Data Processing Addendum

1. Definitions

Capitalized terms not defined here have the meanings in the Terms of Service, and "Agreement" has the meaning given there. This addendum is part of the Agreement.

• "Customer Personal Data" means personal information within Customer Data that we process on your behalf in providing the Service. It mainly consists of phone numbers you submit and the results we return for them.
• "Data Protection Laws" means U.S. federal and state laws that apply to our processing of Customer Personal Data under the Agreement. These include the California Consumer Privacy Act as amended (the "CCPA") and its regulations; the comprehensive privacy laws of other U.S. states, such as those of Colorado, Connecticut, Oregon, Texas and Virginia; and, where applicable, the Gramm-Leach-Bliley Act and Canada's Personal Information Protection and Electronic Documents Act.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in our systems or those of our Subprocessors.
• "Subprocessor" means a third party we engage that processes Customer Personal Data.
• "Business", "service provider", "contractor", "controller", "processor", "sell", "share", "business purpose" and "consumer" have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

2.1 For Customer Personal Data, you are the business or controller and we are your service provider, contractor or processor. Annex 1 describes the processing.

2.2 This addendum does not cover personal information we handle as a business for our own purposes. That includes account and billing information about your users, and website and security logs. Our Privacy Policy covers that information.

2.3 You are responsible for the lawfulness of the Customer Personal Data you submit and of your instructions, including giving any required notices and obtaining any required consents.

2.4 If you use the Service for your own customers under Section 6.4 of the Terms, you act as their service provider or processor and we act as your subprocessor. You are responsible for having the agreements with your customers that this requires.

2.5 When a business uses our free lookup, we process the number for that business as its service provider under this addendum. Because a free lookup has no account and we usually can't identify the business, Section 7 notices for free lookups are given by updating Annex 3; Sections 9 and 11.2 and Section 5.6 of the Terms apply only where we can identify and contact the business; and we give any other notice the law requires. Free lookups are deleted after 7 days.

3. Processing only on your instructions

3.1 We process Customer Personal Data only to provide the Service to you, in line with the Agreement and your use and configuration of the Service, which together are your complete instructions. We also process it as the law requires, and if the law requires processing beyond your instructions we will tell you first unless the law prohibits it.

3.2 We will tell you if we believe an instruction violates Data Protection Laws, and we may decline to follow it.

3.3 The business purposes for which we process Customer Personal Data are: performing the lookups and batches you request and returning results to you, which is verifying customer information on your behalf (Cal. Civ. Code § 1798.140(e)(5)); honoring requests not to look up a number (Section 8.1); maintaining the security and integrity of the Service and preventing fraud and abuse; debugging to fix errors; testing and improving the quality of the Service, including checking that new versions return correct results, without using it to serve anyone else or to build profiles or databases; and complying with law.

4. Service provider commitments

We will not:

1. sell or share Customer Personal Data;
2. retain, use or disclose it for any purpose other than the business purposes in Section 3.3, including any other commercial purpose;
3. retain, use or disclose it outside the direct business relationship between you and us;
4. combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with consumers, except as Data Protection Laws permit service providers to do; or
5. use it to build or improve a profile of any person, or to build, enrich or maintain any database or list of phone numbers or the people who use them, for us or anyone else.

We will comply with the CCPA and other Data Protection Laws that apply to us as a service provider or processor, and give Customer Personal Data the level of privacy protection they require. We will notify you if we determine we can no longer meet our obligations under them. You may take reasonable and appropriate steps, under Section 10, to make sure we use Customer Personal Data consistently with your obligations, and, on notice, to stop and remediate any unauthorized use. We certify that we understand and will comply with the restrictions in this Section 4.

5. Personnel

Only personnel who need access to perform the Service, provide support you request, maintain security or comply with law may access Customer Personal Data. They are bound by confidentiality obligations. Lookups and batches are processed automatically; staff open an order or record only when needed for those reasons.

6. Security

We maintain the administrative, technical and physical safeguards described in Annex 2, designed to protect Customer Personal Data against Security Incidents and appropriate to the nature of the data and the risks of the processing. We may update these safeguards as long as we don't materially reduce the overall protection they provide.

