Data Processing Terms

1. Definitions

"Applicable Data Protection Laws" means all privacy and data protection laws that apply to the processing under this DPA, including the California Consumer Privacy Act as amended by the CPRA ("CCPA"), other U.S. state privacy laws, and, where applicable, the EU and UK General Data Protection Regulation ("GDPR").

"Personal Data" means information relating to an identified or identifiable person that VMP Agency processes on Client's behalf under the Agreement.

"Data Subject" means the individual to whom Personal Data relates (for example, Client's leads, customers, members, or contacts).

"Processing" means any operation performed on Personal Data, such as collection, use, storage, disclosure, or deletion.

"Subprocessor" means a third party engaged by VMP Agency to process Personal Data in providing the Services.

The terms "Controller," "Processor," "Service Provider," "Business," "sell," and "share" have the meanings given in Applicable Data Protection Laws.

2. Roles and Scope of Processing

Client is the Controller (and, under the CCPA, the Business) of the Personal Data. VMP Agency is the Processor (and, under the CCPA, the Service Provider). VMP Agency processes Personal Data only to provide the Services and only on Client's documented instructions, including those in the Agreement, this DPA, and Client's configuration of the Services. The subject matter, nature and purpose, duration, categories of Data Subjects, and types of Personal Data are described in Annex 1. If VMP Agency believes an instruction violates Applicable Data Protection Laws, it will notify Client.

3. VMP Agency's Obligations

• (a) Instructions. VMP Agency processes Personal Data only as needed to provide the Services and on Client's documented instructions, and not for its own independent purposes.
• (b) Confidentiality. VMP Agency ensures that personnel and approved support partners authorized to process Personal Data are bound by confidentiality obligations.
• (c) Security. VMP Agency implements and maintains the technical and organizational security measures described in Annex 2, appropriate to the risk and the nature of the Personal Data.
• (d) Subprocessors. Client provides general authorization for VMP Agency to engage Subprocessors to provide the Services. The current Subprocessors are listed in Annex 3. VMP Agency imposes data protection obligations on each Subprocessor that are substantially similar to those in this DPA, and remains responsible for its Subprocessors' performance. The current list is published at vmpagency.com/dpa; VMP Agency updates that page at least 14 days before a new Subprocessor first processes Client Personal Data, and Client may request email notice of changes at support@vmpagency.com. If Client objects on reasonable data protection grounds and the parties cannot resolve the objection, Client may terminate the affected Services.
• (e) Assistance. Taking into account the nature of the processing, VMP Agency provides reasonable assistance to help Client respond to Data Subject requests (such as access, correction, deletion, or opt-out) and to meet Client's obligations around security, breach notification, and data protection assessments. Where VMP Agency receives a Data Subject request directly, it will, unless legally prohibited, direct the request to Client rather than respond itself.
• (f) Breach notification. VMP Agency notifies Client without undue delay, and in any event within 72 hours of confirming, a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data, by email to Client's account owner, and provides information reasonably available to help Client meet its own notification obligations.
• (g) Deletion. On termination of the Services, VMP Agency deletes the Personal Data it holds on Client's behalf within 30 days of the request or termination. Copies in encrypted backups expire within a further 30 days. This does not apply where the law requires VMP Agency to keep data, or to data in Client's own connected systems (such as Client's GoHighLevel account or booking system). Those systems stay under Client's control. Client gets its data back through the self serve export in the Services, which Client may use at any time while its subscription is active. VMP Agency does not return, send, or deliver copies of data after termination. On request, VMP Agency will confirm deletion in writing, including a per-table record of what was removed.
• (h) Records and audit. VMP Agency makes available information reasonably necessary to demonstrate compliance with this DPA, and allows for and contributes to reasonable audits, which may be satisfied by VMP Agency's written responses, documentation, or available third-party reports, on reasonable notice and no more than once per year unless required by a regulator or following a breach.

