Data Processing Addendum

1. Purpose and Scope

1.1 Purpose

This DPA sets out the parties’ rights and obligations with respect to the processing of Customer Personal Data by Loop on behalf of Customer.

1.2 Scope

This DPA applies solely to the extent that Loop processes Customer Personal Data for Customer as a processor, service provider, or contractor under applicable data protection law.

1.3 Order of precedence

If there is any conflict between this DPA and the Agreement, this DPA will control solely with respect to the parties’ data protection obligations relating to Customer Personal Data. In all other respects, the Agreement will control.

1.4 Effective relationship

This DPA is effective as of March 1, 2026, or the effective date of the Agreement between the parties, whichever is later, and remains in effect for so long as Loop processes Customer Personal Data on Customer’s behalf.

2. Definitions

For purposes of this DPA:

• “Applicable Data Protection Law” means all laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR, UK GDPR, Swiss data protection laws, CCPA, CPRA, and other applicable privacy or data protection laws.
• “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, and any implementing regulations.
• “Controller” means the entity that determines the purposes and means of processing personal data, or any analogous term such as “business” under Applicable Data Protection Law.
• “Customer Personal Data” means any personal data or personal information contained within Customer Data that Loop processes on behalf of Customer in connection with the Services.
• “Data Subject” means an identified or identifiable natural person to whom Customer Personal Data relates.
• “EEA” means the European Economic Area.
• “GDPR” means Regulation (EU) 2016/679.
• “Personal Data Breach” means a breach of security leading to the accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure of, or access to Customer Personal Data transmitted, stored, or otherwise processed by Loop, excluding unsuccessful attempts or events that do not compromise Customer Personal Data.
• “Process” or “Processing” means any operation or set of operations performed on Customer Personal Data, whether or not by automated means, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transmission, combination, restriction, erasure, or destruction.
• “Processor” means the entity that processes personal data on behalf of a controller, or any analogous term such as “service provider” or “contractor.”
• “Restricted Transfer” means any transfer of Customer Personal Data subject to Applicable Data Protection Law to a country or recipient for which a lawful transfer mechanism is required.
• “Subprocessor” means any third party engaged by Loop to process Customer Personal Data on behalf of Customer.
• “UK GDPR” means the GDPR as incorporated into the laws of the United Kingdom.

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

3. Roles of the Parties

3.1 Customer as Controller

Customer is the Controller or Business of Customer Personal Data processed under this DPA, except where Applicable Data Protection Law provides otherwise.

3.2 Loop as Processor

Loop acts as a Processor, Service Provider, or Contractor, as applicable, with respect to Customer Personal Data processed on behalf of Customer under the Agreement.

3.3 Customer instructions

Customer appoints Loop to process Customer Personal Data solely for the limited and specific purposes described in the Agreement, this DPA, and Customer’s documented lawful instructions consistent with the Services.

3.4 Customer responsibility for legality

Customer is solely responsible for:

• determining whether its processing and use of the Services is lawful;
• establishing and documenting any required lawful basis for processing;
• obtaining all necessary consents, permissions, notices, and authorizations;
• ensuring the legality of calls, SMS, recording, transcripts, voicemail, and AI-assisted communications;
• providing only lawful instructions to Loop.

3.5 No independent determination by Loop

Except as expressly permitted by the Agreement, this DPA, or Applicable Data Protection Law, Loop will not determine the purposes and means of processing Customer Personal Data on Customer’s behalf.

4. Customer Instructions and Scope of Processing

4.1 Documented instructions

Loop will process Customer Personal Data only:

• on Customer’s documented instructions;
• as necessary to provide the Services under the Agreement;
• as required to comply with applicable law;
• as otherwise permitted by this DPA.

The Agreement, the Documentation, Customer’s in-product configuration choices, API calls, support requests, integration settings, and other written or electronic communications from Customer constitute Customer’s documented instructions for purposes of this DPA.

4.2 Lawful instruction limitation

Loop is not required to follow any instruction that Loop reasonably believes is unlawful, technically infeasible, inconsistent with the Agreement, or likely to create legal, security, provider, carrier, or operational risk. In such cases, Loop may decline the instruction and, where appropriate, notify Customer.

4.3 Scope of processing

Loop may process Customer Personal Data as necessary to provide communications, voice workflows, recordings, transcripts, SMS follow-up, analytics, integrations, support, security monitoring, troubleshooting, abuse prevention, and related functionality described in the Agreement and Documentation.

4.4 Processing required by law

If Loop is required by applicable law to process Customer Personal Data other than on Customer’s instructions, Loop will inform Customer of that legal requirement before processing unless the law prohibits such notice.

5. Customer Obligations

Customer represents, warrants, and covenants that:

• Customer has all rights, lawful bases, notices, permissions, and consents necessary for Loop to process Customer Personal Data in accordance with the Agreement and this DPA.
• Customer’s instructions to Loop are lawful and do not violate Applicable Data Protection Law.
• Customer has provided all legally required notices to Data Subjects.
• Customer is solely responsible for the legality of its collection and use of phone numbers, recordings, transcripts, customer profiles, purchase history, cart data, and other Customer Personal Data.
• Customer will not provide Customer Personal Data to Loop if Customer lacks the legal right to do so.
• Customer will not use the Services to process Customer Personal Data in a manner prohibited by the Agreement, Acceptable Use Policy, or Applicable Data Protection Law.
• Customer remains solely responsible for responding to Data Subject requests, determining retention periods, and ensuring that its use of the Services is appropriate for the nature and sensitivity of the Customer Personal Data involved.
• If Customer is an agency or service provider acting for a merchant or other client, Customer represents and warrants that it has all authority required to instruct Loop and to provide Customer Personal Data on behalf of that client.

6. Loop Personnel and Confidentiality

6.1 Confidentiality obligations

Loop will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual, statutory, or otherwise.

6.2 Need-to-know access

Loop will limit access to Customer Personal Data to personnel who need such access to provide, support, secure, or improve the Services, or to comply with law.

6.3 Training and internal controls

Loop will maintain reasonable internal measures designed to ensure that authorized personnel understand and appropriately handle Customer Personal Data consistent with their responsibilities.

7. Security Measures

7.1 Technical and organizational measures

Loop will implement and maintain commercially reasonable technical and organizational measures designed to protect Customer Personal Data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access.

7.2 Security standard

Such measures will take into account:

• the nature, scope, context, and purposes of processing;
• the state of the art;
• implementation costs;
• the risks presented by the processing;
• the sensitivity of the Customer Personal Data.

7.3 Security details

Without limiting the generality of the foregoing, Loop will maintain measures substantially as described in Annex 2.

7.4 No absolute guarantee

Customer acknowledges that no security measure can guarantee absolute security and that Loop does not warrant that the Services will be immune from all vulnerabilities, intrusions, or disruptions.

8. Subprocessors

8.1 General authorization

Customer authorizes Loop to engage Subprocessors and Affiliates to process Customer Personal Data on Customer’s behalf in connection with the Services.

8.2 Subprocessor obligations

Loop will impose data protection obligations on Subprocessors that are materially protective of Customer Personal Data and appropriate to the nature of the services provided by the Subprocessor.

8.3 Responsibility

Loop will remain responsible for the acts and omissions of its Subprocessors to the extent required by Applicable Data Protection Law and the Agreement.

8.4 Subprocessor list

Loop will make available a current list of Subprocessors on its website or by other reasonable means.

8.5 Changes to subprocessors

Loop may update its Subprocessors from time to time. Where required by Applicable Data Protection Law, Loop will provide notice of a new Subprocessor by updating its list, by email, or through another reasonable mechanism.

8.6 Objections

Where Applicable Data Protection Law grants Customer a right to object, Customer may object to a new Subprocessor on reasonable data protection grounds by notifying Loop in writing within ten (10) days of notice. Customer’s objection must describe the specific reasonable data protection grounds.

If Customer objects, the parties will work in good faith to address the concern. If Loop cannot provide a commercially reasonable alternative, Loop may suspend or terminate the affected Services, and Customer’s sole remedy will be to stop using the affected Services and, where applicable, receive a pro rata refund of prepaid fees for the terminated portion of the affected Services.

9. International Data Transfers

9.1 Restricted transfers

To the extent Loop processes Customer Personal Data subject to Applicable Data Protection Law involving a Restricted Transfer, the parties agree that the transfer mechanism described in Annex 3 will apply.

9.2 EEA transfers

For Restricted Transfers of Customer Personal Data subject to the GDPR from the EEA to a country not recognized as providing an adequate level of protection, the parties incorporate the European Commission’s Standard Contractual Clauses for controller-to-processor transfers, completed as described in Annex 3.

9.3 UK transfers

For Restricted Transfers subject to the UK GDPR, the parties incorporate the UK International Data Transfer Addendum to the EU SCCs, or any successor mechanism, as further described in Annex 3.

9.4 Swiss transfers

To the extent Swiss data protection law applies, references to the GDPR and EU SCCs shall be interpreted as including the corresponding Swiss requirements, as set out in Annex 3.

9.5 Supplementary measures

Loop will implement such supplementary contractual, technical, and organizational measures as are reasonably appropriate to support the lawfulness of Restricted Transfers, taking into account the nature of the processing and the transfer risk profile.

10. Assistance with Data Subject Requests

10.1 Customer responsibility

Customer is solely responsible for responding to Data Subject requests under Applicable Data Protection Law.

10.2 Loop assistance

Taking into account the nature of the processing, Loop will provide commercially reasonable assistance to Customer to enable Customer to respond to Data Subject requests relating to Customer Personal Data, to the extent Loop is legally required to do so and Customer cannot reasonably fulfill such requests without Loop’s assistance.

10.3 Direct requests to Loop

If Loop receives a request directly from a Data Subject relating to Customer Personal Data processed on behalf of Customer, Loop may:

• direct the Data Subject to Customer;
• notify Customer of the request if legally permitted;
• refrain from responding substantively except as required by law.

10.4 Cost allocation

Where permitted by the Agreement or applicable law, Loop may charge reasonable fees for assistance beyond standard product functionality or routine support.

11. Assistance with DPIAs and Regulatory Consultation

Taking into account the nature of the processing and the information available to Loop, Loop will provide commercially reasonable assistance to Customer with:

• data protection impact assessments;
• prior consultations with supervisory authorities or regulators;
• privacy risk assessments;

in each case only to the extent required by Applicable Data Protection Law and only where Customer cannot reasonably satisfy such obligation without Loop’s assistance.

Loop may satisfy this obligation by providing existing documentation, security materials, summaries, responses to questionnaires, or other generally available compliance information.

12. Personal Data Breach Notification

12.1 Notification

Loop will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

12.2 Content of notice

To the extent reasonably available, such notice will include:

• a description of the nature of the Personal Data Breach;
• the categories of Customer Personal Data affected;
• the likely consequences, if known;
• the measures taken or proposed to address the Personal Data Breach.

12.3 Ongoing updates

Loop may provide information in phases as it becomes available.

12.4 No admission

Notification of a Personal Data Breach does not constitute an admission of fault or liability by Loop.

12.5 Customer responsibility

Customer is solely responsible for determining whether to notify regulators, individuals, customers, or other third parties, except to the extent Applicable Data Protection Law requires otherwise.

13. Return and Deletion of Personal Data

13.1 Return or deletion upon termination

Upon expiration or termination of the Agreement, Loop will, subject to the Agreement and applicable law:

• make Customer Personal Data available for return or export using standard product functionality or other commercially reasonable means for a limited period; and
• thereafter delete or render inaccessible Customer Personal Data from Loop’s active systems within a commercially reasonable period.

13.2 Exceptions

Loop may retain Customer Personal Data to the extent required by law, for legitimate backup and disaster recovery archives, to enforce its rights, to comply with legal obligations, or where technically infeasible to immediately delete from archival systems, provided such retained data remains protected under this DPA.

13.3 Deletion timing

Unless otherwise agreed in writing or required by law, Loop will have no obligation to retain Customer Personal Data beyond the retention period set out in the Agreement, Documentation, or standard service practices.

14. Audits and Information Rights

14.1 Information rights

Loop will make available to Customer information reasonably necessary to demonstrate Loop’s compliance with this DPA, which may include summaries of security practices, responses to reasonable questionnaires, certifications, or audit reports where available.

14.2 Audit limitations

Any audit right under Applicable Data Protection Law shall be exercised:

• only where Customer cannot reasonably satisfy its verification obligation through the information provided by Loop;
• upon reasonable prior written notice;
• no more than once per twelve (12) month period unless a Personal Data Breach, regulator request, or material compliance issue reasonably requires more;
• during normal business hours;
• in a manner that does not unreasonably disrupt Loop’s business, systems, personnel, or other customers;
• subject to appropriate confidentiality obligations.

14.3 Scope

Audits shall be limited to matters directly relevant to Customer’s obligations under Applicable Data Protection Law and this DPA and shall not include access to data of other customers, Loop trade secrets beyond what is reasonably necessary, or systems not relevant to the processing of Customer Personal Data.

14.4 Third-party auditor

Any on-site or technical audit must be conducted by an independent third-party auditor reasonably acceptable to Loop, bound by written confidentiality obligations.

14.5 Cost allocation

Customer shall bear all costs of any audit unless the audit reveals a material breach of this DPA by Loop.

15. CCPA / CPRA and U.S. State Privacy Terms

To the extent the CCPA or similar U.S. state privacy law applies to Customer Personal Data processed by Loop on behalf of Customer:

15.1 Service provider / contractor role

Loop acts as a service provider and, where applicable, contractor, with respect to Customer Personal Data processed on behalf of Customer.

15.2 Limited business purpose

Loop shall not retain, use, or disclose Customer Personal Data:

• for any purpose other than the specific business purposes and services purposes set forth in the Agreement and this DPA;
• outside of the direct business relationship between Customer and Loop;
• except as otherwise permitted by the CCPA or other applicable law.

15.3 No sale or sharing

Loop does not sell or share Customer Personal Data received from Customer in the manner those terms are defined under the CCPA, except as may be expressly permitted by law and the Agreement.

15.4 Combining data

Loop shall not combine Customer Personal Data received from Customer with personal information received from another person or collected from its own interaction with a consumer, except as permitted by the CCPA or other applicable law and solely for permitted business purposes, security, fraud prevention, legal compliance, or de-identified / aggregated analytics where permitted.

15.5 Compliance assistance

Loop will provide commercially reasonable assistance to Customer in responding to verifiable consumer requests to the extent required by applicable U.S. privacy law and to the extent Customer cannot reasonably fulfill such obligations without Loop’s assistance.

16. De-Identified, Aggregated, and Usage Data

16.1 Usage Data

Loop may collect and use Usage Data relating to the operation, support, security, and use of the Services.

16.2 De-identified and aggregated data

Loop may create, use, disclose, and retain de-identified and aggregated data derived from Customer Data and Customer Personal Data, provided such data does not identify Customer or any Data Subject in violation of Applicable Data Protection Law.

16.3 Improvement rights

Loop may use such de-identified, aggregated, and Usage Data to:

• provide and improve the Services;
• enhance reliability, safety, and security;
• develop analytics, reporting, and benchmarking;
• improve models and system performance;
• conduct internal business analysis.

16.4 No broad right to identifiable training use

Except as otherwise expressly agreed in writing or lawfully permitted, Loop will not use Customer Personal Data in identifiable form for generalized model training for unrelated third-party benefit.

17. Liability

This DPA is subject to the limitations of liability, exclusions, and allocation of risk set out in the Agreement. Any claim under or in connection with this DPA shall be subject to the same liability limitations that apply under the Agreement, to the fullest extent permitted by Applicable Data Protection Law.

18. Order of Precedence

If there is any conflict between:

• this DPA and the Agreement, this DPA controls with respect to data protection subject matter;
• this DPA and the SCCs or other transfer mechanism in Annex 3, the SCCs or applicable transfer mechanism control solely with respect to the relevant Restricted Transfer;
• this DPA and Customer instructions, this DPA and the Agreement control unless the parties expressly agree otherwise in writing.

19. Miscellaneous

19.1 Governing law

The governing law and dispute resolution provisions of the Agreement apply to this DPA unless Applicable Data Protection Law requires otherwise for a specific transfer mechanism or annex.

19.2 Amendments

Loop may update this DPA from time to time to reflect changes in law, guidance, transfer mechanisms, subprocessors, or operational practices. Where required, Loop will provide notice of material changes.

19.3 Severability

If any provision of this DPA is found unenforceable, the remaining provisions will remain in full force and effect.

19.4 No waiver

A failure or delay to exercise any right under this DPA shall not operate as a waiver.

19.5 Counterparts and electronic acceptance

This DPA may be accepted electronically and forms part of the Agreement without separate signature where incorporated by reference or accepted through the Services.

Annex 1: Details of Processing

A. Subject matter

Processing of Customer Personal Data in connection with Loop’s provision of the Services to Customer.

B. Duration

For the duration of the Agreement and for any limited retention period thereafter in accordance with the Agreement, this DPA, and applicable law.

C. Nature and purpose of processing

Processing activities may include:

• hosting and storage;
• transmission and routing of communications;
• AI voice call orchestration;
• SMS follow-up;
• voicemail creation and delivery;
• call recording;
• transcription and summarization;
• workflow automation;
• integrations with ecommerce, CRM, and support tools;
• analytics, monitoring, fraud prevention, abuse detection, support, troubleshooting, and security.

D. Categories of Data Subjects

Depending on Customer’s use of the Services, Data Subjects may include:

• Customer’s end customers;
• prospective customers;
• website visitors;
• leads;
• support contacts;
• merchant personnel;
• agency personnel;
• Customer’s own users and administrators.

