Data Processing Agreement

1. Scope and applicability

1.1 This DPA applies to Clear C2's Processing of Personal Information on Customer's behalf, as a Processor, to provide the Service, including Personal Information about Contacts contained in Customer Data.

1.2 This DPA takes effect when you accept the Terms of Service and remains in force for as long as we Process Personal Information on your behalf.

2. Roles and instructions

2.1 Customer is the Controller and Clear C2 is the Processor of Personal Information processed as part of the Service. Each party is responsible for complying with its own obligations under Applicable Data Protection Law. Customer is responsible for having a lawful basis, and any notice or consent required, for the Personal Information it provides to the Service.

2.2 Clear C2 will Process Personal Information only to provide the Service in accordance with the Terms of Service, this DPA, and Customer's documented instructions, which include Customer's configuration and use of the Service. We will inform Customer if we believe an instruction violates Applicable Data Protection Law.

2.3 Clear C2 will not sell or share Personal Information as those terms are defined under the CCPA, and will not retain, use, or disclose it for any purpose other than providing the Service, except as Applicable Data Protection Law permits.

2.4 The Service is not designed to protect sensitive or special categories of Personal Information, such as health, financial account, or government identification data. Unless we have agreed otherwise in writing, Customer will not provide that information to the Service.

3. Requests from individuals

3.1 If Customer receives a request from an Individual to exercise rights over Personal Information processed in the Service, Customer can address it directly in the Service, for example by viewing, editing, exporting, or deleting the Contact record. Where Customer cannot do so itself, Customer may email support@clearc2.com with detailed written instructions and we will reasonably assist.

3.2 If Clear C2 receives a request directly from an Individual who identifies Customer as the Controller, we will promptly pass it to Customer without responding to the Individual. Otherwise, we will advise the Individual to identify and contact the relevant Controller.

4. Affiliates and sub-processors

4.1 Customer authorizes Clear C2 to engage Clear C2 Affiliates and Third-party Sub-processors to Process Personal Information in providing the Service, such as hosting, email delivery, payment processing, and AI providers. Each is bound by written terms requiring at least the same level of data protection and security as this DPA, and Clear C2 remains responsible for their compliance with this DPA and Applicable Data Protection Law.

4.2 A current list of our Third-party Sub-processors is available on request at support@clearc2.com. We will notify Customer before adding or replacing a Third-party Sub-processor. Customer may object on reasonable data protection grounds within 30 days of the notice, and if we cannot resolve the objection, Customer may terminate the affected part of the Service.

5. Cross-border data transfers

5.1 Clear C2 may Process Personal Information globally as necessary to provide the Service.

5.2 Where a transfer of Personal Information is subject to cross-border transfer restrictions under Applicable Data Protection Law, the transfer will be made (i) for Clear C2 Affiliates, in compliance with Applicable Data Protection Law and Clear C2's security and data privacy policies, and (ii) for Third-party Sub-processors, under security and data privacy requirements consistent with this DPA and Applicable Data Protection Law, including an approved transfer mechanism such as the EU Standard Contractual Clauses where required.

6. Security and confidentiality

6.1 Clear C2 has implemented and will maintain appropriate technical and organizational security measures designed to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information. These measures cover physical access, system access, data access, transmission and encryption, input control, data backup, data segregation, and security oversight and enforcement.

6.2 All Clear C2 and Clear C2 Affiliate personnel, and any Third-party Sub-processors, that Process Personal Information are subject to written confidentiality obligations, regular training on information protection, and Clear C2 policies on protecting confidential information.

7. Audit rights

7.1 Customer may audit Clear C2's compliance with this DPA up to once per year, or more often where Applicable Data Protection Law requires it.

7.2 A third-party auditor must be mutually agreed by Customer and Clear C2, unless the auditor is a Regulator. We will not unreasonably withhold consent. The auditor must sign a written confidentiality agreement acceptable to Clear C2 or be bound by a statutory or legal confidentiality obligation.

7.3 To request an audit, Customer must send Clear C2 a detailed proposed audit plan, describing its scope, duration, and start date, at least two weeks before the proposed audit date. We will review the plan, raise any concerns or questions, and work with Customer in good faith to agree on a final plan.

7.4 Audits must take place during regular business hours, follow the agreed plan and Clear C2's health, safety, and other relevant policies, and may not unreasonably interfere with Clear C2's business.

7.5 Customer will give Clear C2 a copy of the audit report, which is Clear C2's confidential information under the Terms of Service. Customer may use the report only to meet its regulatory audit requirements or confirm compliance with this DPA.

7.6 Each party bears its own audit costs. If Clear C2 expects to incur charges not covered by the fees for the Service, such as third-party contractor fees, we will tell Customer promptly after reviewing the audit plan and the parties will negotiate those charges in good faith.

7.7 If the requested scope is covered by a SOC, ISO, NIST, PCI DSS, or similar report issued by a qualified third-party auditor within the prior 12 months, and Clear C2 provides that report and confirms there have been no known material changes to the audited controls, Customer will accept the report's findings in place of auditing the same controls.

8. Incident management and breach notification

8.1 Clear C2 has implemented controls and policies designed to detect and promptly respond to incidents that suggest destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information. We will investigate such incidents to confirm whether a Personal Information Breach has occurred, identify the root cause, mitigate possible adverse effects, and prevent a recurrence.

8.2 Clear C2 will notify Customer of a confirmed Personal Information Breach without undue delay, and in any case within 72 hours. As information becomes available, we will provide (i) a description of the nature and reasonably anticipated consequences of the breach, (ii) the measures taken to mitigate adverse effects and prevent a recurrence, and (iii) where possible, the types of Personal Information involved. Customer will coordinate with Clear C2 on the content of any public statements or notices to affected Individuals or Regulators about the breach.

9. Return and deletion

9.1 When the Service ends, Clear C2 will make data export functionality available and will then delete remaining copies of Personal Information from our systems, except where the Terms of Service or Applicable Data Protection Law require us to retain it.

9.2 Customer should export or back up any Personal Information it wants to keep before its subscription ends, including for any part of the Service that does not offer export functionality.

10. Legal requirements

10.1 Clear C2 may be required by law to provide access to Personal Information, for example to comply with a subpoena or other legal process, or to respond to requests from public or government authorities, including for national security or law enforcement purposes.

10.2 Clear C2 will promptly inform Customer of any such request, unless the law prohibits us from doing so.

11. Definitions

• "Applicable Data Protection Law" means all data privacy and data protection laws and regulations that apply to the Processing of Personal Information under this DPA, which may include the GDPR and UK GDPR, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA").
• "Clear C2 Affiliate" means a subsidiary of Clear C2, Inc. that may Process Personal Information as described in section 4.
• "Individual" has the same meaning as "data subject," "consumer," or the equivalent term under Applicable Data Protection Law.
• "Personal Information" has the same meaning as "personal data," "personal information," "personally identifiable information," or the equivalent term under Applicable Data Protection Law.
• "Personal Information Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information transmitted, stored, or otherwise Processed on Clear C2 systems that compromises its security, confidentiality, or integrity.
• "Process, Processing, Controller, and Processor" have the meanings given under Applicable Data Protection Law, including "business" and "service provider" under the CCPA.
• "Regulator" means a "supervisory authority," "data protection authority," or the equivalent under Applicable Data Protection Law.
• "Third-party Sub-processor" means a third party, other than a Clear C2 Affiliate, that Clear C2 engages and that may Process Personal Information as described in section 4.

Contact

Questions about this DPA, sub-processor requests, and audit requests can go to support@clearc2.com or by mail to: