DATA PROCESSING AGREEMENT

NextGen as Processor — Customer as Controller

DRAFT v2.5 — 10 October 2026. NOT LEGAL ADVICE. This is a working draft prepared for internal use. It must be reviewed and approved by qualified data protection counsel before it is offered to any customer. Bracketed text is either a fill-in value in UPPER CASE or a decision required marked PLACEHOLDER: …. See README.md for the consolidated decision list and for the commitments this document makes on the platform's behalf.

Document version. 2.5. NextGen publishes this identifier with the Standard Form so a Customer's acceptance under clause 15.4 can name the version accepted, and so the record kept under clause 15.5 identifies the text in force.

Which NextGen entity is the Processor. The Processor is NextGen OS LLP (England and Wales) for every Customer whose Services are provided outside the United States, and NextGen OS, Inc. (Wyoming) only for Customers whose Services are provided in the United States. Where the Parties sign, execute against the entity for the Customer's territory and delete the other limb in clause 0.2; where the Customer accepts without signature, the entity is named in the acceptance table under SIGNATURES. Where a Service the Customer turns on involves a Sub-processor established in the United States, that is disclosed in Schedule 3 and clause 10 applies to it. NextGen OS LLP and NextGen OS, Inc. are together the "NextGen Group".

How this Agreement is entered into. The standard form is published at /dpa/agreement/ and is accepted, not signed — clause 15.4 provides that acceptance by incorporation into the Underlying Agreement, or by the Customer's written or electronic acceptance of the Standard Form, has the same effect as execution. A signature is optional and is offered only where a Customer asks for a signed counterpart (see SIGNATURES).

Clause numbering. This version renumbers the clauses (v1.x ran 1–15; v2.0 runs 1–16, with artificial intelligence added as clause 6). Cross-references inside this document have been updated; a Customer holding a v1.x copy should be given this version rather than a marked-up diff of clause numbers.

---

PARTIES

This Data Processing Agreement (this "DPA" or this "Agreement") is made and entered into as of EFFECTIVE DATE (the "Effective Date") by and between:

0.1 CUSTOMER LEGAL NAME, a STATE / COUNTRY ENTITY TYPE with its principal place of business at STREET ADDRESS, CITY, STATE/PROVINCE, POSTAL CODE, COUNTRY (the "Customer", and where it acts as a controller, the "Controller"); and

0.2 the NextGen Group entity that is the Customer's Processor (the "Processor" or "NextGen"), being:

• (a) NextGen OS LLP, a limited liability partnership registered in England and Wales, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX — for every Customer whose Services are provided outside the United States; or
• (b) NextGen OS, Inc., a Wyoming corporation with its principal place of business at 30 North Gould Street, Ste R, Sheridan, Wyoming 82801, United States — for Customers whose Services are provided in the United States only.

0.3 The Customer's region is recorded in the Underlying Agreement or the applicable order form. Where it is not, the NextGen Group entity named on the face of the accepted copy — whether in the signature block or in the acceptance table — is the Processor, and the Customer's execution or acceptance of this Agreement confirms that entity.

The Customer and NextGen are each a "Party" and together the "Parties".

RECITALS

A. The Customer has entered into, or will enter into, the NextGen Terms of Service or a master subscription agreement with the Processor (the "Underlying Agreement") under which the Processor provides a hosted customer relationship management platform and related services (the "Services").

B. In the course of providing the Services, NextGen processes Personal Data on behalf of the Customer. The Parties intend this Agreement to satisfy the requirements of Article 28 of Regulation (EU) 2016/679 (the "GDPR"), the equivalent requirements of applicable national law and, where the Customer is established in or the processing is subject to Australian law, the requirements of the Privacy Act 1988 (Cth).

C. This Agreement supplements, and is incorporated into, the Underlying Agreement. In the event of a conflict, the order of precedence in clause 16.1 applies.

NOW, THEREFORE, the Parties agree as follows.

---

1. DEFINITIONS

1.1 Capitalised terms used but not defined in this Agreement have the meanings given to them in the GDPR, the UK GDPR or Australian Privacy Law, as applicable.

