Data processing addendum

Data Processing Addendum

Version: 1.0
Effective date: 13 October 2026
Last updated: 13 October 2026

This Data Processing Addendum (DPA) forms part of the Terms and Conditions, or another written agreement, between Go Sollo Limited, a company registered in New Zealand (company number 9429712, NZBN 9429053685360) (Sollo), and the customer that accepts them (Customer) (together, the Agreement).

This DPA applies when Sollo processes Customer Personal Data on the Customer's behalf. By accepting the Agreement, the Customer accepts this DPA, including the Standard Contractual Clauses where they apply. No signature is needed. If a Customer needs a signed copy for its records, it can ask at support@gosollo.com. Sollo provides this DPA in a standard form for all customers.

1. Definitions

1.1 Words that start with a capital letter and are not defined in this DPA have the meaning given in the Agreement.

1.2 In this DPA:

• Customer Personal Data means any personal data in Customer Data that Sollo processes on behalf of the Customer as a processor under the Agreement.

• Data Protection Laws means all laws about privacy and the processing of personal data that apply to a party's processing of Customer Personal Data under the Agreement. These may include: (a) the EU GDPR (Regulation (EU) 2016/679); (b) the UK GDPR and the Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection (FADP); (d) the New Zealand Privacy Act 2020; (e) the Australian Privacy Act 1988; (f) the Canadian Personal Information Protection and Electronic Documents Act and provincial privacy laws; (g) US State Privacy Laws; and (h) any other law of the same kind that applies.

• EU SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, as changed or replaced from time to time.

• Personal Data Breach means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in Sollo's or its Subprocessors' systems. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data.

• Restricted Transfer means a transfer of Customer Personal Data that is subject to the EU GDPR, the UK GDPR or the FADP to a country that the relevant authority has not recognised as giving adequate protection. This includes an onward transfer.

• Subprocessor means any third party that Sollo engages to process Customer Personal Data. It does not include Third-Party Services that the Customer chooses to connect (see section 7), or Sollo's employees and individual contractors.

• Third-Party Services has the meaning given in the Agreement. It includes LinkedIn, Google, Microsoft and WhatsApp.

• UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0), as changed or replaced from time to time.

• US State Privacy Laws means the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and the comprehensive consumer privacy laws of other US states.

• The terms controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the EU GDPR or UK GDPR. Where other Data Protection Laws use equivalent terms (for example "business", "service provider", "agency", "agent" or "personal information"), the GDPR terms include them.

2. Scope and roles

2.1 Roles. For Customer Personal Data, the Customer is the controller and Sollo is the processor.

2.2 Customer as processor. If the Customer processes Customer Personal Data as a processor for a third-party controller (for example, its own client), Sollo acts as the Customer's subprocessor. In that case:

(a) the Customer confirms that the controller has authorised the Customer's instructions and the appointment of Sollo, including Sollo's Subprocessors;

(b) the Customer is the only point of contact for Sollo, and the Customer passes on any communication to and from the controller; and

(c) Sollo has no direct obligation to the third-party controller.

2.3 Details of the processing. Annex I describes the subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects.

2.4 Sollo as controller. This DPA does not apply to personal data that Sollo processes as a controller. Sollo's Privacy Policy describes that processing. It includes:

(a) data about the Customer's account and its Users, including billing and contact details;

(b) data about how the Services are used, including logs, metadata and diagnostic data;

(c) data that Sollo processes to secure the Services, to prevent fraud and abuse, and to protect connected accounts; and

(d) data that Sollo processes to comply with law.

2.5 Aggregated and de-identified data. Sollo may create aggregated or de-identified data from its processing of Customer Personal Data. It may use that data to operate, secure and improve the Services, and to create statistics. Sollo will not try to re-identify any person from it. Data that does not identify a person is not Customer Personal Data.

2.6 No AI training. Sollo will not use Customer Personal Data to train generalised AI or machine-learning models. Sollo will not allow its Subprocessors to do so.

3. Customer's obligations

3.1 Lawful processing. The Customer is responsible for its compliance with Data Protection Laws. This includes the lawfulness of the Customer's instructions and of the processing of Customer Personal Data. The Customer confirms that it has, and will keep:

(a) a lawful basis for collecting Customer Personal Data and for each processing activity it instructs Sollo to carry out;

(b) all notices and consents that Data Protection Laws require. This includes notices to people whose personal data the Customer gets from a source other than the data subject, such as lead search or enrichment features (for example under GDPR Article 14 or NZ IPP 3A); and

(c) the right to give Sollo access to Customer Personal Data in Third-Party Services that the Customer connects.

3.2 Accuracy and sources. The Customer is responsible for the accuracy and quality of Customer Personal Data, and for the means by which the Customer got it.

3.3 Outreach. The Customer is responsible for every message and connection request it sends through the Services, and for complying with anti-spam and electronic marketing laws and with the terms of each Third-Party Service.

3.4 Prohibited data. The Customer must not upload or instruct Sollo to process:

(a) special categories of personal data (GDPR Article 9) or data about criminal convictions and offences (GDPR Article 10);

(b) government identification numbers, financial account numbers, payment card details or health information; or

(c) personal data of children under 16,

unless Sollo has agreed in writing. Sollo has no obligation under this DPA or the Agreement for such data, other than to delete it when the Customer asks.

3.5 Customer's security. The Customer is responsible for the security measures that it controls, including:

(a) protecting its log-in details;

(b) managing User access and permissions;

(c) the security of its own devices and of its connected Third-Party Service accounts; and

(d) backing up Customer Personal Data that matters to it.

3.6 Records. The Customer is responsible for keeping its own records of processing activities, where Data Protection Laws require them.

4. Sollo's obligations

4.1 Instructions. Sollo will process Customer Personal Data only on the Customer's documented instructions, unless the law that applies to Sollo requires otherwise. If so, Sollo will tell the Customer before it processes the data, unless that law prohibits it.

4.2 Complete instructions. The Customer instructs Sollo to process Customer Personal Data:

(a) to provide the Services under the Agreement;

(b) as initiated by the Customer and its Users through their use of the Services, including through settings, integrations, AI Features and automations; and

(c) as described in this DPA.

These are the Customer's complete instructions at the effective date. Any extra or different instructions need Sollo's prior written agreement. Sollo may charge for them.

4.3 Unlawful instructions. If Sollo becomes aware that an instruction infringes Data Protection Laws, Sollo will tell the Customer. Sollo is not required to carry out a legal review of the Customer's instructions. Sollo may suspend the affected processing until the Customer confirms or changes the instruction.

4.4 Confidentiality. Sollo will make sure that every person it authorises to process Customer Personal Data is bound by a duty of confidentiality.

4.5 Compliance. Sollo will comply with the Data Protection Laws that apply to it as a processor. If Sollo decides that it can no longer meet its obligations under this DPA, it will tell the Customer.

5. Security

5.1 Measures. Sollo will put in place and maintain the technical and organisational measures in Annex II. Their purpose is to protect Customer Personal Data against Personal Data Breaches.

5.2 Updates. Security threats and technology change, so Sollo may update the measures in Annex II from time to time. An update must not materially reduce the overall security of the Services.

5.3 Customer's assessment. The Customer has reviewed the measures in Annex II. It agrees that they are appropriate for the risks of the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.

6. Subprocessors

6.1 General written authorisation. The Customer gives Sollo general written authorisation to engage Subprocessors. The Customer authorises the Subprocessors listed in Annex III at the effective date of this DPA.

6.2 Subprocessor obligations. For each Subprocessor, Sollo will:

(a) carry out reasonable checks of the Subprocessor's security and privacy practices before it gets access to Customer Personal Data;

(b) enter into a written agreement with the Subprocessor that gives Customer Personal Data a level of protection that is no less than the protection in this DPA, to the extent that it applies to the Subprocessor's services; and

(c) remain responsible to the Customer for the Subprocessor's performance of its data protection obligations, as if they were Sollo's own, subject to section 17.

6.3 List and notice of changes. Sollo's current list of Subprocessors is in Annex III of this DPA, published at gosollo.com/legal/data-processing-addendum. At least 14 days before a new Subprocessor starts to process Customer Personal Data, Sollo will update the list and tell the Customer by email to the address on the Customer's Account.

