processor will reasonably and promptly assist Data Controller with meeting the Data Controller’s CCPA compliance obligations and responding to CCPA-related inquiries, including responding to verifiable consumer requests, taking into account the nature of the Data Processor’s processing and the information available to the Data Processor.

Data Processor must promptly comply with any Data Controller request or instruction requiring the Data Processor to provide, amend, transfer, or delete the personal information, or to stop, mitigate, or remedy any unauthorized processing, and communicate such request or instructions to Sub-processors or other downstream entities.

Data Processor must notify Data Controller immediately if it receives any complaint, notice, or communication that directly or indirectly relates either party’s compliance with the CCPA. Specifically, the Data Processor must notify the Data Controller within three (3) working days if it receives a verifiable consumer request under the CCPA.

5. Data Controller may, upon providing reasonable notice to Data Processor, take all reasonable and appropriate steps to prevent, stop, or remediate any unauthorized Processing of Personal Data.

6. Data Processor agrees to notify Data Controller in writing if it can no longer comply with the CCPA or its obligations under the Agreement or this Addendum.