1.2 For the purposes of this Agreement:

• "AI System" means a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments, and includes the artificial-intelligence features of the Services.
• "Applicable Data Protection Law" means all laws and regulations relating to the protection of Personal Data that apply to the processing under this Agreement, including the GDPR, the UK GDPR, Australian Privacy Law, and, to the extent applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act and other United States state privacy laws.
• "Australian Privacy Law" means the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs") made under it, the Notifiable Data Breaches scheme in Part IIIC of that Act, and any code of practice registered under that Act that applies to the processing (including the Children's Online Privacy Code once registered).
• "Controller" has the meaning given in Article 4(7) GDPR, and includes a "APP entity" that is an organisation for the purposes of Australian Privacy Law.
• "Customer Personal Data" means Personal Data that NextGen processes on behalf of the Customer in connection with the Services.
• "Data Subject" has the meaning given in Article 4(1) GDPR, and includes an "individual" for the purposes of Australian Privacy Law.
• "Eligible Data Breach" has the meaning given in Part IIIC of the Privacy Act 1988 (Cth).
• "Personal Data" has the meaning given in Article 4(1) GDPR.
• "Personal Data Breach" has the meaning given in Article 4(12) GDPR, and includes an Eligible Data Breach and a suspected Eligible Data Breach.
• "Personal Information" has the meaning given in Australian Privacy Law, and is included within "Personal Data" and "Customer Personal Data" for the purposes of this Agreement.
• "Processing" has the meaning given in Article 4(2) GDPR, and "process" and "processed" are construed accordingly.
• "Processor" has the meaning given in Article 4(8) GDPR.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country or territory outside the European Economic Area or the United Kingdom that is not subject to an adequacy decision. Whether a transfer to the United Kingdom is a Restricted Transfer is addressed in Schedule 4.
• "Sensitive Data" means Special Categories of Personal Data within the meaning of Article 9 GDPR, "sensitive information" within the meaning of Australian Privacy Law, and any other categories of Personal Data subject to additional protections under Applicable Data Protection Law.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and includes Module Two (controller to processor) and Module Three (processor to processor) as applicable.
• "Sub-processor" means any processor engaged by NextGen to process Customer Personal Data, as further described in clause 7 and Schedule 3.
• "Supervisory Authority" has the meaning given in Article 4(21) GDPR, and includes, in relation to Australian Privacy Law, the Australian Information Commissioner and the Office of the Australian Information Commissioner ("OAIC").
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

---

2. ROLES AND SCOPE

2.1 The Parties acknowledge that, in respect of Customer Personal Data, the Customer is the Controller and NextGen is the Processor. NextGen processes Customer Personal Data only on documented instructions from the Customer, as required by Article 28(3)(a) GDPR.

2.2 Where the Customer is itself a processor acting on behalf of a controller, the Customer acts as processor and NextGen acts as a Sub-processor, and the Customer warrants that it has the authority of that controller to enter into this Agreement and to give the instructions described in it. References to the Customer's obligations as Controller include, where applicable, the equivalent obligations under Article 28(4) GDPR and the Customer's own processing agreement with its controller.

2.3 NextGen shall process Customer Personal Data only:

• (a) in accordance with the Customer's documented instructions, including with respect to Restricted Transfers, as set out in this Agreement (including the Schedules), the configuration of the Services by the Customer, the Customer's use of the Services, and any written instruction given under clause 16.3; and
• (b) as necessary to provide the Services and as permitted by Applicable Data Protection Law.

2.4 The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are described in Schedule 1.

2.5 NextGen shall not:

• (a) process Customer Personal Data for its own purposes, except as necessary to provide, secure, support and maintain the Services or as required by law;
• (b) sell Customer Personal Data or share it with third parties for cross-context behavioural advertising; or
• (c) use Customer Personal Data to train, fine-tune or otherwise improve machine-learning models, except where the Customer expressly instructs otherwise and the data has been aggregated or de-identified in accordance with Applicable Data Protection Law.

2.6 NextGen may create and use aggregated or de-identified data derived from the operation of the Services (for example service telemetry, performance metrics and usage statistics) to operate, secure and improve the Services, provided that such data does not identify and cannot reasonably be used to re-identify any individual and is not Customer Personal Data.

2.7 The Customer is responsible for the lawfulness of the processing, for providing the notices required under Articles 13 and 14 GDPR and APP 5 to Data Subjects, for ensuring it has a lawful basis and a valid documented instruction for the processing, and for the accuracy and quality of Customer Personal Data submitted to the Services.

2.8 Third-party integrations are outside this Agreement. The Services allow the Customer to connect third-party products and services that the Customer selects and contracts with directly (for example, by adding a Twilio or TextGrid messaging connection, a SendGrid or Mailgun email connection, a Meta, Slack, Telegram or Google connection, or any other integration or marketplace item, and by sending data out through a webhook, API call or export). Where the Customer does so:

• (a) the Customer engages that third party directly and is its controller (or its own processor's customer); those integrations are not Sub-processors of NextGen and are not covered by this Agreement;
• (b) NextGen provides connectivity to them as part of the Service on the Customer's instruction, but does not determine the purposes of that third party's processing and does not control it;
• (c) NextGen is not responsible for that third party's security, retention, location, onward transfers or compliance, and gives no warranty about it; and
• (d) the Customer is responsible for the contract, the notices, the lawful basis and any transfer mechanism that the disclosure to that third party requires.

