Last Updated: September 16, 2026

This Data Processing Addendum (the “DPA”) forms part of the agreement between KickoffLabs LLC, a Washington limited liability company (“KickoffLabs”), and the customer that uses the Services (“Customer”). It is incorporated into the KickoffLabs Terms of Service or other written agreement governing Customer’s use of the Services (the “Agreement”).

This version of the DPA is effective on September 16, 2026 for Customers already using the Services on that date, and on the date a new Customer accepts the Agreement thereafter (the “Effective Date”). No separate signature is required. If the parties sign a version of this DPA, the signed version will control for those parties.

1. Definitions

“Applicable Data Protection Law” means privacy, data protection, and data security laws that apply to the Processing of Customer Personal Data under the Agreement, including, where applicable: (a) Regulation (EU) 2016/679 (the “EU GDPR”); (b) the EU GDPR as incorporated into United Kingdom law, together with the UK Data Protection Act 2018 (the “UK GDPR”); (c) the Swiss Federal Act on Data Protection (the “Swiss FADP”); and (d) United States state privacy laws that impose processor, service-provider, or contractor obligations.

“Customer Personal Data” means Personal Data that KickoffLabs Processes on Customer’s behalf in connection with the Services. It does not include Personal Data for which KickoffLabs determines the purposes and means of Processing, such as billing, account administration, and direct business communications, which is governed by the KickoffLabs Privacy Policy.

“Data Subject,” “Personal Data,” “Personal Data Breach,” “Process,” “Processing,” “Processor,” and “Controller” have the meanings given to them by Applicable Data Protection Law. “Controller” includes a “business,” and “Processor” includes a “service provider” or “contractor,” where those terms apply under United States state privacy laws.

“Services” means the KickoffLabs products and services Customer receives under the Agreement.

“Subprocessor” means a third party engaged by KickoffLabs to Process Customer Personal Data on Customer’s behalf.

“EU SCCs” means the standard contractual clauses in the Annex to European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, available from the European Commission’s official EUR-Lex site.

“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, in force March 21, 2022, issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018, available from the Information Commissioner’s Office, as revised in accordance with its mandatory provisions.

2. Scope and Roles

2.1 This DPA applies only to the extent KickoffLabs Processes Customer Personal Data on Customer’s behalf and Applicable Data Protection Law applies to that Processing.

2.2 Customer is the Controller of Customer Personal Data and KickoffLabs is the Processor. If Customer acts as a Processor for another Controller, KickoffLabs acts as Customer’s Subprocessor. Each party will comply with the obligations applicable to it under Applicable Data Protection Law.

2.3 Customer is responsible for: (a) providing all required notices and obtaining all required permissions or other lawful bases for Processing; (b) the lawfulness and accuracy of Customer Personal Data; (c) Customer’s instructions to KickoffLabs; and (d) configuring and using the Services in compliance with Applicable Data Protection Law.

3. Processing Instructions

3.1 KickoffLabs will Process Customer Personal Data only: (a) to provide, secure, support, and improve the Services in accordance with the Agreement and this DPA; (b) on Customer’s other documented instructions; or (c) as required by applicable law. The Agreement, this DPA, Customer’s configuration and use of the Services, and Customer’s documented support requests constitute Customer’s documented instructions.

3.2 If applicable law requires KickoffLabs to Process Customer Personal Data other than on Customer’s instructions, KickoffLabs will notify Customer before that Processing unless the law prohibits notice on important grounds of public interest.

3.3 KickoffLabs will immediately inform Customer if, in KickoffLabs’ opinion, an instruction infringes Applicable Data Protection Law. KickoffLabs may suspend the affected Processing until Customer modifies or confirms the instruction.

4. Confidentiality and Personnel

KickoffLabs will ensure that persons authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations and receive appropriate privacy and security training. Access to Customer Personal Data will be limited to personnel who need access to provide, secure, or support the Services.

5. Security

5.1 Taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of Processing, and the risk to Data Subjects, KickoffLabs will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

5.2 The measures in Annex II and the current Security Measures page describe the safeguards in place. KickoffLabs may update those safeguards as technology and threats evolve, provided the updates do not materially decrease the overall protection of Customer Personal Data.

5.3 Customer is responsible for securely configuring the Services, protecting account credentials, limiting account access, and using appropriate safeguards when exporting or transmitting Customer Personal Data outside the Services.

6. Personal Data Breaches

6.1 KickoffLabs will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will be sent to the account contact or by another reasonable channel.

6.2 As information becomes reasonably available, KickoffLabs will provide information necessary for Customer to meet applicable breach-notification obligations, including the nature of the incident, affected data and Data Subjects, likely consequences, and measures taken or proposed. KickoffLabs’ notification of or response to a Personal Data Breach is not an acknowledgment of fault or liability.

7. Subprocessors

7.1 Customer gives KickoffLabs general written authorization to engage the Subprocessors listed on the Subprocessor page. That page is incorporated into this DPA as Annex III.

7.2 KickoffLabs will enter into a written agreement with each Subprocessor that imposes the same data protection obligations that apply to KickoffLabs under this DPA, to the extent applicable to the Subprocessor’s Processing. KickoffLabs remains responsible for each Subprocessor’s performance of its data protection obligations to the extent required by Applicable Data Protection Law.

7.3 KickoffLabs will provide notice of a new Subprocessor at least ten (10) days before authorizing that Subprocessor to Process Customer Personal Data, ordinarily by email to the account contact or by another reasonable method. Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith to resolve the objection. If they cannot, Customer may discontinue the affected feature or terminate the affected Services in accordance with the Agreement. If Customer is a Processor, Customer represents that its Controller has granted the required general written authorization for Subprocessors. Customer will provide KickoffLabs with a current Controller contact on request, and KickoffLabs will provide the intended-change notice to that Controller directly or through a notice channel designated in writing by the Controller. Customer will promptly forward any notice it receives on the Controller’s behalf.

8. Data Subject Requests and Regulatory Assistance

8.1 Taking into account the nature of the Processing, KickoffLabs will provide appropriate technical and organizational assistance, insofar as reasonably possible, to help Customer respond to requests by Data Subjects to exercise their rights. If KickoffLabs receives a request concerning Customer Personal Data directly from a Data Subject, KickoffLabs will direct the requester to Customer or notify Customer, unless legally prohibited.

8.2 Taking into account the nature of the Processing and information available to KickoffLabs, KickoffLabs will provide reasonable assistance with Customer’s obligations concerning security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities under Articles 32 through 36 of the EU GDPR or equivalent requirements.

9. Return and Deletion

Upon termination or expiration of the Services, at Customer’s choice, KickoffLabs will return or delete Customer Personal Data and delete existing copies within a reasonable period, except to the extent applicable law requires retention. Customer Personal Data in backups will be put beyond ordinary use, remain protected under this DPA, and be deleted as the backups expire under KickoffLabs’ documented backup lifecycle. Legally retained data will not be Processed for another purpose unless required by law.

10. Information and Audits

10.1 KickoffLabs will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may request written responses to reasonable privacy and security questionnaires no more than once in any twelve-month period, unless a Personal Data Breach or regulator request reasonably requires additional review.

10.2 Customer may conduct an audit or inspection itself or through a qualified independent auditor. The parties will ordinarily use current certifications, reports, and written responses first when those materials can reasonably satisfy the audit objective. Audits are subject to reasonable advance notice, confidentiality obligations, reasonable scope and duration, and measures to avoid disruption or risks to other customers. Customer will bear its audit costs unless the audit identifies a material breach by KickoffLabs. Nothing in this section requires KickoffLabs to disclose information that would compromise another customer’s security or confidentiality, privileged information, or trade secrets unrelated to the audit.

11. Government Requests

Unless prohibited by law, KickoffLabs will notify Customer of a legally binding demand by a public authority for Customer Personal Data. Where appropriate and legally permitted, KickoffLabs will direct the authority to request the data from Customer, review the legality of the demand, and challenge demands that KickoffLabs reasonably believes are unlawful or overbroad.

12. International Transfers

12.1 Customer authorizes KickoffLabs and its Subprocessors to Process Customer Personal Data in the United States and other countries where they operate, subject to this DPA and a valid transfer mechanism where required.

12.2 If Customer transfers Customer Personal Data protected by the EU GDPR to KickoffLabs in a country not recognized by the European Commission as providing an adequate level of protection, the EU SCCs are incorporated into this DPA as described in Annex IV.

12.3 If Customer transfers Customer Personal Data protected by the UK GDPR to KickoffLabs in a country not covered by UK adequacy regulations, the EU SCCs, as completed by this DPA, and the UK Addendum are incorporated into this DPA as described in Annex V.

12.4 If Customer transfers Customer Personal Data protected by the Swiss FADP to a country that does not provide adequate protection under Swiss law, the EU SCCs apply with the adaptations in Annex VI.

12.5 The parties will reasonably cooperate with transfer impact assessments and with implementing supplementary safeguards that are reasonably necessary for a lawful transfer. If a valid alternative transfer mechanism applies to a transfer, that mechanism may be used instead of the mechanisms above.

