Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of and is incorporated into the SpeakerFlow Terms of Service (the "Agreement") between SpeakerFlow, LLC ("SpeakerFlow," "we," "us") and the client ("Client," "you"). By agreeing to the Agreement, you also agree to this DPA. Where this DPA conflicts with the Agreement on the handling of Personal Data, this DPA controls.

This DPA governs how SpeakerFlow handles Personal Data on your behalf while delivering our services (for example, when we build, configure, or migrate systems that contain your business's data). It does not govern the personal information SpeakerFlow collects as a business in its own right, which is covered by our Privacy Policy.

---

1. Definitions

• Applicable Data Protection Laws means all privacy and data protection laws that apply to the processing of Personal Data under this DPA, including, where relevant, the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Australian Privacy Act 1988, and applicable U.S. state privacy laws.
• Controller means the party that determines the purposes and means of processing Personal Data. For Personal Data covered by this DPA, the Client is the Controller.
• Processor means the party that processes Personal Data on behalf of the Controller. SpeakerFlow is the Processor.
• Personal Data means any information relating to an identified or identifiable person that SpeakerFlow processes on the Client's behalf under the Agreement.
• Data Subject means the individual to whom Personal Data relates.
• Sub-processor means any third party engaged by SpeakerFlow to process Personal Data on the Client's behalf.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

---

2. Roles and Scope

The Client is the Controller and SpeakerFlow is the Processor of the Personal Data described in Exhibit A.

SpeakerFlow will process Personal Data only on the Client's documented instructions, including the instructions set out in the Agreement, this DPA, and any further written instructions the Client gives in the ordinary course of the engagement. SpeakerFlow will not process Personal Data for its own purposes or sell it.

If SpeakerFlow believes an instruction violates Applicable Data Protection Laws, it will inform the Client (unless legally prohibited from doing so). If SpeakerFlow is legally required to process Personal Data beyond the Client's instructions, it will notify the Client of that requirement before processing, unless the law prohibits such notice.

---

3. Details of Processing

The subject matter, duration, nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects are set out in Exhibit A.

---

4. SpeakerFlow's Obligations

SpeakerFlow will:

• Process Personal Data only on the Client's documented instructions, as described in Section 2.
• Ensure that personnel authorized to process Personal Data are bound by an obligation of confidentiality.
• Implement and maintain the technical and organizational security measures described in Exhibit B.
• Taking into account the nature of processing, provide reasonable assistance to the Client in responding to requests from Data Subjects seeking to exercise their rights.
• Provide reasonable assistance to the Client with data protection impact assessments and consultations with supervisory authorities, where required by Applicable Data Protection Laws and where the Client cannot reasonably obtain the information itself.
• Make available to the Client information reasonably necessary to demonstrate compliance with this DPA.

---

5. Security

SpeakerFlow will maintain technical and organizational measures appropriate to the risk, as described in Exhibit B. SpeakerFlow will not materially reduce the overall level of protection during the term of the Agreement.

---

6. Sub-processors

The Client provides general authorization for SpeakerFlow to engage Sub-processors to process Personal Data, subject to this Section. SpeakerFlow's current Sub-processors are listed in Exhibit C.

SpeakerFlow will:

• Impose data protection obligations on each Sub-processor that are substantially equivalent to those in this DPA, by written contract.
• Remain fully liable to the Client for the performance of each Sub-processor's data protection obligations.
• Give the Client reasonable prior notice of any intended addition or replacement of a Sub-processor that processes Personal Data, and give the Client the opportunity to object on reasonable, data-protection-related grounds. If the parties cannot resolve a good-faith objection, the Client may terminate the affected portion of the services.

---

7. Data Subject Rights

Taking into account the nature of the processing, SpeakerFlow will assist the Client by appropriate technical and organizational measures, insofar as possible, in fulfilling the Client's obligation to respond to Data Subject requests. If SpeakerFlow receives a request directly from a Data Subject relating to Personal Data processed on the Client's behalf, it will not respond directly (except to confirm the request should be directed to the Client) and will promptly forward the request to the Client, unless legally required to respond.

---

8. Personal Data Breach

SpeakerFlow will notify the Client without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on the Client's behalf. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address it. SpeakerFlow will cooperate reasonably with the Client and take reasonable steps to mitigate the breach.

Notification of a breach is not, by itself, an acknowledgment of fault or liability.

---

9. Return and Deletion of Data

Upon termination of the Agreement, or earlier upon the Client's written request, SpeakerFlow will, at the Client's choice, delete or return the Personal Data it processes on the Client's behalf, and delete existing copies, within 30 days, unless retention is required by law. Consistent with SpeakerFlow's standard practice, migration files and any Client credentials are removed at the close of the applicable project.

On request, SpeakerFlow will confirm in writing that deletion has taken place.

---

10. International Data Transfers

SpeakerFlow is located in the United States and processes Personal Data there. Where the Client transfers Personal Data of individuals in the EU, UK, or another jurisdiction that restricts cross-border transfers, and such transfer requires an approved transfer mechanism, the parties agree that the applicable Standard Contractual Clauses (and the UK Addendum, where relevant) are incorporated into this DPA by reference and apply to that transfer. The Client acts as data exporter and SpeakerFlow as data importer.

---

11. Audit

SpeakerFlow will make available to the Client, on reasonable written request, information reasonably necessary to demonstrate compliance with this DPA. Where a Data Subject law requires an audit or inspection, the Client may, no more than once per calendar year and on at least 30 days' prior written notice, conduct (or appoint an independent third party to conduct) a review of SpeakerFlow's relevant practices, during business hours, without disrupting SpeakerFlow's operations, and subject to confidentiality obligations. Additional audits may be conducted if required by a supervisory authority or following a confirmed Personal Data Breach.

---

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in the Agreement or this DPA limits either party's liability where such limitation is not permitted by Applicable Data Protection Laws.

---

13. Governing Law

This DPA is governed by the law of the State of Wyoming and the Agreement's governing law and venue provisions apply, except where Applicable Data Protection Laws or an incorporated Standard Contractual Clause require otherwise, in which case those requirements control for the transfer or processing they govern.

---

Exhibit A — Details of Processing

Subject matter: SpeakerFlow's provision of system implementation, migration, configuration, advisory, and support services to the Client under the Agreement.

Duration: For the term of the Agreement and until deletion or return of Personal Data under Section 9.

Nature and purpose of processing: Building, configuring, migrating, and supporting the Client's business systems (primarily within the Zoho platform), which may involve storing, organizing, importing, transferring, and otherwise handling Personal Data contained in those systems.

Types of Personal Data:

• Contact details of the Client's own customers, leads, and contacts (e.g., names, email addresses, phone numbers, company details)
• Business records the Client chooses to migrate or store in its systems
• Personal Data contained in call recordings of the Client's personnel
• Login credentials for the Client's own applications that SpeakerFlow needs to access for integration and migration

Categories of Data Subjects:

• The Client's customers, prospects, and leads
• The Client's own personnel and contacts
• The Client's vendors, partners, and other business contacts (which may include event organizers, bureaus, sponsors, and referral or affiliate partners)
• Any other individuals whose Personal Data the Client chooses to store in the systems SpeakerFlow supports

---

Exhibit B — Security Measures

SpeakerFlow maintains technical and organizational measures appropriate to the risk, including:

• Access controls limiting access to Personal Data to personnel who need it to deliver the services
• Multi-factor authentication and passkeys used to secure access to systems where supported or required
• Use of a dedicated password manager for storing and sharing any Client credentials, with access revoked at the close of the applicable project
• Removal of migration files and Client credentials at the close of the applicable project
• Confidentiality obligations binding personnel with access to Personal Data
• Reasonable measures to protect data in transit and at rest, consistent with the capabilities of the underlying platforms used to deliver the services

---

Exhibit C — Sub-processors

The third parties SpeakerFlow engages to process Client Personal Data:

SpeakerFlow's own migration scripts and applications, which SpeakerFlow builds, controls, and operates itself, are used to move Client data and are not third-party Sub-processors.