Data Processing Agreement

1. Introduction and Structure

This Data Processing Agreement ("DPA") is entered into by and between TellUS, a California corporation ("TellUS"), and the Customer identified in the Agreement ("Customer"), and forms part of and is incorporated into the salesHum Terms of Service and Software Subscription Agreement between the parties (the "Agreement"). This DPA governs TellUS’s Processing of Personal Information on Customer’s behalf in connection with the Services.

In the event of a conflict between this DPA and the Agreement or the Privacy Policy with respect to the Processing of Personal Information on Customer’s behalf, this DPA controls. In all other respects, the Agreement remains in full force and effect. Capitalized terms not defined in this DPA have the meanings given in the Agreement.

2. Definitions

• 2.1 "Applicable Data Protection Law" means all privacy and data-protection laws applicable to a party’s Processing of Personal Information under this DPA, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other U.S. state privacy laws.
• 2.2 "Controller" (or "Business" under the CCPA) means the entity that determines the purposes and means of the Processing of Personal Information.
• 2.3 "Processor" (or "Service Provider" or "Contractor" under the CCPA) means the entity that Processes Personal Information on behalf of, and at the direction of, the Controller.
• 2.4 "Customer Personal Data" means Personal Information within Customer Data that TellUS Processes on Customer’s behalf under the Agreement, including Personal Information contained in Audio Recordings, Transcripts, and AI Output generated from Customer’s conversations, and Authorized-User information Processed for Customer.
• 2.5 "Personal Information" (or "Personal Data") means information that identifies, relates to, or could reasonably be linked to an identified or identifiable individual or household, as defined under Applicable Data Protection Law.
• 2.6 "Processing" means any operation performed on Personal Information, including collection, recording, storage, use, transcription, analysis, disclosure, transmission, deletion, or destruction.
• 2.7 "Data Subject" (or "Consumer") means the individual to whom Personal Information relates.
• 2.8 "Sub-processor" means a third party engaged by TellUS to Process Customer Personal Data in connection with the Services.
• 2.9 "Security Incident" means a confirmed breach of TellUS’s security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data Processed by TellUS. Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data.
• 2.10 "Sell," "Share," "Business Purpose," "Commercial Purpose," and "Deidentified" have the meanings given under the CCPA.

3. Roles of the Parties

The parties acknowledge that, with respect to the Processing of Customer Personal Data, Customer is the Controller (Business) and TellUS is the Processor (Service Provider/Contractor), Processing Customer Personal Data on Customer’s documented instructions to provide the Services. Where Customer is itself a processor acting on behalf of a third-party controller, Customer is responsible for ensuring it has authority to engage TellUS as a Sub-processor.

With respect to Personal Information that TellUS Processes for its own purposes — including account, billing, usage, security, and Deidentified data — TellUS acts as a Controller (Business), and that Processing is governed by the Privacy Policy rather than this DPA.

4. Scope and Instructions for Processing

TellUS shall Process Customer Personal Data only: (a) to provide, maintain, secure, support, and operate the Services in accordance with the Agreement; (b) in accordance with Customer’s documented instructions, including the instructions set out in this DPA and the configuration choices Customer makes within the Services; and (c) as required by applicable law, in which case TellUS will, where legally permitted, inform Customer of that legal requirement before Processing.

The subject matter, duration, nature and purpose of the Processing, the categories of Personal Information, and the categories of Data Subjects are described in Annex 1. Customer’s use and configuration of the Services, together with the Agreement and this DPA, constitute Customer’s complete and final documented instructions. If TellUS believes an instruction violates Applicable Data Protection Law, it will inform Customer (unless prohibited by law).

5. TellUS Obligations as Processor / Service Provider

TellUS shall:

• Process Customer Personal Data only for the Business Purposes specified in the Agreement and this DPA, and not retain, use, or disclose it for any other purpose, including any Commercial Purpose, except as permitted by Applicable Data Protection Law;
• not Sell or Share Customer Personal Data;
• not retain, use, or disclose Customer Personal Data outside the direct business relationship between the parties, except as permitted by Applicable Data Protection Law;
• not combine Customer Personal Data with Personal Information received from, or on behalf of, third parties, or collected from TellUS’s own interactions with Data Subjects, except as permitted by the CCPA for a service provider;
• ensure that personnel authorized to Process Customer Personal Data are subject to obligations of confidentiality and Process it only as necessary to perform their duties;
• implement and maintain the technical and organizational security measures described in Annex 2;
• comply with its obligations as a Service Provider/Contractor under the CCPA and provide the same level of privacy protection as required of a Business; and
• notify Customer if TellUS determines it can no longer meet its obligations under Applicable Data Protection Law.

TellUS hereby certifies that it understands the restrictions in this Section 5 and will comply with them. Customer may, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.

6. Sub-processors

Customer provides general authorization for TellUS to engage Sub-processors to Process Customer Personal Data, subject to this Section. A current list of Sub-processors is set out in Annex 3 (and mirrored in Appendix B of the Privacy Policy).

TellUS shall: (a) enter into a written agreement with each Sub-processor imposing data-protection obligations no less protective than those in this DPA, to the extent applicable to the services the Sub-processor performs; and (b) remain responsible for each Sub-processor’s performance of the obligations TellUS delegates to it.

TellUS may engage new or replacement Sub-processors as needed to provide the Services and will update Annex 3 / Appendix B before a new Sub-processor begins Processing Customer Personal Data. If Customer reasonably objects to a Sub-processor on data-protection grounds, Customer may notify TellUS and the parties will work in good faith to resolve the objection; if they cannot, Customer may, as its sole remedy, terminate the affected portion of the Services.

