Data Processing Agreement

Effective Date: 1 April 2026 Last Updated: 1 April 2026

This Data Processing Agreement ("DPA") forms part of the agreement between the Customer and GTMSAI Ltd (trading as Pebbles Ai) for the provision of the Pebbles Ai platform and related services (the "Service Agreement"). It sets out the terms under which Pebbles Ai processes personal data on behalf of the Customer.

This DPA is incorporated into and subject to the terms of the Service Agreement, including the Terms of Service.

1. Definitions

In this DPA, unless stated otherwise, the following terms have the meanings set out below. Terms not defined here have the meaning given to them in the Service Agreement or applicable Data Protection Laws.

2. Scope and Purpose

2.1 Scope

This DPA applies to all Personal Data that the Processor processes on behalf of the Controller in connection with the provision of the Service. It governs the relationship between the Controller and the Processor with respect to data protection obligations.

2.2 Purpose of Processing

The Processor processes Personal Data solely to provide the Service as described in the Service Agreement. This includes:

• Storing and managing contact lists uploaded by the Controller
• Generating personalised outreach content based on Controller-provided data
• Executing email and messaging campaigns on behalf of the Controller
• Providing AI-powered research and intelligence features using Controller-provided inputs
• Managing campaign analytics and performance reporting

2.3 Categories of Data Subjects

Data Subjects may include:

• The Controller's business contacts and prospects
• Recipients of the Controller's outreach campaigns
• Other individuals whose Personal Data is uploaded or processed through the Service by the Controller

2.4 Types of Personal Data

Personal Data processed may include:

• Contact information (names, email addresses, telephone numbers, job titles, company names)
• Professional information (LinkedIn profile data, business roles, industry information)
• Communication content (email content, message drafts, campaign copy)
• Engagement data (email open/click tracking, campaign response data)
• Any other Personal Data that the Controller uploads to or processes through the Service

2.5 Duration of Processing

Processing shall continue for the duration of the Service Agreement and for a period of 30 days following its termination, in accordance with Section 9 of this DPA and the Data Retention and Deletion Policy.

3. Obligations of the Processor

3.1 Processing on Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by applicable law. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

The Service Agreement, including this DPA, constitutes the Controller's initial documented instructions to the Processor. The Controller may issue additional written instructions consistent with the terms of this DPA.

3.2 Confidentiality

The Processor shall ensure that all persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation shall survive the termination of their engagement with the Processor.

3.3 Security Measures

The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risk to the rights and freedoms of Data Subjects.

These measures include, but are not limited to:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls and authentication mechanisms, including multi-factor authentication for administrative access
• Regular testing and assessment of the effectiveness of security measures
• Network segmentation and firewall protections
• Logging and monitoring of access to systems containing Personal Data
• Incident detection and response capabilities

The Processor's security measures are described in further detail in the Information Security Policy.

3.4 Sub-processing

The Processor shall not engage any Sub-processor without the prior written consent of the Controller. The Controller grants general authorisation for the Processor to engage the Sub-processors listed in the Subprocessor List as at the Effective Date.

Where the Processor engages a Sub-processor:

• The Processor shall impose on the Sub-processor, by way of a written contract, data protection obligations that are substantially equivalent to those set out in this DPA
• The Processor shall remain fully liable to the Controller for the performance of the Sub-processor's obligations
• The Processor shall carry out appropriate due diligence on each Sub-processor to ensure it can provide the level of protection required by this DPA and applicable Data Protection Laws

Changes to the list of Sub-processors are governed by Section 5 of this DPA.

3.5 Data Subject Rights

The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object

The Processor shall promptly notify the Controller if it receives a request directly from a Data Subject. The Processor shall not respond to a Data Subject request directly unless authorised by the Controller or required by applicable law.

3.6 Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller with any DPIA and any prior consultation with a supervisory authority, where required under Data Protection Laws, taking into account the nature of the processing and the information available to the Processor.

3.7 Deletion and Return of Data

Upon termination or expiry of the Service Agreement, the Processor shall, at the Controller's election:

• Return all Personal Data to the Controller in a commonly used, machine-readable format; or
• Delete all Personal Data and existing copies, unless applicable law requires continued storage

Deletion shall occur within 30 days of the effective date of termination, in accordance with the Data Retention and Deletion Policy. Personal Data contained in backups shall be purged within 90 days. The Processor shall provide written confirmation of deletion upon the Controller's request.

3.8 Audit and Information

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and applicable Data Protection Laws.

The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller, subject to the terms set out in Section 8 of this DPA.

4. Obligations of the Controller

The Controller warrants and represents that:

• It has a lawful basis for the processing of Personal Data and for instructing the Processor to process such data as contemplated by this DPA
• It has provided all necessary notices to, and obtained all necessary consents or authorisations from, Data Subjects as required by applicable Data Protection Laws
• It shall ensure that its instructions to the Processor comply with applicable Data Protection Laws
• It is responsible for the accuracy, quality, and legality of the Personal Data it provides to the Processor
• It shall inform the Processor without undue delay of any changes to applicable Data Protection Laws that may affect the Processor's obligations under this DPA

5. Sub-processing

5.1 Current Sub-processors

The current list of Sub-processors engaged by the Processor is maintained at Subprocessor List. The Controller acknowledges and approves the Sub-processors listed as at the Effective Date of this DPA.

5.2 Notification of Changes

The Processor shall notify the Controller in writing at least 30 days in advance of any intended addition or replacement of a Sub-processor. The notification shall include the identity of the proposed Sub-processor, the nature of the processing to be carried out, and the location of processing.

