Data Processing Addendum (DPA)

Parties

This addendum (the "Addendum") is made between FORTVISION (the "Processor" / "Provider") and Customer name, registration no. number, of address (the "Controller" / "Customer"), and forms an integral part of the service agreement between them (the "Main Agreement").

1. Definitions

1. "Data Protection Law" means the Israeli Protection of Privacy Law, 5741-1981 and its regulations, including the Protection of Privacy Regulations (Data Security), 5777-2017 ("Israeli Law"); and, where applicable, Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.
2. "Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Security Incident" have the meanings given in Data Protection Law. "Controller" includes a "database owner" and "Processor" includes a "holder" under Israeli Law.
3. "Customer Data" means Personal Data that the Customer (or anyone on its behalf, including its users and end clients) enters, uploads, connects or generates in the Platform.
4. "Sub-processor" means a third party engaged by the Processor to process Customer Data.

2. Roles and scope of processing

1. The Customer is the Controller of Customer Data and the Processor processes it on the Customer's behalf and only on its documented instructions. The Customer's instructions are given through the Main Agreement, this Addendum and its use of the Platform and its interfaces.
2. Subject matter: provision of a lead-management, marketing, advertising and customer-communication platform (the "Platform").
3. Nature and purpose: collection, storage, organisation, analysis, sending of communications (email, SMS, WhatsApp, LinkedIn), synchronisation with advertising and commerce platforms the Customer has connected, AI-assisted content generation at the Customer's request, backup and deletion.
4. Types of Personal Data: identification and contact details (name, email, phone, company, role), behavioural data on the Customer's sites (views, clicks, carts, purchases), content of communications with leads and customers, campaign data, and details of the Customer's Platform users.
5. Categories of Data Subjects: the Customer's leads and customers, visitors to the Customer's sites, the Customer's employees and authorised users.
6. Duration: the term of the Main Agreement until deletion or return is completed under section 9.
7. The Processor shall promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend that instruction until clarified.

3. Processor obligations

1. Process Customer Data solely for the purposes in section 2 and not for its own purposes; never sell Customer Data nor use it to train general-purpose models.
2. Ensure that every person authorised to process Customer Data is bound by confidentiality (contractual or statutory) and appropriately trained, and that access is granted on a need-to-know basis.
3. Assist the Customer, to a reasonable extent and taking into account the nature of processing, in meeting its obligations under Data Protection Law — including responses to Data Subjects, security, Security Incident notification, data-protection impact assessments and prior consultation with a supervisory authority.
4. Maintain a record of the processing activities carried out for the Customer where required by law.

4. Security measures

1. The Processor shall implement and maintain appropriate technical and organisational measures to protect Customer Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, having regard to the state of the art, implementation costs, the nature of processing and the risks to Data Subjects.
2. The measures implemented in the Platform at the date of this Addendum are described at app.fortvision.com/security (the "Security Page"), which forms part of this Addendum. The Processor may update the measures from time to time provided the overall level of protection is not materially reduced.
3. The Processor shall classify its databases and apply the duties of the Data Security Regulations according to the security level applicable to them, including a security procedure, access management, event logging and access control.

5. Sub-processors

1. The Customer gives general authorisation to the Sub-processors listed on the Security Page at the date of signature and those listed below:

   Sub-processor	Role	Location
   Vercel Inc.	Hosting of app and API	USA
   Upstash Inc.	Database (Redis)	Per database configuration
   Amazon Web Services	Email (SES), storage and backups (S3), database (Aurora), Lambda/API Gateway	Ireland (EU); SES per configuration
   Cloudflare Inc.	CDN for ad creatives	Global
   Anthropic PBC	AI services	USA
   OpenAI	AI services	USA
   Google LLC	AI services (Gemini), sign-in, APIs	USA / global
   Twilio Inc.	SMS and voice	USA / global
   MicroPay	SMS in Israel	Israel
   Unipile	LinkedIn integration	EU

2. The Processor shall give the Customer written notice (including by email or by updating the Security Page together with a notice) at least 14 days before adding or replacing a Sub-processor. The Customer may object on reasonable data-protection grounds within that period; if no reasonable solution is found, the Customer may terminate the affected service without penalty.
3. The Processor shall impose on each Sub-processor, by contract, data-protection obligations no less protective than those in this Addendum, and remains liable to the Customer for the Sub-processors' acts.
4. Platforms the Customer chooses to connect to its account (e.g. Meta, Google Ads, TikTok, LinkedIn, Shopify, Wix, WooCommerce) act as independent controllers under their own terms and are not Sub-processors of the Processor.

6. International transfers

1. Customer Data may be processed in Israel, the European Union and the United States. Transfers of Personal Data subject to the GDPR outside the EEA are made on the basis of an adequacy decision (including the decision concerning Israel) or the European Commission's Standard Contractual Clauses (2021/914), which are deemed incorporated into this Addendum where required (Module 2, controller to processor).
2. Transfers from a database in Israel are made in accordance with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001.

7. Security Incidents

1. The Processor shall notify the Customer without undue delay and no later than 72 hours after becoming aware of a Security Incident concerning Customer Data.
2. The notice shall include, to the extent known: a description of the incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Information not available at the time of notice shall be provided without undue delay thereafter.
3. The Processor shall cooperate with the Customer in investigating and mitigating the incident and in notifying authorities and Data Subjects where required, and shall not notify Data Subjects or authorities on the Customer's behalf without its consent unless required by law.

8. Data Subject rights

1. If a Data Subject contacts the Processor directly regarding Customer Data, the Processor shall refer them to the Customer and inform the Customer within 5 business days, and shall not respond substantively except on the Customer's instruction or where required by law.
2. The Processor shall assist the Customer, through the Platform's tools and other reasonable means, in responding to requests for access, rectification, erasure, restriction, portability and objection.

9. Deletion and return on termination

1. Upon termination of the Main Agreement, and at the Customer's written election, the Processor shall delete all Customer Data or return it to the Customer in a commonly used, machine-readable format and delete existing copies — within 30 days of termination (and, absent an election, delete).
2. Notwithstanding the above, the Processor may retain Customer Data to the extent required by law, and backup copies shall be deleted in the ordinary backup cycle provided they are not otherwise used.
3. On request, the Processor shall confirm completion of deletion in writing.

10. Audit

1. The Processor shall make available to the Customer the information necessary to demonstrate compliance with this Addendum, including the Security Page, descriptions of controls and answers to reasonable security questionnaires (at most once a year, unless a Security Incident has occurred).
2. The Customer (or an independent auditor on its behalf, bound by confidentiality) may conduct an audit, including inspections, no more than once a year on 30 days' notice, during business hours, in a manner that does not disrupt the Processor's operations or its other customers, and at the Customer's cost. The Processor may provide Sub-processor reports in lieu of direct access to their infrastructure.

11. Liability, term and governing law

1. Each party's liability in connection with this Addendum is subject to the limitations of liability and remedies in the Main Agreement, unless such limitation is prohibited by law.
2. This Addendum takes effect on signature by both parties and remains in force for as long as the Processor processes Customer Data.
3. In case of conflict between this Addendum and the Main Agreement on data-protection matters, this Addendum prevails. Governing law and jurisdiction are as set out in the Main Agreement; absent such provision, the laws of the State of Israel and the competent courts of Tel Aviv-Jaffa.

Signatures

Data-protection contact: info@fortvision.com