Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Schulte Media ("Processor," "we," "us," or "our") and the business entity using our Services ("Controller," "you," or "your") and applies where we process personal information on your behalf in connection with the Services. This DPA supplements our Terms of Service and Privacy Policy.

1. Definitions

• Applicable Privacy Laws means all privacy and data protection laws applicable to the processing described in this DPA, including the California Consumer Privacy Act as amended by the CPRA, the California Invasion of Privacy Act (CIPA) as it relates to call recording, and similar U.S. state privacy laws, each as applicable.
• Personal Information has the meaning given in Applicable Privacy Laws and includes any information that identifies, relates to, describes, or could reasonably be linked with a consumer or household — including names, contact details, and the contents of calls, transcripts, and intake conversations.
• Voice Data means audio recordings of telephone calls, voicemails, and voice interactions handled by systems we operate for you, together with transcripts and structured data derived from them.
• Process / Processing means any operation performed on Personal Information, including collection, recording, transcription, analysis, use, storage, disclosure, deletion, or disposal.
• Services means the products and services we provide to you, including websites, AI intake funnels, AI voice agents, CRM configuration, review management, marketing campaigns, and automated follow-up messaging.

2. Roles and Scope; Nature of Processing

You are the business or controller of Personal Information submitted to the Services about your customers, leads, and personnel. We act as your service provider or processor and will Process that Personal Information only on your documented instructions, as described in this DPA and our agreement, unless otherwise required by law.

The Processing includes: operating website intake conversations that collect contact details and a description of the visitor's situation; answering, recording, and transcribing telephone calls via AI voice agents; storing leads and their history in your CRM; sending follow-up messages you have configured or approved; and generating reports. Data subjects are your leads, customers, and callers. Duration is the term of our agreement plus the retention period in Section 9.

3. Processing Instructions and Restrictions

1. We will Process Personal Information only to provide the Services, comply with law, or as otherwise agreed in writing.
2. We will not sell or share Personal Information (as those terms are defined by the CCPA) and will not retain, use, or disclose it outside our direct business relationship with you, except as permitted by Applicable Privacy Laws.
3. We will not combine Personal Information received in connection with the Services with Personal Information from other sources except as necessary to provide or improve the Services, detect security incidents, or as permitted by law.

4. AI Processing

1. No training on your data. We do not use your Personal Information to train our own AI models, and we configure the Services to use AI providers under business terms that prohibit those providers from using your Personal Information to train their models, where such terms are made available by the provider.
2. Automated interactions are disclosed. AI voice agents we deploy identify themselves as automated assistants, and call recording is disclosed at the start of recorded calls.
3. Human oversight. AI-generated intake summaries and communications are subject to your review, and we will correct configurations promptly at your request. The Services do not provide legal, medical, or financial advice, and we configure them not to purport to.
4. Accuracy. AI output can contain errors. We design intake flows to capture the data subject's own words and route them to you rather than to make determinations about the data subject.

5. Call Recording and Communications Compliance

1. Where the Services record calls, we implement recording disclosures at the start of the call. You are responsible for instructing us as to the recording, consent, and disclosure requirements applicable to your business and jurisdictions, and for ensuring that your use of recording, SMS, and email features complies with laws applicable to you (including CIPA, TCPA, and CAN-SPAM). We will implement your reasonable instructions, including disabling recording or adjusting disclosures.
2. You will not instruct us to send messages to individuals who have not provided any legally required consent.

6. Confidentiality; Sensitive and Privileged Information

1. Persons we authorize to Process Personal Information are subject to appropriate confidentiality obligations and receive data-protection training appropriate to their role.
2. We acknowledge that intake conversations for professional-services clients (for example, law firms and financial advisors) may contain sensitive information. We treat all intake content as confidential, and we will follow your written instructions restricting the categories of information the Services request or store. You are responsible for determining what categories of information your intake flows should collect, including whether any information may be subject to professional privilege or duty of confidentiality, and our Services are not intended to create or preserve any privilege.

7. Sub-processors

7.1 Authorized sub-processors

You authorize us to engage the sub-processors listed below. We remain responsible for each sub-processor's performance of its obligations under this DPA.

Sub-processor	Service provided	Location
HighLevel LLC (GoHighLevel)	CRM, websites and funnels, SMS/email automation, telephony, voicemail, call recording, and AI voice/conversation features, including AI model providers engaged through the platform	United States
Telephony carriers engaged via HighLevel (e.g., Twilio Inc. / LC Phone)	Phone numbers, call routing, SMS delivery, call recording infrastructure	United States
Stripe, Inc.	Payment processing and billing	United States
Google LLC	Business Profile management, analytics, and related services	United States
Vercel Inc.	Hosting and content delivery for certain intake widgets and media	United States

We may replace or add sub-processors in accordance with Section 7.2.

7.2 Changes to sub-processors

We will provide at least 30 days' advance notice of a new sub-processor or a material change to an existing arrangement, unless legal or security reasons prevent it (in which case we will notify you as soon as reasonably practicable). If you object on reasonable data-protection grounds, we will work with you in good faith to resolve the objection, including offering an alternative configuration where feasible.

8. Security and Incident Notification

1. We implement and maintain appropriate technical and organizational measures designed to protect Personal Information against unauthorized access, loss, or alteration, taking into account the nature of the Processing and the risks involved. Measures include access controls, encryption in transit, least-privilege account administration, logging, vendor review, and incident response procedures.
2. Breach notice. If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information we Process on your behalf, we will notify you without undue delay after becoming aware of it, and will provide information reasonably available to us about the nature of the incident, the categories and approximate volume of data concerned, and the measures taken or proposed to address it.

9. Data Retention, Return, and Deletion

We retain Personal Information only as long as necessary to provide the Services and as described in our Privacy Policy. Voice Data is retained only as long as needed for quality assurance and the operation of your system, and per your written retention instructions where provided. Upon termination of the Services or upon your written request (subject to legal retention requirements), we will delete or return Personal Information in our possession and direct sub-processors to do the same; your CRM data belongs to you and we will reasonably cooperate in handing off your accounts.

10. Consumer Requests and Assistance

Taking into account the nature of the Processing, we will assist you by appropriate technical and organizational measures, insofar as possible, to respond to consumer rights requests under Applicable Privacy Laws (access, deletion, correction, and opt-out). Where a request is submitted directly to us, we will instruct the requester to contact you unless we are legally required to respond directly.

11. Audits

Upon reasonable written request, we will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of our security practices or completed questionnaires. Where an audit is required by Applicable Privacy Laws, it will be conducted during business hours, with reasonable advance notice, no more than once annually absent a specific incident, and subject to confidentiality and security controls.

12. International Transfers

Personal Information is processed in the United States. If cross-border transfer safeguards are required by law for your data, we will implement appropriate safeguards as required by Applicable Privacy Laws.

13. Liability

Liability arising from our Processing under this DPA is subject to the limitations and exclusions in our agreement with you, except where prohibited by Applicable Privacy Laws.

14. Contact

Questions about this DPA or our Processing on your behalf: