DATA PROCESSING ADDENDUM (DPA)
Document Version: 2.1
Effective Date: November 4, 2026

This Data Processing Addendum ("DPA") supplements the Terms of Service or Main Services Agreement ("Agreement") entered into by and between Intuitive Growth System, LLC ("Processor" or "iGS"), and the entity subscribing to the iGS software platform and related integration services ("Controller" or "Client").

DEFINITIONS AND DETAILS OF PROCESSING

1.1. "Data Protection Laws" means all global privacy regulations applicable to the processing of Personal Data under the Agreement, including the EU/UK GDPR, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other applicable U.S. state and global privacy laws.

1.2. Description of Processing:

Types of Data: First and last names, email addresses, phone numbers, IP addresses, consent records, email delivery logs, and email marketing metric data (opens, clicks, bounces).

Categories of Data Subjects: Controller’s newsletter subscribers, leads, CRM contacts, and website visitors.

Purpose of Processing: Hosting landing pages and opt-in forms, automated CRM contact management, pipeline tracking, and executing email/SMS marketing campaigns.

Duration of Processing: For the duration of the active Agreement between iGS and the Controller, up to account termination or data deletion request.

ROLES, COMPLIANCE, AND UNLAWFUL INSTRUCTIONS

2.1. The parties acknowledge and agree that with respect to the processing of Personal Data, Client is the Data Controller and iGS is the Data Processor.

2.2. iGS shall process Personal Data only on documented, written instructions from Controller, including with respect to transfers of Personal Data to a third country, unless required to do so by applicable law.

2.3. iGS shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes applicable European Union or Member State data protection provisions.

2.4. iGS ensures that persons authorized to process the Personal Data have committed themselves to confidentiality.

SUB-PROCESSORS AND ADVANCE NOTIFICATION

3.1. Controller grants a general written authorization to iGS to engage Sub-processors to provide the infrastructure, underlying features, and advanced capabilities of the software platform.

3.2. iGS shall inform the Controller via email from [email protected] at least thirty (30) days in advance of any intended changes concerning the addition or replacement of Sub-processors, thereby giving the Controller the opportunity to object to such changes.

3.3. iGS shall enter into a written agreement with each Sub-processor imposing data protection obligations no less restrictive than those imposed on iGS under this DPA.

SECURITY, ASSISTANCE, AND BREACH NOTIFICATIONS

4.1. iGS shall implement appropriate technical and organizational measures to ensure a level of security appropriate to risk, maintaining protections aligned with the frameworks published in the HighLevel Security Statement and individual AI engine parameters.

4.2. iGS shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (Security of processing, Notification of a personal data breach to the supervisory authority, Communication of a personal data breach to the data subject, Data protection impact assessments, and Prior consultation), taking into account the nature of processing and the information available to iGS.

4.3. Data Breach Notice: iGS shall notify the Controller without undue delay, and in any event no later than forty-eight (48) hours, after becoming aware of a personal data breach. This notification shall contain all necessary details to assist the Controller in fulfilling its statutory reporting obligations within seventy-two (72) hours.

ARTIFICIAL INTELLIGENCE AND AUTOMATION PROCESSING

5.1. Controller acknowledges that certain automated workflow features, conversational agents, and data enrichment tools within the iGS platform utilize Artificial Intelligence ("AI Features") powered by specialized underlying sub-processors, specifically OpenAI LLC, Anthropic PBC (Claude), and Google LLC (Gemini) via iGS and its core platform infrastructure.

5.2. iGS ensures that personal data submitted through AI Features is processed in accordance with the security and data protection commitments of our underlying infrastructure and AI model providers.

CUSTOM API AND INTEGRATION PIPELINES

6.1. To the extent that iGS builds, deploys, or maintains custom Application Programming Interfaces (APIs), webhooks, or middleware integrations for the Controller, Personal Data may transit through intermediary hosting infrastructure managed by iGS.

6.2. iGS shall not utilize Personal Data flowing through custom APIs for any purpose other than executing the specific integration instructions dictated by the Controller. iGS’s liability and processing responsibility terminate once data is successfully transmitted to the Controller's designated third-party destination endpoints.

DATA SUBJECT RIGHTS

7.1. Taking into account the nature of the processing, iGS shall assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the data subject's rights.

INTERNATIONAL DATA TRANSFERS

8.1. To the extent that the processing of Personal Data involves a transfer of data outside the European Economic Area (EEA), United Kingdom, or Switzerland to a country not recognized as providing an adequate level of protection, the parties agree that the European Commission's Standard Contractual Clauses (SCCs) Module 2 (Controller-to-Processor) are hereby incorporated by reference and form an integral part of this DPA.

U.S. STATE SPECIFIC AMENDMENTS (CCPA/CPRA)

9.1. iGS shall not "sell" or "share" Personal Data.

9.2. iGS shall not retain, use, or disclose Personal Data for any purpose other than for the business purposes specified in the Agreement, or as otherwise permitted by the CCPA.

TERMINATION AND DELETION

10.1. Upon termination of the Agreement, iGS shall, at the choice of the Controller, delete or return all Personal Data to the Controller, and delete existing copies unless applicable law requires retention of the Personal Data.

See Privacy Policy & Terms

APPENDIX: APPROVED SUB-PROCESSOR LIST

Sub-Processor & Purpose of Processing:

HighLevel, Inc. - Core Software Platform Infrastructure, Database & CRM Architecture - United States

Cloudflare, Inc. - Web Network Optimization, Edge Caching, SSL Encryption, Domain Routing - United States

OpenAI, LLC - AI Content Generation, Workflow AI, and Automation - United States

Anthropic, PBC - Claude AI Large Language Model Processing & Conversational Agents - United States

Google, LLC - Gemini AI Processing, Data Enrichment & Cloud Hosting Logic - United States

Twilio, Inc. - SMS and Phone System Infrastructure - United States

Mailgun Technologies, Inc. - Email Delivery Infrastructure - United States

Stripe, Inc. - SaaS Subscription Billing and Merchant Payment Gateways - United States

Render, Inc. - Secure Cloud Infrastructure for Custom-Built iGS API Pipelines - United States