Data Processing Addendum

Effective Date: September 29, 2026
Last Updated: September 29, 2026

This Data Processing Addendum applies when Bullish Leads processes personal information on behalf of a client through our Services.

1. Definitions

"Client Personal Data" means personal information that Bullish Leads processes on behalf of a client through the Services. "Processing," "controller," "processor," "sub-processor" and "data subject" have the meanings given in applicable data protection laws.

2. Roles and scope

The client is the controller (or business) and Bullish Leads is the processor (or service provider) for Client Personal Data. This addendum forms part of the Terms and applies whenever we process Client Personal Data.

3. Processing instructions and restrictions

We process Client Personal Data only to provide the Services and according to the client's documented instructions. We will not sell Client Personal Data, use it for our own purposes outside the business relationship, or combine it with other data except as permitted by law.

4. Confidentiality and personnel

Anyone at Bullish Leads who accesses Client Personal Data is bound by confidentiality obligations and receives appropriate training.

5. Sub-processors

5.1 Authorized sub-processors

The client authorizes us to use sub-processors, such as hosting, telephony, messaging, email and payment providers, to deliver the Services. We require sub-processors to protect data to a standard at least as strong as this addendum.

5.2 Changes to sub-processors

We will give notice of new sub-processors and the client may object on reasonable data protection grounds.

6. Security

We maintain reasonable technical and organizational measures, including access controls, encryption in transit, monitoring and backups. We will notify the client without undue delay after becoming aware of a security incident affecting Client Personal Data.

7. Consumer requests and assistance

If we receive a request from a data subject about Client Personal Data, we will direct it to the client. We will reasonably assist the client in responding to such requests and with data protection assessments where required.

8. Data retention and deletion

When the Services end, we will return the Client Personal Data that the client requests in writing within 30 days, as described in Section 17.4 of our Terms and Conditions. 30 days after the Services end, we will delete Client Personal Data, unless we are required by law to keep it.

9. Audits

On reasonable written request, and no more than once a year, we will provide information needed to demonstrate compliance with this addendum.

10. International transfers

Client Personal Data is processed in the United States. Where required, we will use appropriate safeguards for any transfer outside the United States.

11. Liability

Each party's liability under this addendum is subject to the limitations of liability in the Terms.

12. Contact

Questions about this addendum can be sent to hello@bullishleads.com.