5.3 Objection Mechanism

The Controller may object to a new or replacement Sub-processor by notifying the Processor in writing within 30 days of receiving the notification described in Section 5.2. The objection must set out reasonable grounds relating to data protection.

If the Controller objects:

• The Processor shall use reasonable efforts to make available an alternative solution that avoids the use of the objected-to Sub-processor
• If no alternative is reasonably available within 30 days of the Controller's objection, either party may terminate the affected portion of the Service by providing written notice, and the Processor shall refund any prepaid fees for the terminated portion of the Service covering the period after termination

6. International Data Transfers

6.1 Primary Processing Location

The Processor's primary infrastructure is located in the European Economic Area (Belgium, europe-west1 region of Google Cloud Platform). Personal Data is processed and stored within the EEA unless otherwise specified.

6.2 Transfers Outside the EEA and UK

Where the processing of Personal Data involves a transfer to a country outside the EEA or the United Kingdom that has not been deemed adequate by the European Commission or the UK Secretary of State, the Processor shall ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs): The parties shall enter into the SCCs adopted by Commission Implementing Decision (EU) 2021/914, with the Processor as the data importer and the Controller as the data exporter. The SCCs are incorporated into this DPA by reference.
• UK International Data Transfer Agreement (UK IDTA): For transfers from the United Kingdom, the UK IDTA (or the UK Addendum to the EU SCCs, as applicable) shall apply and is incorporated into this DPA by reference.
• Transfer Impact Assessments: The Processor shall carry out and document a Transfer Impact Assessment for each transfer to a third country, evaluating the laws and practices of the destination country, any supplementary measures in place, and the effectiveness of those measures in ensuring an essentially equivalent level of protection.

6.3 Sub-processor Transfers

Where a Sub-processor processes Personal Data outside the EEA or UK, the Processor shall ensure that the Sub-processor is bound by appropriate transfer safeguards equivalent to those described in this Section 6.

The applicable Standard Contractual Clauses (Module 2: Controller to Processor) and UK IDTA Addendum are set out in the SCC Annexes, which form part of this DPA.

7. Data Breach Notification

7.1 Notification to the Controller

The Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed on behalf of the Controller (a "Personal Data Breach").

7.2 Content of Notification

The notification shall include, to the extent available:

• A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records affected
• The name and contact details of the Processor's Data Protection Officer or other point of contact
• A description of the likely consequences of the Personal Data Breach
• A description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects

7.3 Ongoing Obligations

The Processor shall:

• Cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Personal Data Breach
• Provide the Controller with updates as further information becomes available
• Not inform any third party of a Personal Data Breach without first obtaining the Controller's written consent, unless required to do so by applicable law

The Processor's data breach procedures are described in further detail in the Incident Response Policy.

8. Audit Rights

8.1 Right to Audit

The Controller shall have the right to audit the Processor's compliance with this DPA once per calendar year. Audits may be conducted by the Controller or by an independent third-party auditor appointed by the Controller, provided that such auditor is bound by appropriate confidentiality obligations and is not a competitor of the Processor.

8.2 Audit Process

Audits shall be conducted subject to the following conditions:

• The Controller shall provide the Processor with at least 30 days' prior written notice of an intended audit
• Audits shall be conducted during normal business hours and shall not unreasonably interfere with the Processor's operations
• The Controller shall bear the costs of the audit, unless the audit reveals a material breach of this DPA by the Processor, in which case the Processor shall bear the reasonable costs of the audit
• The scope of the audit shall be limited to the Processor's processing activities under this DPA

8.3 Audit Alternatives

The Processor may satisfy the Controller's audit request by:

• Providing a copy of a relevant third-party audit report, certification, or assessment (such as SOC 2, ISO 27001, or CASA Tier 2 assessment results) that covers the Processor's processing activities under this DPA; or
• Providing written responses to the Controller's reasonable audit questions

The Controller retains the right to conduct an on-site audit if the alternatives described above do not reasonably address the Controller's concerns.

9. Duration and Termination

9.1 Duration

This DPA shall come into effect on the Effective Date and shall remain in force for the duration of the Service Agreement.

9.2 Survival

The provisions of this DPA that by their nature should survive termination shall survive, including but not limited to Sections 3.2 (Confidentiality), 3.7 (Deletion and Return of Data), 7 (Data Breach Notification), 8 (Audit Rights), and 10 (Liability).

9.3 Effect of Termination

Upon termination of the Service Agreement, the Processor shall cease processing Personal Data and shall comply with its obligations under Section 3.7 regarding the deletion or return of Personal Data.

10. Liability

10.1 Limitation

Each party's liability under this DPA shall be subject to the limitations and exclusions of liability set out in the Service Agreement.

10.2 Indemnification

The Processor shall indemnify the Controller against all costs, claims, damages, and expenses incurred by the Controller arising from a breach of this DPA by the Processor or its Sub-processors, except to the extent that such costs, claims, damages, or expenses arise from the Controller's own breach of this DPA, the Service Agreement, or applicable Data Protection Laws.

11. Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws of England and Wales. Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

12. General Provisions

12.1 Precedence

In the event of any conflict between this DPA and the Service Agreement, this DPA shall prevail with respect to data protection matters.

12.2 Amendments

This DPA may only be amended in writing, signed by both parties.

12.3 Severability

If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

12.4 Entire Agreement

This DPA, together with the Service Agreement and any documents incorporated by reference (including the SCCs and UK IDTA), constitutes the entire agreement between the parties with respect to the processing of Personal Data.

13. Contact

For questions or requests relating to this DPA, please contact:

GTMSAI Ltd (trading as Pebbles Ai) 82 Wandsworth Bridge Road, London, United Kingdom, SW6 2TF

Data Protection Officer: data@trypebbles.ai