7. Assistance with Data Subject Requests

Taking into account the nature of the Processing, TellUS shall provide reasonable assistance to enable Customer to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law (such as access, correction, deletion, and portability). If TellUS receives such a request directly relating to Customer Personal Data, it will, unless legally prohibited, advise the Data Subject to submit the request to Customer and/or forward the request to Customer, and will not respond except on Customer’s documented instructions or as required by law.

8. Security Incidents

TellUS shall maintain the security measures in Annex 2 and shall notify Customer of a Security Incident affecting Customer Personal Data without undue delay after TellUS confirms the Security Incident, and within any timeframe required by Applicable Data Protection Law. The notice will describe, to the extent then known and as it becomes available, the nature of the incident, the categories of data and Data Subjects affected, the likely consequences, and the measures taken or proposed. TellUS shall take reasonable steps to mitigate and remediate the Security Incident. Notification of or response to a Security Incident is not an acknowledgment by TellUS of fault or liability.

9. Security Measures

TellUS shall implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against a Security Incident, as described in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing. TellUS may update its security measures provided the updates do not materially reduce the overall level of protection.

10. Audits and Demonstrating Compliance

TellUS shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA. Upon reasonable prior written notice, no more than once per twelve (12) months (unless required by a supervisory authority or following a Security Incident), and subject to confidentiality obligations, TellUS will respond to a reasonable written audit/security questionnaire and, where available, provide summaries of relevant third-party assessments in lieu of an on-site audit. Any audit shall be conducted during business hours, without unreasonably interfering with TellUS’s operations, and shall not require access to other customers’ data or to TellUS’s confidential or security-sensitive infrastructure beyond what is necessary.

11. International Transfers

TellUS Processes Customer Personal Data primarily in the United States. Customer authorizes TellUS and its Sub-processors to Process Customer Personal Data in the United States and in any other location where TellUS or its Sub-processors operate, subject to this DPA. Where Applicable Data Protection Law requires a specific transfer mechanism (for example, for transfers originating in the EEA, UK, or Switzerland), the parties will implement the required mechanism, which is incorporated by reference upon execution.

12. Return and Deletion of Customer Personal Data

Upon termination or expiration of the Agreement, TellUS shall, at Customer’s election and to the extent the Services support it, make Customer Personal Data available for export for a limited period, and shall thereafter delete Customer Personal Data in accordance with the data lifecycle described in the Agreement (Exhibit A) and the Privacy Policy, except to the extent retention is required by law or for the establishment, exercise, or defense of legal claims. Deletion from backups and disaster-recovery systems occurs in the ordinary course as those systems cycle. TellUS may retain and continue to use Deidentified and Aggregated Data as described in Section 13.

13. Deidentified and Aggregated Data

Customer authorizes TellUS to create Deidentified and Aggregated Data from Customer Personal Data and to use such data for the purposes described in the Privacy Policy and the Agreement, including improving and developing the Services, analytics, and benchmarking. TellUS, as Controller of such Deidentified and Aggregated Data, shall: (a) take reasonable measures to ensure the data cannot be associated with an individual or household; (b) maintain and use the data only in deidentified or aggregated form; (c) not attempt to reidentify the data except as reasonably necessary to test the effectiveness of its deidentification; and (d) contractually obligate any recipient of the data to comply with the same restrictions. This Section survives termination.

14. Liability

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any reference to a party’s liability means the aggregate liability of that party under the Agreement and this DPA combined.

15. Term, Conflict, and Governing Law

This DPA takes effect on the effective date of the Agreement and continues for as long as TellUS Processes Customer Personal Data. This DPA is governed by the same governing law and dispute-resolution provisions as the Agreement, except where Applicable Data Protection Law requires otherwise. If any provision of this DPA is invalid or unenforceable, the remainder continues in effect.

Annex 1 — Details of Processing

Annex 2 — Technical and Organizational Security Measures

TellUS maintains the following measures, which it may update provided the overall level of protection is not materially reduced:

• Access control and least privilege — role-based access control (owner/manager/representative roles) and restriction of access to Customer Personal Data to authorized personnel and processes on a need-to-know basis.
• Tenant isolation — database-enforced row-level security so that each organization’s data is logically segregated and accessible only within that organization’s authorized context.
• Encryption — encryption of Customer Personal Data in transit (TLS) and at rest through TellUS’s infrastructure providers.
• Authentication and session security — managed authentication; secure, HTTP-only session cookies on the web; encrypted secure storage of session credentials on mobile devices.
• Secrets management — server-side-only handling of secrets and service credentials; no exposure of server secrets to client applications.
• Audit logging — append-only audit logging of state-changing actions, recording the action, actor, and organization, without storing unnecessary Personal Information in log payloads.
• Abuse prevention — rate limiting and edge protections (including a web application firewall and security headers) to mitigate automated abuse and common web attacks.
• Secure development and vulnerability management — code review and automated security, dependency, and secret-scanning gates in the development pipeline prior to release.
• Backups and resilience — managed backup and disaster-recovery processes provided by TellUS’s infrastructure providers.
• Vendor management — engagement of Sub-processors under written agreements with appropriate data-protection and confidentiality obligations.

Annex 3 — Authorized Sub-processors

The following Sub-processors are authorized to Process Customer Personal Data to provide the Services: