Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller — the company or organisation ("Client") that engages LeadOne Marketing OÜ for the Review Machine service.
• Data Processor — LeadOne Marketing OÜ, registered in Estonia (EU), email: info@leadone.online ("LeadOne").

2. Background and purpose

LeadOne provides the Review Machine service, which involves LeadOne sending SMS review requests to the Client's existing customers on the Client's behalf. This DPA governs that processing in accordance with GDPR Article 28.

3. Nature and purpose of processing

4. LeadOne's obligations

• Process personal data solely according to documented instructions from the Client.
• Ensure that persons authorised to process the data have committed to confidentiality.
• Implement appropriate technical and organisational security measures per GDPR Article 32.
• Not engage additional sub-processors without informing the Client in advance.
• Assist the Client in fulfilling obligations regarding data subject rights.
• Delete or return all personal data after contract termination.
• Notify the Client without undue delay of any personal data breach.

5. Sub-processors

6. Entering into the agreement

This DPA takes effect when the Client enters into a service agreement with LeadOne Marketing OÜ for the Review Machine. It can also be entered into separately via written confirmation to info@leadone.online.