7. Subprocessors

7.1 You authorize us to use the Subprocessors listed in Annex 3. We give each Subprocessor only the Customer Personal Data it needs to provide its services to us. Subject to Section 14.2, we remain responsible for our Subprocessors' processing of Customer Personal Data as if it were our own, and for meeting this addendum when we use them.

7.2 We will give at least 30 days' notice before adding or replacing a Subprocessor, by updating Annex 3 with the date of the change. We will also email the notice to everyone who has subscribed to subprocessor updates by emailing legal@phonevalidator.com with the subject "Subprocessor updates", and to any customer whose signed agreement with us asks for direct notice. Subscribers who tell us they resell under Section 6.4 of the Terms get at least 45 days' notice. If we must act sooner to keep the Service running, for example because a Subprocessor fails, we will give as much notice as we can. Updating Annex 3 under this Section 7 is not a change to this addendum under Section 16 of the Terms.

7.3 You may object on reasonable data protection grounds by emailing legal@phonevalidator.com within the notice period. We will try in good faith to address the objection. If we can't, you may stop using the affected part of the Service or close your account, and we will refund your unused purchased balance.

7.4 Our choice of telecommunications data providers is confidential business information. Annex 3 describes them by role and location. We will identify them to you on request, for your vendor review or to exercise your rights under this Section 7. Section 10 of the Terms is your agreement to keep their identity confidential, and no separate agreement is needed. You may share it, under a duty of confidentiality, with your and your affiliates' personnel, contractors and service providers who need it for vendor oversight (including vendor-risk platforms), and with your regulators, examiners, auditors, insurers and legal advisors; and, if you resell under Section 6.4 of the Terms, with a customer that needs it to review its own subprocessors, which may share it on the same terms. A notice of a new or replacement data provider under Section 7.2 will describe it the same way, and we will identify it on request on the same terms.

8. Requests and assistance

8.1 If we receive a request from a consumer about Customer Personal Data, we will tell you if we can identify you as the relevant customer and won't respond ourselves except to direct the person to you, or as the law requires. Requests to stop looking up a phone number are an exception: we honor those directly, across all customers, through our suppression list, as our Privacy Policy explains.

8.2 Taking into account the nature of the processing and the information available to us, we will give you reasonable help to meet your obligations under Data Protection Laws. This includes responding to consumer requests (mostly through the self-service deletion tools in your account), security, Security Incident notification, and data protection assessments.

9. Security incidents

9.1 We will notify you without undue delay, and in any case within 72 hours, after we become aware of a Security Incident, or of a breach of our systems that exposes your account credentials or API keys, even if our investigation is continuing. We become aware when we have a reasonable degree of certainty that a Security Incident has occurred. We will send the notice to your account email and to any security contact you designate by emailing security@phonevalidator.com.

9.2 Our notice will describe, as far as we then know: the nature of the incident; the date or estimated date range; the categories and approximate volume of data affected; whether the data was encrypted and whether keys were exposed; its likely consequences; the steps we have taken or propose; and a contact for more information. We will update you as we learn more, take reasonable steps to contain and remediate the incident, and cooperate with your reasonable requests, including for notices you must give.

9.3 Our notification is not an admission of fault or liability. Unsuccessful attempts that don't compromise Customer Personal Data, such as pings, port scans and blocked login attempts, are not Security Incidents.

9.4 If you tell us you are a banking organization, we will notify your designated contact as soon as possible after we determine that we have had a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the Service for you for four or more hours.

10. Information and assessments

10.1 We will make available the information reasonably necessary to demonstrate our compliance with this addendum. That includes our security page and written answers to a reasonable security or privacy questionnaire. You may send one questionnaire a year, and another after a Security Incident or if a regulator requires it.

10.2 You may also have an independent assessor, bound by confidentiality, review our compliance with this addendum. You must give at least 30 days' notice. The review must be remote where possible, limited to one review in any 12-month period, held during business hours without disrupting our operations, and at your cost. It must not include access to other customers' data or to our Subprocessors' systems.

