Data Processing Addendum

This Addendum forms part of the services agreement between Astra GTM, LLC (“Astra”) and the client named in it (“Client”), and applies when Astra processes personal data on Client's behalf. In that processing Client is the controller (or business) and Astra is the processor (or service provider). If this Addendum conflicts with the agreement on the handling of personal data, this Addendum controls.

Astra processes Client personal data only to perform the services described in the agreement and its statement of work, and on Client's documented instructions. The agreement, statement of work, and Client's configuration of the systems we operate for it are Client's instructions. Astra does not sell Client personal data and does not use it for any purpose other than the services. Astra will tell Client if it believes an instruction violates law.

Astra restricts access to Client personal data to personnel who need it for the services and who are bound by confidentiality. Astra maintains the technical and organizational measures described at astragtm.io/trust and will not materially reduce them during the term.

Client authorizes Astra to use the subprocessors listed at astragtm.io/trust. Astra remains responsible for their performance and binds them to data protection terms no less protective than this Addendum. Astra will notify Client by email at least 14 days before adding or replacing a subprocessor that will process Client personal data. Client may object on reasonable data protection grounds within that period, and the parties will work in good faith to resolve it.

Astra will notify Client without undue delay, and no later than 72 hours, after confirming a security incident that results in unauthorized access to, or loss or disclosure of, Client personal data. The notice will describe what is known about the incident, the data involved, and the steps taken, and Astra will update it as facts develop.

If an individual contacts Astra about Client personal data, Astra will refer the request to Client unless the law requires otherwise. Astra will give Client reasonable help to answer such requests, and to meet its obligations on assessments and regulator inquiries, taking into account the nature of the processing.

On Client's written request after the agreement ends, Astra will delete or return, within 30 days, the personal data Client supplied to Astra and the campaign, reply, and activity records created for Client under the agreement. Astra will keep opt-out and do-not-contact records as needed to honor individuals' opt-outs, and may keep data the law requires it to retain, and will keep that data protected under this Addendum.

Business contact information that Astra sourced independently of Client is not Client personal data. Astra holds it for its own business-to-business outreach under its Privacy Policy.

On request, and not more than once a year unless an incident or regulator requires otherwise, Astra will complete Client's reasonable security questionnaire and provide the information needed to show compliance with this Addendum.

Astra is based in the United States and may process personal data there. Where law requires a transfer mechanism for personal data from the EEA, UK, or Switzerland, the parties will enter the applicable standard contractual clauses on request. To the extent the California Consumer Privacy Act or another US state privacy law applies, Astra acts as Client's service provider or processor for Client personal data and will comply with the obligations that law places on it in that role.

This Addendum applies to Client when the agreement incorporates it. A countersigned copy is available on request at rees@astragtm.io.