Data Processing Addendum

Last updated: July 22, 2026

1. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the agreement between the customer (“Customer”) and CS2 Technologies Inc., a company incorporated in Canada, Business Number 707258406RC001, which operates the agentlyleads CRM (“Processor”). For personal data stored in the Customer’s workspace, the Customer is the data controller and CS2 Technologies Inc. is the data processor. CS2 Technologies Inc. acts as a controller only for the Customer’s own account, billing, and usage data (see the Privacy Policy).

2. Subject matter of processing

• Categories of data subjects: the Customer’s contacts, leads, and business counterparts; the Customer’s own users.
• Categories of personal data: names, job titles, employers, email addresses, phone numbers, postal addresses, social profiles, communication content and metadata, and any custom fields the Customer defines.
• Purpose and duration: providing the CRM service for the term of the agreement.

3. Processor obligations

The Processor will:

• process personal data only on the Customer’s documented instructions (including as given through the product);
• ensure personnel with access are bound by confidentiality;
• implement appropriate technical and organizational measures (encryption in transit and at rest, tenant isolation by workspace, hashed credentials, access controls, and logging);
• assist the Customer with data-subject requests, security, and breach notification obligations;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data;
• make available information reasonably necessary to demonstrate compliance.

4. Data subject requests

The product provides self-service tooling: contact records can be corrected or deleted individually (deletion cascades their communications, briefs, and attachments), the workspace can be exported in full, and the whole workspace can be erased. Where a request cannot be fulfilled with those tools, the Processor will assist within a reasonable time.

5. Retention nuances disclosed

• Suppression tombstones: when a workspace is deleted, suppressed (unsubscribed/bounced/complained) email addresses are retained only as irreversible SHA-256 hashes with the suppression reason, for up to 2 years, to prevent re-mailing people who opted out. No other workspace data survives deletion.
• Email metadata: deleting a contact removes their record and its associated content, but email messages sent to that person retain the destination address in message metadata — a legitimate-interest retention required for deliverability history and honoring suppression.

6. Subprocessors

The Customer authorizes the subprocessors listed at /subprocessors. agentlyleads will update that page before adding a subprocessor; the Customer may object on reasonable data-protection grounds, in which case the parties will seek a workable alternative or the Customer may terminate the affected service.

7. International transfers

Processing occurs in AWS us-east-1 (United States). Where personal data is transferred from the EEA, UK, or Switzerland, the parties rely on the EU Standard Contractual Clauses (module 2, controller-to-processor), which are incorporated by reference, together with the UK Addendum where applicable.

8. Deletion and return of data

The Customer can export all workspace data at any time (Settings → Data export). Upon workspace deletion — after the 7-day grace window — all Customer Data, including stored files, is permanently erased, except the hashed suppression tombstones described in Section 5. Backups expire on their normal rotation schedule.

9. Liability and order of precedence

This DPA is subject to the limitations of liability in the Terms of Service. If this DPA conflicts with the Terms, this DPA controls with respect to processing of personal data. Contact: privacy@agentlyleads.com.