6.4 Objection. The Customer may object to a new Subprocessor, on reasonable grounds related to data protection, by email to support@gosollo.com within the 14-day notice period. The Customer must explain its grounds. If the Customer does not object in time, it is deemed to have accepted the new Subprocessor.

6.5 What happens after an objection. If the Customer objects in time, Sollo will discuss the objection with the Customer in good faith. Sollo may, at its choice:

(a) give information or extra safeguards that address the objection;

(b) offer a way to use the Services without the new Subprocessor processing the Customer's data; or

(c) decide to go ahead with the new Subprocessor.

If Sollo decides to go ahead, the Customer may terminate the affected Services by written notice within 14 days after Sollo tells it of that decision. This termination is the Customer's sole and exclusive remedy. The Customer must pay all Fees due up to the date of termination. No refund or credit is payable.

6.6 Emergency replacement. Sollo may replace a Subprocessor without advance notice if the replacement is urgently needed for security, legal or service-continuity reasons, and the reason is outside Sollo's reasonable control. Sollo will tell the Customer as soon as reasonably possible afterwards, and sections 6.4 and 6.5 then apply.

6.7 Copies of agreements. If the EU SCCs require Sollo to give the Customer a copy of a Subprocessor agreement, Sollo may first remove commercial information and terms that are not related to data protection.

7. Third-Party Services selected by the Customer

7.1 The Services let the Customer connect Third-Party Services, such as LinkedIn, Google (Gmail and Google Contacts), Microsoft and WhatsApp. When the Customer connects a Third-Party Service:

(a) the provider of that Third-Party Service is not a Subprocessor of Sollo;

(b) the Customer has its own agreement with that provider, and that provider's terms and privacy policy apply to the data it holds;

(c) any transfer of Customer Personal Data to or from that Third-Party Service happens on the Customer's instruction; and

(d) Sollo is not responsible for how the provider processes Customer Personal Data, including any data the provider returns to the Services.

7.2 Sollo uses Subprocessors to connect to some Third-Party Services (for example, a LinkedIn connection provider). Those Subprocessors are listed in Annex III, and this DPA applies to them. The Third-Party Service itself is not a Subprocessor.

8. Data subject requests

8.1 Self-service. The Services include features that let the Customer find, access, correct and delete Customer Personal Data. The Customer will use these features first to respond to requests from data subjects.

8.2 Requests received by Sollo. If Sollo receives a request from a data subject about Customer Personal Data, and Sollo can identify that it relates to the Customer, Sollo will:

(a) tell the data subject to send the request to the Customer; and

(b) tell the Customer about the request, unless the law prohibits this.

Sollo will not respond to the request in any other way unless the Customer instructs it to, or the law requires it.

8.3 Assistance. If the Customer cannot respond to a request with the self-service features, Sollo will give reasonable help, by appropriate technical and organisational measures and as far as possible, considering the nature of the processing. The Customer will pay Sollo's reasonable costs for this help, where Data Protection Laws allow Sollo to charge for it.

9. Assistance with compliance

9.1 Considering the nature of the processing and the information available to it, Sollo will give the Customer reasonable help with the Customer's obligations under Data Protection Laws for:

(a) data protection impact assessments;

(b) prior consultations with supervisory authorities; and

(c) security of processing (GDPR Article 32), Personal Data Breach notifications (GDPR Articles 33 and 34), and equivalent duties under other Data Protection Laws.

9.2 Sollo will first give this help by making available the documentation it holds, including this DPA, Annex II, and its Subprocessor list. The Customer will pay Sollo's reasonable costs for further help, at Sollo's then-current rates.

10. Personal Data Breaches

10.1 Notice. If Sollo becomes aware of a Personal Data Breach, it will tell the Customer without undue delay, and where feasible within 72 hours after becoming aware of it. Sollo will send the notice to the email address on the Customer's Account.

10.2 Information. As far as it is available to Sollo, the notice will describe:

(a) the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned;

(b) the likely consequences; and

(c) the measures taken or proposed to address the Personal Data Breach and to reduce its effects.

If Sollo cannot give all the information at once, it may give it in stages without further undue delay.

10.3 Response. Sollo will take reasonable steps to contain and investigate the Personal Data Breach and to reduce its effects, as far as these steps are within Sollo's control.