E. Categories of Customer Personal Data

Depending on Customer’s use of the Services, Customer Personal Data may include:

• names;
• phone numbers;
• email addresses;
• shipping or billing-related contact details;
• order details and cart contents;
• transaction-related metadata;
• customer support details;
• call recordings;
• transcripts;
• voicemail content;
• AI-generated summaries;
• account identifiers;
• device and usage metadata;
• communication preferences;
• opt-in or consent-related records if provided by Customer.

F. Special categories / sensitive data

The Services are not intended for the routine processing of special categories of personal data or similarly sensitive regulated data unless expressly authorized in writing by Loop and covered by appropriate contractual and technical arrangements. Customer shall not provide such data absent such written authorization.

G. Processing operations

Collection, storage, retrieval, analysis, recording, organization, transmission, transcription, summarization, deletion, and other processing necessary to provide the Services and fulfill Loop’s obligations under the Agreement.

Annex 2: Technical and Organizational Measures

Loop will maintain commercially reasonable technical and organizational measures appropriate to the risks presented by the processing, which may include:

1. Access control

• role-based access controls;
• authentication controls for administrative access;
• least-privilege principles where reasonably appropriate;
• internal access restrictions to Customer Personal Data on a need-to-know basis.

2. Encryption and transmission security

• encryption in transit using industry-standard protocols where reasonably appropriate;
• secure transmission methods for data exchanged between components and providers where supported.

3. System security and monitoring

• logging and monitoring of relevant production systems;
• detection and response processes for suspicious activity;
• environment separation practices where reasonably appropriate;
• controls designed to reduce unauthorized access risk.

4. Vulnerability and change management

• software updates and patching practices appropriate to the environment;
• change management or deployment controls appropriate to service architecture;
• reasonable efforts to identify and remediate material security issues.

5. Personnel controls

• confidentiality obligations for personnel;
• restricted access to production data and systems;
• security awareness or role-appropriate operational handling measures.

6. Incident response

• incident response processes for investigating, containing, mitigating, and documenting security incidents;
• escalation procedures as reasonably appropriate.

7. Vendor and subprocessor management

• diligence procedures for key subprocessors and infrastructure providers;
• contractual protections with subprocessors handling Customer Personal Data.

8. Backup and resilience

• backup, redundancy, and recovery practices as reasonably appropriate to the Services and architecture;
• restoration procedures or recovery planning where applicable.

9. Data minimization and retention support

• support for deletion and retention practices through service functionality or internal procedures where appropriate.

The measures described in this Annex are not intended to be exhaustive and may be updated by Loop from time to time, provided that any changes do not materially diminish the overall security posture of the Services.

Annex 3: International Transfer Mechanism

1. EEA Standard Contractual Clauses

For Restricted Transfers of Customer Personal Data from the EEA to Loop in a third country lacking an adequacy decision, the parties incorporate by reference the European Commission Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Implementing Decision (EU) 2021/914, as follows:

• Module Two applies where Customer is a Controller and Loop is a Processor.
• In Clause 7, the optional docking clause applies.
• In Clause 9, Option 2 applies, and the time period for prior notice of Subprocessor changes shall be as set out in Section 8 of this DPA.
• In Clause 11, the optional language does not apply unless required by law.
• In Clause 17, the governing law shall be the law of Ireland, unless another permitted EU Member State is required.
• In Clause 18(b), disputes shall be resolved in the courts of Ireland, unless another permitted EU Member State is required.

Annex I, II, and III of the SCCs shall be deemed completed using the information in this DPA and Annexes 1 and 2, together with the Subprocessor information made available by Loop.

2. UK transfer mechanism

For Restricted Transfers of Customer Personal Data subject to the UK GDPR, the EU SCCs described above shall apply as supplemented by the UK International Data Transfer Addendum issued under section 119A of the UK Data Protection Act 2018, or any successor mechanism. The relevant tables shall be deemed completed using the information in this DPA and the Agreement.

3. Swiss transfers

For transfers subject to Swiss data protection law, the SCCs shall apply with such modifications as are necessary to comply with Swiss law, including interpretation references to the competent Swiss authority where applicable.

4. Supplementary measures

Loop shall implement supplementary technical and organizational measures reasonably appropriate to the risks associated with Restricted Transfers, taking into account the nature of the processing and applicable legal guidance.

5. Priority

To the extent required by Applicable Data Protection Law, if there is any conflict between this DPA and the SCCs or other applicable transfer mechanism, the SCCs or such mechanism shall control solely with respect to the relevant Restricted Transfer.