Nothing in this Agreement makes NextGen a processor, sub-processor, controller or joint controller in respect of an integration the Customer connects for itself, and the safeguards in clauses 10.2 and 10.3 (and, for Australia, Schedule 7.3) do not apply to it.

---

3. INSTRUCTIONS

3.1 This Agreement, including the Schedules, the Customer's configuration of the Services and the Customer's use of the features of the Services, constitutes the Customer's documented instructions to NextGen in relation to the processing of Customer Personal Data.

3.2 NextGen shall immediately inform the Customer if, in NextGen's opinion, an instruction from the Customer infringes the GDPR, Australian Privacy Law or other Applicable Data Protection Law.

3.3 NextGen is not required to comply with an instruction that would require it to breach Applicable Data Protection Law. If NextGen declines to follow an instruction on that basis, it will notify the Customer and may suspend the relevant processing until a lawful instruction is received.

---

4. CONFIDENTIALITY

4.1 NextGen shall ensure that persons authorised to process Customer Personal Data are subject to appropriate obligations of confidentiality, whether contractual or statutory, and that those obligations survive termination.

4.2 NextGen shall limit access to Customer Personal Data to those personnel who require it to provide the Services, on a least-privilege and need-to-know basis, and shall maintain records of production access.

4.3 NextGen shall provide appropriate data protection and security training to personnel with access to Customer Personal Data, in accordance with Applicable Data Protection Law and Schedule 2.

---

5. SECURITY OF PROCESSING

5.1 NextGen shall implement the technical and organisational measures set out in Schedule 2 to ensure a level of security appropriate to the risk, as required by Article 32 GDPR and APP 11, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of Data Subjects.

5.2 Without limiting clause 5.1, NextGen shall implement measures to ensure:

• (a) the confidentiality, integrity, availability and resilience of processing systems and services;
• (b) the ability to restore the availability of and access to Customer Personal Data in a timely manner in the event of a physical or technical incident; and
• (c) a process for regularly testing, assessing and evaluating the effectiveness of the measures.

5.3 The measures in Schedule 2 are not a substitute for the Customer's own security obligations, and the Customer is responsible for the security of its own credentials, users, configurations, integrations and end-user devices.

5.4 NextGen shall not reduce the overall level of protection provided by the measures in Schedule 2 during the term of this Agreement.

---

6. ARTIFICIAL INTELLIGENCE FEATURES

6.1 Scope. This clause applies to the artificial-intelligence features of the Services that the Customer enables (which may include conversational assistants, AI agents, AI-assisted voice interactions, content and image generation, and AI-assisted builders). The detailed allocation of responsibility for those features is set out in Schedule 8.

6.2 No training on Customer Personal Data. NextGen shall not use Customer Personal Data to train, fine-tune or otherwise improve any AI System, and shall not permit a Sub-processor to do so, except where the Customer expressly instructs otherwise and the data has been aggregated or de-identified in accordance with Applicable Data Protection Law (clause 2.5(c)).

6.3 Inference Sub-processors. AI inference is performed through the Sub-processors listed in Schedule 3 under written Article 28 contracts. The primary text-inference Sub-processor operates under contractual zero data retention, meaning prompts and outputs are not retained by that Sub-processor after the response is returned.

6.4 Transparency. NextGen shall implement the transparency measures described in Schedule 8, including:

• (a) informing a natural person that they are interacting with an AI System at the latest at the time of the first interaction, except where that is obvious to a reasonably well-informed, observant and circumspect person in the context (Article 50(1) of Regulation (EU) 2024/1689 (the "AI Act"));
• (b) marking synthetic content generated by the AI features, including generated images, in a machine-readable format and in a manner that is detectable as artificially generated or manipulated (Article 50(2) AI Act); and
• (c) ensuring that any AI-generated text published to inform the public on matters of public interest is disclosed as artificially generated, except where it has undergone human review or editorial control with editorial responsibility (Article 50(4) AI Act).

6.5 Human oversight and automated decisions. The AI features are decision-support tools. They do not make decisions that produce legal effects concerning a Data Subject, or similarly significantly affect a Data Subject, unless the Customer has deliberately configured the Services to do so and has satisfied itself that it has a lawful basis and has provided the information required by Article 22 GDPR, APP 1.7 (automated decision-making transparency) and any other Applicable Data Protection Law. The Customer is responsible for the human review of AI outputs it acts on.

6.6 Customer responsibility. The Customer is responsible for: the instructions it gives to AI features; the prompts and any Customer Personal Data it submits to them; the content it generates and publishes; and ensuring that its use of the AI features complies with the AI Act and Applicable Data Protection Law as a deployer. The Customer shall not use the AI features to make decisions about individuals based on Sensitive Data unless clause 10 and Schedule 1.6 permit it.

6.7 No high-risk or prohibited use. NextGen does not design or market the AI features for a use prohibited by Article 5 of the AI Act, or for the purpose of emotion recognition or biometric categorisation in the workplace or in education. The Customer shall not use the Services for such purposes.

---

7. SUB-PROCESSORS

7.1 The Customer provides a general written authorisation for NextGen to engage Sub-processors to process Customer Personal Data, as permitted by Article 28(2) GDPR.

7.2 The Sub-processors engaged as at the Effective Date are listed in Schedule 3, together with their processing purpose, location and transfer mechanism.

7.3 NextGen shall:

• (a) give the Customer notice of the intended addition or replacement of a Sub-processor at least thirty (30) days before that Sub-processor begins processing Customer Personal Data, by email to the Sub-processor notification contact in Schedule 5 and by publishing the change on the sub-processor notice page maintained by NextGen at https://thenextgencrm.com/subprocessors/; and
• (b) allow the Customer to object to the change. If the Customer objects in writing within the notice period on reasonable data protection grounds, the Parties shall discuss the objection in good faith and NextGen may offer an alternative configuration of the Services that avoids the change. If the Parties cannot resolve it, the Customer may terminate the affected Services without penalty (and, if the affected Services are the whole of the Services, the Underlying Agreement) by written notice given within thirty (30) days of the notice, and NextGen shall refund prepaid fees for the terminated period on a pro-rata basis. Termination under this clause 7.3(b) is the Customer's sole remedy for an objection.

7.4 NextGen shall impose data protection obligations on each Sub-processor that are materially the same as, or stricter than, those in this Agreement, including the obligations in Article 28(3) GDPR, APP 8 and, where the Sub-processor processes data subject to Australian Privacy Law, obligations that permit NextGen to comply with Australian Privacy Law, by way of a written contract. NextGen remains fully liable to the Customer for the performance of each Sub-processor's obligations.

7.5 NextGen shall maintain an up-to-date record of Sub-processors and shall provide it to the Customer on request. The record at clause 7.3(a)'s notice page is maintained as the current list for the purposes of clause 7.5.

7.6 Any processing by a Sub-processor involving a Restricted Transfer is subject to clause 10.

---

8. DATA SUBJECT RIGHTS

8.1 NextGen shall assist the Customer, to the extent reasonably possible and taking into account the nature of the processing, in responding to requests from Data Subjects exercising their rights under Chapter III GDPR and under the APPs, including access, correction, erasure, restriction, portability, objection, and the right not to be subject to a solely automated decision (Article 22 GDPR, APP 1.7 and APP 12/13).

8.2 Where NextGen receives a request directly from a Data Subject relating to Customer Personal Data, NextGen shall not respond to the substance of the request except to confirm that it relates to the Customer, and shall forward the request to the Customer without undue delay and in any event within five (5) business days, unless legally prohibited or where the request relates to a service NextGen provides separately to that individual.

8.3 NextGen shall provide in-product functionality and documented procedures, described in Schedule 2, to enable the Customer to search, export, correct and delete Customer Personal Data. Where the Customer cannot resolve a request through the product, NextGen shall provide reasonable assistance and shall respond to the Customer's written request for that assistance within five (5) business days.

---

9. ASSISTANCE WITH CONTROLLER OBLIGATIONS

9.1 NextGen shall provide reasonable assistance to the Customer in ensuring compliance with Articles 32 to 36 GDPR and, in relation to Australian Privacy Law, with APPs 1, 11 and the Customer's obligations in respect of Eligible Data Breaches, taking into account the nature of the processing and the information available to NextGen, including:

• (a) assistance with data protection impact assessments under Article 35 GDPR and with any privacy impact assessment the Customer considers necessary; and
• (b) assistance with prior consultations with a Supervisory Authority or the OAIC under Article 36 GDPR or otherwise.

9.2 NextGen shall cooperate with a Supervisory Authority, and with the OAIC, in the performance of their tasks, and shall make available to the Customer, to a Supervisory Authority and to the OAIC the information necessary to demonstrate compliance with Article 28 GDPR and Australian Privacy Law.

9.3 Assistance under this clause is subject to clause 13.2 in respect of costs.

---

10. INTERNATIONAL TRANSFERS AND LOCATION OF PROCESSING

10.1 NextGen may process Customer Personal Data in the regions made available to the Customer through the Services. Where the Services offer a European region, the Customer may select it so that Customer Personal Data is stored and processed on infrastructure located in the European Economic Area, subject to the Sub-processors listed in Schedule 3 and to backup processing described in clause 10.6 and Schedule 2. NextGen's own regional deployments are self-contained and Customer Personal Data held in a region's account databases is not replicated between NextGen's servers in different regions, except as described in clause 10.7.

10.2 A Restricted Transfer of Customer Personal Data shall be made only:

• (a) to a country or territory covered by an adequacy decision of the European Commission or the UK Secretary of State, as applicable; or
• (b) subject to appropriate safeguards under Article 46 GDPR, which the Parties record as the Standard Contractual Clauses, completed as set out in Schedule 4, together with, where applicable, the UK Addendum.

10.3 The Customer authorises NextGen to enter into the Standard Contractual Clauses with a Sub-processor on the Customer's behalf in respect of Restricted Transfers, and NextGen shall provide the Customer with a copy of the completed clauses on request.

10.4 NextGen shall:

• (a) document and, on the Customer's reasonable request, provide a transfer impact assessment covering each Restricted Transfer, including the laws of the destination country and any supplementary measures applied; and
• (b) implement supplementary technical measures, including the security measures in Schedule 2, to protect Customer Personal Data against access by public authorities where the assessment concludes they are necessary.

10.5 If NextGen receives a legally binding request from a public authority, court or tribunal for disclosure of Customer Personal Data, it shall, unless legally prohibited from doing so:

• (a) notify the Customer without undue delay;
• (b) review the legality of the request and challenge it where there are reasonable grounds to do so; and
• (c) disclose only the minimum amount of Customer Personal Data necessary to comply.

10.6 Location of processing, internal architecture and backup residency. Each regional deployment of the Services is self-contained. The application servers for a region and that region's account databases — the libSQL databases in which Customer Personal Data is held — run on the same server, and the application accesses those databases directly on local storage rather than over a network. NextGen does not replicate or transfer Customer Personal Data held in a region's account databases to its own servers in another region, except where a Customer-initiated feature described in clause 10.7 causes it to do so while performing the Customer's documented instruction. Accordingly, where the Customer selects the European region, Customer Personal Data in its account databases is stored and processed on infrastructure located in the European Economic Area, and is not transferred by NextGen outside it within NextGen's own server network, except under clause 10.7.

Customer Personal Data is backed up to storage located in the same region as the data. Customer Personal Data hosted in the United States region is backed up to backup storage located in the United States; Customer Personal Data hosted in the European region is backed up to backup storage located in the European Economic Area; and Customer Personal Data hosted in the Australian region is backed up to backup storage located in Australia. A backup of European Economic Area, United Kingdom or Australian data is therefore not, in itself, a Restricted Transfer, and a backup of Australian data is not an overseas disclosure for the purposes of APP 8. This paragraph addresses NextGen's own regional infrastructure only: transfers to the Sub-processors listed in Schedule 3 — other than the in-region backup storage described above and in Schedule 2 — are separate, and are governed by clause 10.2.

Note on Australian backups. NextGen's Australian region stores account databases in Australia and backs them up within Australia. This is stated here, in Schedule 2, in Schedule 3, in the NextGen Privacy Policy and in the NextGen Terms of Service so that an Australian Customer can make its own APP 1.4(e) and APP 8 assessments.

10.7 Customer-initiated transfers between regions. Some features of the Services let the Customer deliberately move or reflect Customer Personal Data between regions of NextGen's own server network. These transfers are performed on the Customer's documented instruction and only where the Customer (or a permitted user of the Customer's account) initiates them. They are:

• (a) Pass contact to a sub-account. Where the Customer's account is a parent or reseller account, the Customer may pass a contact record, its field values and the triggering form submission from the Customer's region to a sub-account served in another region. That sub-account's region receives and re-encrypts the data with its own account key.
• (b) Ticket escalation and escalation state. Where a support ticket is escalated from a sub-account to a parent account in another region, the ticket — including its description, its field values, the submitting account's primary-admin contact details and any attachment references — is created in the parent's region. Where the parent subsequently changes the ticket's status, lane or resolution note, that state and the parent's message are pushed back down to the account that escalated the ticket, one hop at a time, so that each account in the chain can apply the update for itself.
• (c) Child sale hand-over. Where a sub-account makes a sale to be recorded against a parent account in another region, the sale's contact and transactional data are passed to the parent's region.