13. United States State Privacy Laws

To the extent a United States state privacy law applies to Customer Personal Data, KickoffLabs will act as Customer’s service provider, contractor, or processor, as applicable. KickoffLabs will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data outside the direct business relationship with Customer or for a purpose other than the limited and specified purposes in the Agreement and this DPA; or (c) combine Customer Personal Data with Personal Data received from another person or collected from KickoffLabs’ own interaction with a consumer, except as permitted by applicable law. KickoffLabs will provide the same level of privacy protection required of Customer, will notify Customer if it can no longer meet those obligations, and grants Customer the right to take reasonable and appropriate steps to stop and remediate unauthorized use.

14. General

14.1 If there is a conflict among the documents governing Processing, the following order of precedence applies: (a) the EU SCCs or UK Addendum, as applicable; (b) this DPA; and (c) the Agreement.

14.2 The limitations of liability in the Agreement apply to this DPA to the maximum extent permitted by law, but they do not limit rights that the EU SCCs or UK Addendum grant directly to Data Subjects or supervisory authorities.

14.3 Except where the EU SCCs, UK Addendum, or Applicable Data Protection Law require otherwise, this DPA is governed by the governing-law and dispute-resolution provisions in the Agreement.

14.4 If KickoffLabs makes a material change to this DPA, KickoffLabs will provide reasonable notice. Changes required to comply with law may take effect on the date stated in the updated DPA.

---

Annex I — Details of Processing

Subject matter	Provision, operation, security, support, and improvement of the Services under the Agreement.
Duration	For the term of the Agreement and the period necessary to return or delete Customer Personal Data in accordance with this DPA.
Nature and purpose	Collecting, recording, organizing, storing, hosting, retrieving, displaying, transmitting, analyzing, protecting, deleting, and otherwise Processing Customer Personal Data as necessary to provide landing pages, forms, campaigns, referrals, scoring, messaging, integrations, analytics, fraud prevention, support, and related Services configured by Customer.
Categories of Data Subjects	Customer’s account users and personnel; visitors to Customer campaign pages; leads, entrants, subscribers, referrers, invitees, and other individuals whose Personal Data Customer submits to or collects through the Services.
Categories of Personal Data	Names, email addresses, telephone numbers when Customer enables SMS features, IP addresses, device and browser data, cookie or referral identifiers, approximate location derived from IP address, campaign activity and scoring data, communication preferences, custom fields configured by Customer, content submitted by Customer or Data Subjects, and support or integration data.
Sensitive or special-category data	Customer must not submit sensitive or special-category Personal Data to the Services unless the parties first sign a written order or addendum that identifies the data, Processing instructions, restrictions, and safeguards. Absent that written agreement, no sensitive or special-category Personal Data is authorized for Processing.
Frequency	Continuous or as initiated and configured by Customer during the term of the Agreement.
Retention	For the term of the Agreement and according to Customer’s configuration, deletion activity, applicable product retention settings, backup cycles, and legal obligations.

Annex II — Technical and Organizational Measures

• Identity and access management: production and administrative access is restricted to authorized personnel with a business need; personnel are subject to confidentiality obligations; application authorization checks and tenant-scoped queries logically segregate customer accounts and records.
• Authentication: account passwords are stored with one-way password hashing; login endpoints use controls designed to limit repeated authentication attempts; account owners can restrict access to authorized team members.
• Transmission security: supported login, application, API, and public campaign endpoints use TLS to encrypt data in transit; administrative access uses encrypted connections.
• Application and infrastructure protection: rate limiting and abuse controls protect internet-facing endpoints; production changes are limited to authorized personnel; cloud hosting, database, storage, search, and content-delivery functions are provided by the providers listed on the Subprocessor page.
• Logging, monitoring, and response: application errors, service health, and security-relevant events are monitored to support triage, investigation, containment, remediation, and customer notification.
• Availability and recovery: production data is backed up; recovery procedures support restoration after an incident or service disruption; backup copies are access-restricted and expire under the backup lifecycle.
• Secure operations: personnel receive security and privacy training; dependencies and reported vulnerabilities are reviewed; material providers that Process Customer Personal Data are subject to contractual data-protection obligations.
• Data lifecycle and Controller assistance: product and support workflows enable access, export, correction, restriction, and deletion; account and campaign deletion initiates deletion workflows; support personnel can assist with Data Subject requests, incidents, DPIAs, consultations, and audits under this DPA.
• Evaluation: safeguards are reviewed and adjusted in light of changes to the Services, technology, threats, and the risks of the Processing.

Annex III — Subprocessors

The authorized Subprocessors, their purposes, and relevant processing information are listed on the current KickoffLabs Subprocessor page.

Annex IV — EU Standard Contractual Clauses

The EU SCCs are incorporated by reference and completed as follows:

• Modules: Module Two (Controller to Processor) applies when Customer is a Controller. Module Three (Processor to Processor) applies when Customer is a Processor. No other module applies.
• Clause 7 (Docking): applies.
• Clause 9(a) (Subprocessors): Option 2, general written authorization, applies. The notice period is the period stated in Section 7.3 of this DPA.
• Clause 11 (Independent dispute resolution): the optional language does not apply.
• Clause 13 (Supervision): the competent supervisory authority is determined under Clause 13 and the EU GDPR.
• Clause 17 (Governing law): Option 1 applies, and the parties select the law of the Republic of Ireland.
• Clause 18 (Forum): the courts of the Republic of Ireland.
• Annex I.A (Parties): The data exporter is Customer, using Customer’s legal name and principal address in its order form, account, or other written notice to KickoffLabs. Customer’s key contact is the account owner at the registered account email, acting as Customer’s authorized representative; Customer may designate a different privacy contact and position by written notice. Customer acts as Controller for Module Two and Processor for Module Three. The data importer is KickoffLabs LLC, 4111 East Madison Street #19, Seattle, WA 98112, United States. KickoffLabs’ key contact is the Privacy Team at support@kickofflabs.com. KickoffLabs acts as Processor for Module Two and Subprocessor for Module Three. The parties’ activities are described in the Agreement and Annex I of this DPA. Electronic acceptance of the Agreement constitutes signature, dated on the Effective Date.
• Annex I.B (Transfer): the categories of Data Subjects, categories of Personal Data, frequency, nature, purpose, duration, and retention are described in Annex I of this DPA. Transfers to Subprocessors are for the purposes listed on the Subprocessor page. Sensitive or special-category data is prohibited unless the parties sign the written instructions and safeguards described in Annex I.
• Annex I.C (Supervisory authority): If Customer is established in the EEA, the supervisory authority with responsibility for Customer in that EEA country. If Customer is not established in the EEA but has appointed an EU representative under Article 27, the authority where that representative is established. Otherwise, the authority of an EEA country where the relevant Data Subjects are located, as Customer identifies to KickoffLabs. Customer will notify KickoffLabs if more than one authority is competent.
• Annex II: the measures in Annex II of this DPA.
• Annex III: the list referenced in Annex III of this DPA.

If the EU SCCs conflict with this DPA, the EU SCCs control. Terms used but not defined in this Annex have the meanings in the EU SCCs.

Annex V — United Kingdom Addendum

For Restricted Transfers subject to the UK GDPR, the UK Addendum is incorporated by reference and completed as follows:

• Table 1 (Parties and start date): the parties, addresses, key contacts, and signature details are those in Annex IV, Annex I.A above. The start date is the Effective Date.
• Table 2 (Selected SCCs, modules, and clauses): the version of the Approved EU SCCs is the EU SCCs identified in this DPA. Module Two or Module Three applies as described in Annex IV. The selections in Annex IV apply. For the Table 2 question asking whether personal data received from the Importer is combined with personal data collected by the Exporter, the selection is “not applicable” for Modules Two and Three.
• Table 3 (Appendix information): Annex IV, Annex I.A provides Annex 1A party information; Annex I of this DPA provides Annex 1B transfer information; Annex II of this DPA provides the technical and organizational measures; and the Subprocessor page provides Annex III information.
• Table 4 (Ending the Addendum): the Importer and the Exporter may each end the UK Addendum as permitted by Section 19 of its mandatory clauses.
• Mandatory Clauses: Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on February 2, 2022, as revised under Section 18 of those Mandatory Clauses.

Annex VI — Switzerland

For transfers governed by the Swiss FADP, the EU SCCs apply with these adaptations:

• References to the EU GDPR include the Swiss FADP to the extent applicable.
• References to “Member State” are interpreted to include Switzerland so that Data Subjects in Switzerland may exercise their rights in their place of habitual residence where permitted by the Swiss FADP.
• For transfers governed only by the Swiss FADP, the competent supervisory authority in Annex I.C is the Swiss Federal Data Protection and Information Commissioner (FDPIC). For transfers governed by both the Swiss FADP and EU GDPR, the FDPIC is competent for the Swiss portion and the authority identified in Annex IV is competent for the EU GDPR portion.
• The term “Personal Data” includes data protected as personal data under the Swiss FADP.
• For transfers governed only by the Swiss FADP, Clause 17 is governed by Swiss law and disputes under Clause 18 will be resolved by competent Swiss courts. The term “Member State” will not prevent Data Subjects in Switzerland from bringing proceedings in Switzerland at their habitual residence. If a transfer is also governed by the EU GDPR, the Clause 17 and 18 selections in Annex IV remain in effect for EU GDPR claims, and the Swiss adaptations apply to Swiss FADP claims.

Questions about this DPA may be sent to support@kickofflabs.com.