Last Updated JUNE 17, 2025

This ClientLab Data Processing Agreement is between Avatar First EOOD trading as ClientLab (“ClientLab”) and the party executing this agreement as Customer (“Customer”). This DPA reflects the parties’ agreement with respect to the Processing of Personal Data by ClientLab on behalf of Customer in connection with the services provided under the contemporaneously-executed Terms of Service agreement between the parties (“Agreement”).

This DPA is part of the Agreement and is effective upon execution or another time as specified in the Agreement, an Order, or an executed amendment to the Agreement. In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency, and it will supersede any previous DPA.

1. Definitions

a. “Business Purpose,” “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Process,” and “Processing” shall have the meanings assigned to them under applicable Data Protection Laws.

b. “Customer Personal Data” means any Personal Data (i) contained within Customer Data provided under the Agreement, and (ii) Processed by ClientLab on behalf of the Customer pursuant to the Agreement and this DPA.

c. “Data Protection Laws” means all applicable worldwide data protection and privacy laws and regulations, including without limitation:

- the General Data Protection Regulation (EU) 2016/679 (“GDPR”),

- the UK General Data Protection Regulation as incorporated into UK law (“UK GDPR”),

- the Swiss Federal Act on Data Protection of 25 September 2020 (“Swiss FADP”),

- the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CCPA”/“CPRA”),

- the Virginia Consumer Data Protection Act (“VCDPA”),

- the Colorado Privacy Act (“CPA”),

- the Utah Consumer Privacy Act (“UCPA”), and

- the Connecticut Data Privacy Act (“CTDPA”);

in each case, as amended, superseded, or replaced from time to time.

d. “European Data” means Personal Data that is subject to the protection of European Data Protection Laws.

e. “European Data Protection Laws” means, collectively:

- the GDPR,

- Directive 2002/58/EC (the ePrivacy Directive),

- the UK GDPR,

- the Swiss FADP, and

- applicable national laws implementing or supplementing any of the foregoing.

f. “Standard Contractual Clauses” means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, currently available at:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

g. “UK Addendum” means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018, currently available at:

https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf

h. “Services” means the products or services provided by ClientLab to Customer pursuant to the Agreement.

2. Compliance

Both parties will comply with all applicable requirements of Data Protection Laws. This schedule is in addition to, and does not relieve, remove, or replace, a party's obligations or rights under Data Protection Laws.

3. Controller/Processor

The parties have determined that for the purposes of Data Protection Laws, ClientLab shall process the Customer Personal Data as processor on behalf of the Customer. Customer may be either a Controller or Processor.

4. Consents

Customer will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of Customer Personal Data to ClientLab, and the lawful collection of the same by the Customer using the ClientLab Services for the duration and purposes of the Agreement and DPA, and shall indemnify ClientLab against all loss and damage (including fines) arising from a failure to do so.

5. Nature, Scope, Purpose of Processing, and Data Subjects

The scope, nature, and purpose of Customer Personal Data Processing by ClientLab, the duration of the Processing, and the types of Customer Personal Data and categories of Data Subjects will be agreed upon by the parties as outlined in the Agreement.

6. Customer Instructions

ClientLab shall process Customer Personal Data only on the documented instructions of the Customer, unless ClientLab is required by any applicable laws to otherwise process that Customer Personal Data. The Agreement and DPA are deemed to be the instructions of Customer; the parties may agree to additional instructions. ClientLab shall inform the Customer if, in the opinion of ClientLab, the instructions of the Customer breach Data Protection Laws.

7. ClientLab Obligations

ClientLab will:

a. Implement and maintain appropriate technical and organizational measures to protect Customer Personal Data from Personal Data Breaches ("Security Measures").

b. Ensure that any personnel engaged and authorized by ClientLab to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory or common law obligation of confidentiality.

c. Assist the Customer, insofar as this is reasonably possible (taking into account the nature of the Processing and the information available to ClientLab), and at the Customer's cost and written request, in responding to any request from a Data Subject and in ensuring the Customer's compliance with its obligations under Data Protection Laws with respect to security, breach notifications, impact assessments, and consultations with supervisory authorities or regulators.

d. Notify the Customer without undue delay on becoming aware of a Personal Data Breach involving the Customer Personal Data.

e. At the written direction of the Customer, delete or return Customer Personal Data and copies thereof to the Customer on termination of the Agreement unless ClientLab is required by any applicable law to continue to process that Customer Personal Data. For the purposes of this paragraph, Customer Personal Data shall be considered deleted where it is put beyond further use by ClientLab.

f. For European Data, assist Customer in ensuring compliance with Articles 32 to 36 of the GDPR; make available all information reasonably necessary to demonstrate compliance with this DPA to the Customer and allow for and reasonably contribute to audits, including inspections conducted by the Customer to assess compliance with this DPA to the extent required by Data Protection Laws; and will make available all information reasonably necessary to demonstrate compliance with GDPR Article 28 requirements for Processors.

g. Maintain records to demonstrate its compliance with this paragraph.

8. U.S. State Privacy Law Compliance

If and to the extent applicable, ClientLab acts as a “processor” or “service provider” on behalf of the Customer under relevant U.S. state privacy laws, including but not limited to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (CCPA / CPRA); the Virginia Consumer Data Protection Act (VCDPA); the Colorado Privacy Act (CPA); the Utah Consumer Privacy Act (UCPA); and the Connecticut Data Privacy Act (CTDPA).

ClientLab agrees not to sell or share Customer Personal Data, nor retain, use, or disclose Customer Personal Data for any purpose other than providing the Services under the Agreement and this DPA, or as otherwise permitted by law. ClientLab shall not combine Customer Personal Data with personal data it receives from other sources except as necessary to deliver the Services in accordance with the Agreement.

ClientLab will provide assistance, at the Customer’s written request and expense, to enable the Customer to respond to individual rights requests as required under applicable U.S. state privacy laws, including access, correction, deletion, and opt-out requests. ClientLab will notify Customer if it receives a verifiable consumer request directly relating to Customer Personal Data.

The Customer acknowledges that it is solely responsible for determining the applicability of U.S. state privacy laws to its business operations and end users, and for complying with its own obligations as a controller or business under those laws.

9. Subprocessors

9.1 Use of Subprocessors

To provide the Services, ClientLab engages third-party subprocessors that may process Customer Personal Data. These subprocessors are used to perform specific services such as CRM infrastructure, advertising automation, or AI-powered chat processing. Subprocessors process data on behalf of ClientLab to the extent necessary to deliver the relevant functionality of the ClientLab system.

9.2 List of Subprocessors

The current subprocessors engaged by ClientLab are listed below. Each entry includes the subprocessors’ purpose, processing location, and links to their respective privacy policies and data protection terms where available. ClientLab does not guarantee or control the data use practices of these subprocessors beyond what is stated in their published documentation.