4. Client's Obligations

Client is responsible for: the accuracy, quality, and legality of the Personal Data and the means by which it acquired it; having a lawful basis and all necessary notices and consents for the processing it instructs; its configuration and use of the Services; and not instructing VMP Agency to process special categories of sensitive Personal Data unless the parties have agreed in writing and put appropriate safeguards in place.

5. U.S. State Privacy Law Terms (Service Provider)

With respect to Personal Data subject to the CCPA, VMP Agency acts as a Service Provider. VMP Agency will not: sell or share the Personal Data; retain, use, or disclose it for any purpose other than performing the Services or as otherwise permitted by the CCPA; retain, use, or disclose it outside the direct business relationship between the parties; or combine it with personal information from other sources except as permitted by the CCPA. VMP Agency certifies that it understands and will comply with these restrictions. These terms apply equivalently where other U.S. state privacy laws use similar concepts.

6. International Transfers

The Services are operated primarily in the United States. If Client's instructions involve the processing of Personal Data subject to the GDPR or UK GDPR, the parties will put in place an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or the UK Addendum, which are incorporated by reference and completed using the details in the Annexes, to the extent required by Applicable Data Protection Laws.

7. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. This DPA does not increase a party's total liability beyond the cap stated in the Agreement.

8. Term and Termination

This DPA takes effect when Client first agrees to it and remains in effect for as long as VMP Agency processes Personal Data on Client's behalf under the Agreement. Sections that by their nature should survive (including confidentiality, deletion, records and audit, and liability) survive termination.

9. General

This DPA is governed by the laws of the State of Arizona, consistent with the Agreement. Except as amended by this DPA, the Agreement remains in full force and effect.

Annex 1 — Details of Processing

• Categories of Data Subjects: Client's leads, prospects, customers, members, and contacts, and other individuals who interact with Client's communications, booking or business systems, content, or social channels.
• Types of Personal Data: name, contact details (email and phone), birthday (month and day only, never the year), the emails Client's staff send to Data Subjects through the Services and the replies, other message and conversation content, appointment and booking details, visit or activity history, payment status (such as whether a payment is current, failed or overdue, but never card numbers), and any other data Client sets the Services to collect.
• Special categories: none, unless separately agreed in writing under Section 4.
• Nature and purpose: providing the AI receptionist and automation services, the Insights Platform, custom builds, media production, and social media management, on Client's behalf and per Client's configuration.
• Duration: for the term of the Agreement, plus any limited period needed for deletion.

Annex 2 — Technical and Organizational Security Measures

VMP Agency maintains measures appropriate to the risk, including: encryption of Personal Data in transit; access controls and least-privilege access for personnel; multi-factor authentication where available; logical separation (tenant isolation) of Client data in VMP Agency's own infrastructure; use of reputable infrastructure and platform providers that maintain their own security programs; and procedures for identifying and responding to security incidents. Personal Data that resides in Client's own connected systems is also subject to those platforms' security controls and Client's settings.

Annex 3 — Approved Subprocessors

VMP Agency uses the following subprocessors to help provide the Services. Each is engaged only for the Services that actually use it, and processing occurs primarily in the United States:

• Supabase: application database and hosting (Insights Platform and custom builds)
• Vercel: application hosting
• GitHub: source-code hosting and scheduled data-sync execution (Insights Platform); data is processed on GitHub-hosted runners during each sync
• GoHighLevel / LeadConnector: CRM, messaging, SMS, telephony, and automation
• Anthropic: AI model provider
• OpenAI: AI model provider
• Google: AI model provider, analytics, advertising, and business email (Google Workspace)
• Meta: advertising and analytics
• Stripe: payment processing
• GoHighLevel (LC Email) or Resend: email delivery, notifications, and staff-to-member messaging, depending on the application
• Metricool: scheduling and publishing social content

Questions

VMP Agency keeps the subprocessor list current, and may add a subprocessor when a Client connects a new platform or remove one it stops using. Questions about this DPA or a signed copy for your records: support@vmpagency.com.