Each of these transfers is carried out over NextGen's WireGuard-encrypted private mesh between NextGen-operated servers, or over HTTPS with certificate validation where the mesh is unavailable. Where the Customer is established in the EEA and uses these features to move Customer Personal Data to a NextGen server outside the EEA, that is a Restricted Transfer made on the Customer's instruction and is covered by clause 10.2; where the Customer is established in Australia, it is a disclosure for the purposes of APP 8 and clause 7.4, paragraph 6.5 and Schedule 7 apply.

10.8 Global router replication. The only Customer Personal Data that NextGen transmits between its own servers across regions for its own operational purposes is the data held in its global router: the account record, the user accounts associated with it, and the authentication and authorisation data used to sign users in and to determine which accounts and features they may access. That data is replicated from the primary global router to each regional deployment, and a regional deployment forwards writes to the primary, so that sign-in and account administration work in every region. It does not include the contents of the Customer's account databases. Where that replication crosses regions it is a Restricted Transfer and is covered by clause 10.2.

---

11. PERSONAL DATA BREACHES

11.1 NextGen shall notify the Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and, in any event, no later than forty-eight (48) hours after becoming aware of it, in order to allow the Customer to meet its own obligations under Articles 33 and 34 GDPR and, where applicable, under Part IIIC of the Privacy Act 1988 (Cth). Where the Customer is subject to Australian Privacy Law and NextGen's 48-hour notice arrives with the assessment period in Part IIIC still running, that notice is given in time for the Customer to conduct the assessment required by that Part.

11.2 The notification shall, to the extent known and permitted, include: the nature of the Personal Data Breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach, and the contact point for further information. Where the information is not available at the time of the first notification, NextGen shall provide it in phases without undue further delay.

11.3 NextGen shall assist the Customer in meeting its obligations under Articles 33 and 34 GDPR and under Part IIIC of the Privacy Act 1988 (Cth), including by providing the information the Customer must include in a notification to a Supervisory Authority or the OAIC and, where a communication to Data Subjects or affected individuals is required, information the Customer may use to prepare it. Where a suspected Eligible Data Breach is notified, NextGen shall continue to cooperate with the Customer's assessment for the thirty (30) day period permitted by Part IIIC and shall provide further information as it becomes available within that period.

11.4 NextGen shall take reasonable steps to mitigate the effects of the Personal Data Breach, establish its root cause, and prevent recurrence, and shall keep the Customer informed of material developments.

11.5 A notification under this clause is not an admission of fault or liability.

---

12. RETURN AND DELETION OF CUSTOMER PERSONAL DATA

12.1 On termination or expiry of the Underlying Agreement, or on the Customer's written request, NextGen shall, at the Customer's choice, delete or return Customer Personal Data, and shall delete existing copies, in accordance with Article 28(3)(g) GDPR and APP 11.2, subject to clauses 12.3 and 12.4.

12.2 NextGen shall make the Customer Personal Data available for export using the export functionality of the Services, or in a structured, commonly used and machine-readable format on request, and shall complete deletion within thirty (30) days of the Customer's instruction. Where NextGen deletes Customer Personal Data by destroying the per-account encryption keys (cryptographic erasure), NextGen shall confirm in writing that the keys have been destroyed.

12.3 Customer Personal Data may remain in backup copies for the period covered by the backup rotation described in Schedule 2, during which it is isolated, access-restricted and not processed except for disaster recovery, and is deleted in accordance with the rotation schedule. The maximum residual period for Customer Personal Data in backups is thirty-five (35) days from the date of deletion, after which the backup copy expires through the documented retention cycle. Where a backup copy is held beyond that period because it cannot be expired, it remains isolated and access-restricted, is not processed except for disaster recovery, and is deleted as soon as that is technically possible.

12.4 NextGen may retain Customer Personal Data where required by Applicable Data Protection Law, including for the establishment, exercise or defence of legal claims, provided that it is processed only for that purpose, disclosed only to persons requiring it, and deleted when the obligation ends.

---

13. AUDIT AND INSPECTION

13.1 NextGen shall make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR and Australian Privacy Law, including the documentation of the technical and organisational measures in Schedule 2 and any third-party audit reports listed there.