10.4 No admission. Sollo's notice of, or response to, a Personal Data Breach is not an admission of fault or liability.

10.5 Customer's notifications. The Customer is responsible for any notification to supervisory authorities, data subjects or others that Data Protection Laws require of a controller. Unless the law requires otherwise, the Customer will consult Sollo in good faith before any notification or public statement that names Sollo, and will give Sollo a reasonable opportunity to comment.

11. Audits and information

11.1 Information. Sollo will make available to the Customer the information that is reasonably necessary to show Sollo's compliance with this DPA. Sollo will do this by giving:

(a) this DPA, Annex II and the Subprocessor list;

(b) on request, its written answers to a reasonable security and privacy questionnaire, no more than once in any 12-month period; and

(c) any third-party audit reports or certifications that Sollo holds or that its main Subprocessors make available, subject to confidentiality.

The Customer agrees that this information satisfies its audit rights, except as section 11.2 says.

11.2 Audits. The Customer may carry out an audit, including an inspection, of Sollo's processing of Customer Personal Data only if:

(a) the information in section 11.1 is not enough to show Sollo's compliance with this DPA, and the Customer explains why in writing;

(b) a supervisory authority with jurisdiction over the Customer requires it; or

(c) a Personal Data Breach has happened, and the audit is about that Personal Data Breach.

11.3 Audit conditions. Any audit under section 11.2:

(a) is limited to one in any 12-month period, except under section 11.2(b) or (c);

(b) needs at least 30 days' written notice, with a proposed scope that the parties agree in advance;

(c) takes place during normal business hours in New Zealand, by remote means where possible, and with no unreasonable disruption to Sollo's business;

(d) must be carried out by the Customer or an independent auditor that Sollo reasonably approves. The auditor must not be a competitor of Sollo, and must sign a confidentiality agreement acceptable to Sollo;

(e) does not give access to the data of other customers, to Sollo's trade secrets, to systems that Sollo does not control (including its Subprocessors' systems), or to information that could put the security of the Services at risk;

(f) is at the Customer's cost. The Customer will also pay for the time Sollo's personnel spend on the audit, at Sollo's then-current rates; and

(g) results in a report that the Customer will share with Sollo and treat as Sollo's confidential information.

11.4 Subprocessor audits. For Subprocessors, Sollo may meet its obligations under this section 11 by giving the reports, certifications or other documents that the Subprocessor makes available.

12. International transfers

12.1 Location. Sollo is based in New Zealand. Sollo and its Subprocessors may process Customer Personal Data in New Zealand, in the countries listed in Annex III, and in any other country where Sollo or a Subprocessor operates, subject to this section 12.

12.2 Adequacy. The European Commission, the United Kingdom and Switzerland recognise New Zealand as giving an adequate level of protection. While that recognition stays in force, a transfer of Customer Personal Data from the Customer to Sollo in New Zealand is not a Restricted Transfer.

12.3 EU SCCs. To the extent that the Customer (as data exporter) makes a Restricted Transfer to Sollo (as data importer) that is subject to the EU GDPR, the EU SCCs are incorporated into this DPA by reference, as follows:

(a) Module 2 (controller to processor) applies where the Customer is a controller. Module 3 (processor to processor) applies where the Customer is a processor;

(b) Clause 7 (docking clause) does not apply;

(c) in Clause 9, Option 2 (general written authorisation) applies. The time period for prior notice of changes is the period in section 6.3 of this DPA;

(d) the optional wording in Clause 11 does not apply;

(e) in Clause 13, the competent supervisory authority is the one identified in Annex I.C;

(f) in Clause 17, Option 1 applies, and the EU SCCs are governed by the law of Ireland;

(g) in Clause 18(b), disputes are resolved by the courts of Ireland; and

(h) Annexes I, II and III of this DPA complete Annexes I, II and III of the EU SCCs.

12.4 UK Addendum. To the extent that the Customer makes a Restricted Transfer to Sollo that is subject to the UK GDPR, the EU SCCs apply as in section 12.3, as amended by the UK Addendum, which is incorporated into this DPA by reference. For the UK Addendum:

(a) Table 1: the parties and their details are in Annex I.A;

(b) Table 2: the "Approved EU SCCs" are the EU SCCs as incorporated by section 12.3, with the modules and options chosen there;

(c) Table 3: the "Appendix Information" is in Annexes I, II and III of this DPA; and

(d) Table 4: the Importer may end the UK Addendum as its Section 19 allows.

12.5 Switzerland. To the extent that the Customer makes a Restricted Transfer to Sollo that is subject to the FADP, the EU SCCs apply as in section 12.3, with these changes:

(a) references to the GDPR are to the FADP;

(b) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner;

(c) the term "Member State" does not stop data subjects in Switzerland from bringing claims in their place of habitual residence; and

(d) the EU SCCs also protect the data of legal entities, until the FADP no longer does so.

12.6 If adequacy ends. If an adequacy decision for New Zealand stops applying, the EU SCCs, the UK Addendum or the Swiss changes (as relevant) apply automatically to transfers from the Customer to Sollo from that date. No further action is needed.

12.7 Onward transfers. Before a Subprocessor makes a Restricted Transfer of Customer Personal Data, Sollo will make sure that a valid transfer mechanism is in place. Examples are the EU SCCs (Module 3) with the UK Addendum and Swiss changes, or the Subprocessor's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.

12.8 Alternative mechanisms. If a court or authority invalidates or replaces a transfer mechanism in this section 12, Sollo may adopt a valid alternative by notice to the Customer. The Customer will take any reasonable steps that are needed to make the alternative effective.

12.9 Interpretation of the EU SCCs. As far as the EU SCCs allow:

(a) audits under Clause 8.9 are carried out as described in section 11;

(b) the certification of deletion in Clauses 8.5 and 16(d) is given only on the Customer's written request;

(c) the notice of changes to Subprocessors under Clause 9 is given as described in section 6; and

(d) copies of Subprocessor agreements under Clause 9(c) may be redacted as described in section 6.7.

13. Other regional terms

13.1 United States. To the extent that US State Privacy Laws apply, Sollo is a "service provider" or "processor" for Customer Personal Data. Sollo will not:

(a) sell or share Customer Personal Data (as "sell" and "share" are defined in the CCPA);

(b) keep, use or disclose Customer Personal Data for any purpose other than the business purposes in the Agreement, or outside the direct business relationship between Sollo and the Customer, except as US State Privacy Laws permit; or

(c) combine Customer Personal Data with personal data that Sollo receives from other sources, except as US State Privacy Laws permit.

Sollo will tell the Customer if it can no longer meet its obligations under US State Privacy Laws. The Customer may then take reasonable and appropriate steps to stop and remedy unauthorised use of Customer Personal Data. Sollo certifies that it understands and will comply with the restrictions in this section 13.1.

13.2 New Zealand. For the Privacy Act 2020, Sollo holds Customer Personal Data as the Customer's agent, solely for the purpose of storing or processing it for the Customer (section 11 of that Act). Sollo does not use or disclose Customer Personal Data for its own purposes, except as sections 2.4 and 2.5 of this DPA describe. The Customer remains responsible for the Customer Personal Data under that Act, including for deciding whether a privacy breach is notifiable.

13.3 Australia. The Customer remains responsible for complying with the Australian Privacy Principles for Customer Personal Data, including APP 8 (cross-border disclosure). Sollo will handle Customer Personal Data in a way that is consistent with the Australian Privacy Principles, as far as they apply to the processing.

13.4 Canada. Sollo will give Customer Personal Data a level of protection comparable to the protection the Customer must give under the Canadian Data Protection Laws that apply to it.

13.5 Other countries. If a Data Protection Law not referred to in this DPA requires terms between the parties, the terms of this DPA apply as far as possible to meet that requirement. If more is needed, the parties will negotiate in good faith any additional terms that are reasonably necessary.

14. Return and deletion

14.1 During the Agreement. The Customer can delete Customer Personal Data at any time with the features of the Services. On the Customer's written request, Sollo will give the Customer a copy of its Customer Personal Data in a commonly used, machine-readable format.

14.2 After termination. For 30 days after the Agreement ends, the Customer can ask Sollo for a copy of its Customer Personal Data, as section 14.1 describes. After that 30-day period, Sollo will delete Customer Personal Data within a further 60 days. This deletion satisfies the Customer's choice between return and deletion under Data Protection Laws.

14.3 Exceptions. Sollo may keep Customer Personal Data after this period:

(a) where the law requires Sollo to keep it, for the period the law requires; and

(b) in backups, until they are overwritten in the normal backup cycle.

Sollo will keep this data confidential, protect it under this DPA, and not process it actively for any other purpose.

14.4 Certificate. On the Customer's written request, Sollo will confirm the deletion in writing.

15. Requests from government authorities

15.1 If a government authority, court or law-enforcement agency asks Sollo for access to Customer Personal Data, Sollo will:

(a) try to redirect the request to the Customer;

(b) tell the Customer promptly, unless the law prohibits it; and

(c) disclose only the minimum data needed to comply with a legally binding request, after it has assessed whether the request is lawful.

15.2 Nothing in this section 15 requires Sollo to act in a way that breaks the law that applies to it.

16. Duration

This DPA starts when the Agreement starts. It continues as long as Sollo processes Customer Personal Data, including during the post-termination period in section 14.

17. Liability

17.1 Agreement limits apply. Each party's liability, taken together, arising out of or relating to this DPA (including the EU SCCs and UK Addendum, to the extent they allow) is subject to the exclusions and limitations of liability in the Agreement. Any reference in the Agreement to a party's liability means its aggregate liability under the Agreement and this DPA together. This DPA does not create a separate or additional cap.

17.2 Customer's instructions. Sollo is not liable for any claim, fine or loss that results from:

(a) Sollo acting on the Customer's instructions;

(b) the Customer's breach of section 3; or

(c) the Customer's processing of Customer Personal Data outside the Services, including in Third-Party Services.

17.3 Indemnity. The indemnity in the Agreement (clause 15 of the Terms) covers claims by data subjects, supervisory authorities and other third parties that arise out of the Customer's breach of this DPA or of Data Protection Laws.

17.4 Data subject rights. Nothing in this section 17 limits the rights of data subjects under the EU SCCs or the UK Addendum.

18. General

18.1 Order of priority. If there is a conflict, this order applies: (1) the EU SCCs and the UK Addendum, where they apply; (2) this DPA; and (3) the rest of the Agreement.

18.2 Changes to this DPA. Sollo may update this DPA:

(a) to reflect changes in Data Protection Laws, or new or changed transfer mechanisms;

(b) to reflect changes to the Services or to Sollo's Subprocessors; or

(c) for any other reason, if the update does not materially reduce the protection of Customer Personal Data.

Sollo will publish the updated DPA at gosollo.com/legal/data-processing-addendum and tell the Customer by email or in the app. Clause 18 of the Terms (Changes to these Terms) applies to updates under section 18.2(c).

18.3 Governing law. Except as section 12 says for the EU SCCs, this DPA is governed by the law that governs the Agreement (New Zealand law), and the courts named in the Agreement have jurisdiction.

18.4 Severability. If any part of this DPA is invalid or unenforceable, the rest of this DPA continues to apply. The invalid part will be changed as little as necessary to make it valid while keeping the parties' intention.

18.5 Notices. Sollo sends notices under this DPA to the email address on the Customer's Account. The Customer sends notices to support@gosollo.com.

Annex I: Description of the processing

A. List of parties

Data exporter (controller, or processor under section 2.2)

• Name: the Customer, as identified in its Sollo Account

• Address and contact: as given in the Customer's Account

• Activities relevant to the transfer: use of the Services under the Agreement

• Role: controller (Module 2) or processor (Module 3)

• Signature and date: by acceptance of the Agreement, on the date of acceptance

Data importer (processor)

• Name: Go Sollo Limited (company number 9429712, NZBN 9429053685360)

• Address: Auckland, New Zealand

• Contact: Privacy Officer, support@gosollo.com

• Activities relevant to the transfer: provision of the Services under the Agreement

• Role: processor

• Signature and date: by acceptance of the Agreement, on the date of acceptance

B. Description of the processing and transfer

Categories of data subjects. As the Customer decides, these can include the Customer's:

• prospects, leads and potential clients;

• clients and former clients;

• business contacts, referral partners and LinkedIn and WhatsApp connections;

• the employees and representatives of these people's organisations;

• other people who appear in the Customer's emails, messages, notes or imported files; and

• Users of the Customer's Account, to the extent they appear in Customer Data.

Categories of personal data. As the Customer decides, these can include:

• Identity and contact data: name, work and personal email address, phone number, LinkedIn profile URL, WhatsApp identifier, location (city, region and country).

• Professional data: job title, headline, employer, company name, domain, industry and size, work history, profile summary, profile picture.

• Communications: content and metadata of LinkedIn and WhatsApp messages and connection requests; Gmail message content and metadata (read when displayed, not stored); emails that the Customer sends through the Services.

• Relationship and sales data: notes, tasks, deals, pipeline stages, tags, contact history, last-contact dates.

• Enrichment data: professional email addresses, phone numbers, profile and company information that third-party data providers return on the Customer's request.

• Social content: LinkedIn posts, comments and reactions retrieved on the Customer's request.

• AI-generated data: prospect fit scores, summaries, research, suggestions and drafts about data subjects, and AI conversation content.

• Technical data: data captured in error reports or session recordings that show Customer Data on screen.

Special categories of data. None. The Customer must not submit special categories of data (section 3.4).

Frequency of the transfer. Continuous, for as long as the Customer uses the Services.

Nature of the processing. Collection (including through connected Third-Party Services and enrichment), recording, organisation, storage, retrieval, analysis (including with AI models), consultation, sending of messages and emails on the Customer's instruction, synchronisation, export, and deletion.

Purposes of the processing. To provide the Services to the Customer under the Agreement. This includes contact and pipeline management, lead search and enrichment, LinkedIn, WhatsApp and Gmail integration, AI Features, support, security and the prevention of abuse.

Retention. For the term of the Agreement, then as section 14 describes.

Transfers to Subprocessors. For the subject matter, nature and duration described in Annex III.

C. Competent supervisory authority

• EU GDPR: the supervisory authority determined under Clause 13 of the EU SCCs. This is normally the authority of the EU Member State where the Customer is established. If the Customer is not established in the EU, it is the authority of the Member State where the Customer's Article 27 representative is established, or, if there is none, of the Member State where the data subjects are located.

• UK GDPR: the UK Information Commissioner's Office.

• FADP: the Swiss Federal Data Protection and Information Commissioner.

Annex II: Technical and organisational security measures

1. Encryption

• Data in transit is encrypted with TLS 1.2 or higher between users, Sollo and its Subprocessors.

• Data at rest in the main database and storage is encrypted with AES-256 by the hosting provider.

2. Access control and customer data separation

• Database row-level security separates each customer's data, so a user can access only their own records.

• Backend code that reads user-owned tables must filter by user. An automated check in the build pipeline enforces this.

• Production access is limited to the staff and contractors who need it for their role.

• LinkedIn sign-in passwords pass through to the connection provider when the user connects. Sollo does not store them.

• Payment card details are collected by the payment processor. Sollo does not store them.

3. Secure development

• Source code is kept in a private repository.

• Changes are reviewed and automatically tested before they are deployed.

• Development and testing use separate environments and databases from production.

• Secrets and API keys are kept in environment configuration, not in source code.

4. Monitoring

• Application errors and performance are monitored with an error-monitoring service.

5. Availability

• The Services run on managed cloud infrastructure with high availability.

6. Personnel

• Everyone with access to Customer Personal Data is bound by confidentiality obligations.

7. Subprocessor management

• Subprocessors are bound by written data protection terms (section 6).

• AI model providers are engaged on terms that do not allow training on Customer Personal Data.

8. Data minimisation

• AI Features send to model providers only the data needed for the request.

• Gmail content is read when displayed and is not stored.

• Temporary processing records are deleted on a schedule (for example, background job records after 7 days and search records after 90 days).

9. Assessments

• Sollo relies on the independent audit reports (for example SOC 2 Type II) of its main hosting Subprocessors.

Annex III: Subprocessors

Subprocessors may store or process data in other regions, under the transfer terms in section 12.

Customer-connected Third-Party Services (not Subprocessors, see section 7): LinkedIn, Google (Gmail and Google Contacts), WhatsApp (Meta), and any other platform the Customer connects.