10.3 If a regulator or examiner with authority over you, or over a customer you serve under Section 6.4 of the Terms, asks to review our processing of your Customer Personal Data, we will cooperate reasonably and promptly, including by answering its questions and making records and knowledgeable staff available remotely. That review doesn't count toward Section 10.2's limit, and its notice period is what the regulator requires. You will reimburse our reasonable costs for any such review that takes more than 8 hours of our time in a year.

11. Retention, deletion and return

11.1 We keep Customer Personal Data only as follows:

• API lookups: we don't store submitted numbers or results.
• Free lookups: stored 7 days, as is any feedback a visitor sends about a free lookup's result.
• Account web lookups: stored up to 7 days. Lookups under billing review or correction are kept until resolved, and their number and result are deleted 7 days after resolution.
• Batch files and results: stored up to 7 days after completion (30 days for batches ordered before October 5, 2026), except batches with a payment hold or failed processing, kept until resolved.
• HubSpot app results: we don't store the number. The results are held only until HubSpot accepts them, and at most 3 days, so a failed write-back can be retried without a new charge.

You can delete lookups and batches sooner in your account. Results we have delivered to you, including values written to your CRM or other connected platform and files you download, are in your systems and under your control; we don't change or delete them.

11.2 When the Agreement ends or you close your account, we delete remaining Customer Personal Data within 30 days, and on request we will confirm the deletion in writing. Closing your account deletes your batch files immediately, so download any results you need first; on request we will help you export Customer Personal Data we still hold. Deleted data may remain in encrypted backups until they expire (35 days, and 1 year for our separate protected backup copy). We keep it isolated there, don't restore it except to recover the Service or to test recovery in an isolated environment that we delete afterwards, and continue to protect it under this addendum.

11.3 We may keep records that contain no phone numbers or results, such as billing records and the ledger, as our Privacy Policy describes (although a dashboard lookup's charge may keep a keyed one-way code of the number), and any data the law requires us to keep.

12. Location and international data

12.1 We store Customer Personal Data, and run the systems that process it, in the United States on Amazon Web Services. Requests are received at content delivery network locations that may be outside the United States, and forwarded encrypted to our servers in the United States. We send numbers to our telecommunications data provider through its United States endpoints. Email you send us is held in Google Workspace, which may store it outside the United States.

12.2 The Service is designed for businesses in the United States and Canada. You will not submit personal data subject to the EU or UK General Data Protection Regulation or Swiss data protection law unless we have signed a separate data transfer addendum with you.

12.3 For Canadian customers, we will protect Customer Personal Data in line with this addendum and give it a level of protection comparable to that required by Canadian privacy law. You are responsible for telling individuals, where required, that their information may be processed in the United States.

13. Financial institutions (GLBA)

If Customer Personal Data includes nonpublic personal information that you, a financial institution you work for, or a customer you serve under Section 6.4 of the Terms must protect under the Gramm-Leach-Bliley Act, the FTC Safeguards Rule (16 C.F.R. part 314) or similar rules, we will:

1. use and disclose it only to perform the Service for you, as Regulation P (12 C.F.R. § 1016.11) or the reuse rule that applies to you permits;
2. maintain the safeguards in Annex 2 as our written information security program for it;
3. notify you of Security Incidents as Section 9 provides; and
4. give you the information in Section 10 so you can oversee us as a service provider; and
5. not use it for the testing and improvement purpose in Section 3.3 except as needed to perform the Service for you. This Section 13 controls over Section 3.3.

14. General

14.1 This addendum lasts as long as we process Customer Personal Data for you.

14.2 Each party's liability under or in connection with this addendum is subject to the limitations and exclusions in the Terms of Service. Nothing in this addendum limits your obligations under the Terms of Service.

14.3 If this addendum conflicts with the Terms of Service on the handling of personal information, this addendum controls. A signed order form or data protection agreement between us controls over this addendum to the extent it expressly says so.

14.4 We may update this addendum as the Terms of Service describe. We will not make a change that reduces your protection under Data Protection Laws unless the law, a regulator or a court requires it.

14.5 This addendum is governed by the same law, and disputes under it are resolved in the same way, as under the Terms of Service.