13.2 NextGen shall allow the Customer, or an auditor mandated by the Customer that is not a competitor of NextGen, to conduct an audit of NextGen's processing under this Agreement, including an inspection of NextGen's premises and systems, provided that the Customer:

• (a) gives at least thirty (30) days written notice;
• (b) conducts the audit no more than once in any period of twelve (12) months, except following a Personal Data Breach or where required by a Supervisory Authority or the OAIC;
• (c) ensures that the auditor is bound by confidentiality obligations;
• (d) uses the least intrusive means reasonably available, including by relying on the reports and information already provided under clause 13.1; and
• (e) bears its own costs and, where the audit is not required by a Supervisory Authority or the OAIC and is not attributable to NextGen's breach, the reasonable costs of NextGen's participation.

13.3 Costs. NextGen shall not charge for its participation in the first two (2) audit days in any twelve (12) month period. Beyond that, NextGen's participation is charged at its reasonable standard rates, notified to the Customer before the audit begins. NextGen bears the cost of its own participation where the audit is required by a Supervisory Authority or the OAIC, or is attributable to NextGen's breach of this Agreement.

13.4 Nothing in this clause limits the right of a Supervisory Authority or the OAIC to conduct an inspection.

---

14. LIABILITY AND INDEMNITY

14.1 The limitation of liability in the Underlying Agreement applies to claims arising out of or in connection with this Agreement, except that it does not limit liability that cannot be excluded or limited under Applicable Data Protection Law, or either Party's liability to a Data Subject under Article 82 GDPR or under Australian Privacy Law.

14.2 Data protection liability. NextGen's aggregate liability arising out of or in connection with (a) a Personal Data Breach caused by NextGen's breach of this Agreement, and (b) NextGen's other breaches of this Agreement, is subject to the limitation of liability in the Underlying Agreement. No separate, additional or higher cap applies to that liability. That limitation does not apply to:

• (a) liability that cannot be excluded or limited under Applicable Data Protection Law;
• (b) NextGen's fraud, wilful misconduct or gross negligence; or
• (c) the Customer's obligation to pay fees properly due.

14.3 Indemnity. NextGen shall indemnify and hold harmless the Customer against:

• (a) administrative fines imposed on the Customer by a Supervisory Authority, the OAIC or another competent authority; and
• (b) compensation paid by the Customer to Data Subjects or affected individuals;

in each case to the extent caused by NextGen's breach of this Agreement or of Applicable Data Protection Law, and subject to the limitation of liability in clause 14.2. The indemnity is:

• (i) conditional on the Customer notifying NextGen of the claim within a reasonable time of becoming aware of it, giving NextGen the opportunity to participate in and, where the claim is brought by a third party, control the defence with counsel reasonably acceptable to the Customer, and providing reasonable cooperation and information at NextGen's cost;
• (ii) reduced to the extent the fine or compensation is increased by the Customer's own act, omission, breach of this Agreement, or failure to comply with its own obligations under Applicable Data Protection Law, or by the Customer's failure to give NextGen the notice, cooperation or control described in (i) where that failure materially prejudiced NextGen's ability to mitigate; and
• (iii) not available where the fine or compensation arises from processing carried out in accordance with the Customer's instructions, except to the extent that NextGen failed to comply with clause 3.2.

14.4 The Customer does not indemnify NextGen for processing carried out in accordance with the Customer's instructions, including any instruction that infringes Applicable Data Protection Law, except where NextGen failed to comply with clause 3.2.

14.5 The indemnity in clause 14.3 is one-way in favour of the Customer. The Parties acknowledge that it is the Processor's indemnity and that the Customer's corresponding obligations are set out in the Underlying Agreement.

---

15. TERM AND TERMINATION

15.1 This Agreement takes effect on the Effective Date and continues for as long as NextGen processes Customer Personal Data under the Underlying Agreement.

15.2 Termination or expiry of the Underlying Agreement terminates this Agreement, subject to clause 12 and to any provisions that by their nature survive.

15.3 Termination or expiry of this Agreement does not relieve either Party of obligations accrued before termination, and does not affect the rights of Data Subjects under the Standard Contractual Clauses or of individuals under Australian Privacy Law.

15.4 Execution of the standard form by acceptance. The standard form of this Agreement published at https://thenextgencrm.com/dpa/agreement/ (the "Standard Form") is entered into without signature where the Customer accepts it in either of the following ways, and in each case that acceptance has the same effect as execution and delivery of a signed counterpart:

• (a) by incorporation. Acceptance of the Underlying Agreement, where the Underlying Agreement or an order form under it incorporates the Standard Form by reference (including by a link to it) as it stands at the date of acceptance; or
• (b) by the Customer's written or electronic acceptance of the Standard Form itself — for example by returning a completed copy marked as accepted, by confirming acceptance in writing to the contact in Schedule 5, or by accepting it through the Services where the Services offer that facility.

Where acceptance is given under paragraph (b), it is effective without a signature by either Party, and the Customer's acceptance identifies the NextGen Group entity that is the Processor under clause 0.2 on the face of the accepted copy. The Customer may obtain a copy of the Standard Form completed with its details and the Processor named, and may request a signature by both Parties, in either case by writing to the contact in Schedule 5. No Party is obliged to sign a counterpart, and the absence of a signature does not affect the validity or enforceability of this Agreement entered into under this clause.

15.5 Record of acceptance. NextGen records, for each acceptance of the Standard Form, the date and time, the identity of the accepting user, the version identifier of the Standard Form and a cryptographic hash of the text accepted. That record is available to the Customer on request and is evidence of the version of this Agreement in force between the Parties at that time. Where the Customer accepts the Standard Form, the "Effective Date" is the date of that acceptance.

---

16. GENERAL

16.1 Order of precedence. In the event of a conflict, the following order applies: (a) the Standard Contractual Clauses (including the UK Addendum, where applicable); (b) this Agreement, including its Schedules; and (c) the Underlying Agreement. In the event of a conflict between this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses prevail to the extent of the conflict.

16.2 Amendments.

• (a) This Agreement may be amended by written agreement of both Parties — including by the exchange of signed counterparts, and including by the Customer's written or electronic acceptance of an amended Standard Form under clause 15.4 — or unilaterally by NextGen in the circumstances in paragraph (b).
• (b) NextGen may update Schedule 2 (technical and organisational measures) and Schedule 3 (Sub-processors) in accordance with this Agreement, and may update this Agreement to reflect a change in Applicable Data Protection Law, a requirement of a Supervisory Authority or the OAIC, or a change in the AI Act or the AI features of the Services, with at least thirty (30) days notice.
• (c) Where an update under paragraph (b) would reduce the overall level of protection below that required by clause 5.1, the Customer may object in writing within the notice period; the Parties shall discuss the objection in good faith and, if it cannot be resolved, the Customer may terminate the affected Services without penalty and NextGen shall refund prepaid fees for the terminated period on a pro-rata basis.
• (d) NextGen publishes the version identifier of the Standard Form in force and the date from which it applies. A Customer that does not accept an amended Standard Form and does not object within the notice period continues on the version previously accepted until it next accepts the then-current Standard Form, except where paragraph (c) applies.

16.3 Notices. Notices under this Agreement shall be given to the contacts in Schedule 5, and are deemed received on the next business day if sent by email.

16.4 Assignment. Neither Party may assign this Agreement without the other's written consent, except to an affiliate or in connection with a merger, acquisition or sale of substantially all assets, provided the assignee assumes the obligations in this Agreement. Assignment of this Agreement within the NextGen Group, between NextGen OS LLP and NextGen OS, Inc., does not require the Customer's consent provided the assignee assumes the obligations in this Agreement and the Customer is notified.

16.5 No third-party beneficiaries. Except for Data Subjects in respect of the Standard Contractual Clauses, a controller in respect of clause 2.2, and individuals in respect of Australian Privacy Law, this Agreement confers no rights on any third party.

16.6 Severability and waiver. If any provision is held invalid or unenforceable, it shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions continue in full force. A failure to exercise a right is not a waiver of it.

16.7 Governing law and jurisdiction. This Agreement and any dispute or claim arising out of or in connection with it are governed by, and construed in accordance with:

• (a) the law of the State of Wyoming, United States, where the Processor is NextGen OS, Inc. — that is, where the Customer's Services are provided in the United States — and the state and federal courts located in Wyoming have exclusive jurisdiction; and
• (b) the law of England and Wales, where the Processor is NextGen OS LLP — that is, where the Customer's Services are provided anywhere outside the United States — and the courts of England and Wales have exclusive jurisdiction.

The applicable limb is determined by the Processor identified in Schedule 5 at the Effective Date and does not change if the Customer later relocates. In addition:

• (a) where the Standard Contractual Clauses apply, their governing law and dispute resolution provisions apply to the clauses themselves, as completed in Schedule 4;
• (b) where the Customer is established in the EEA or the UK, nothing in this clause deprives the Customer of the protection of the mandatory provisions of the law of its own establishment; and
• (c) where the Customer is established in Australia, nothing in this clause excludes or limits the application of Australian Privacy Law, and each Party submits to the non-exclusive jurisdiction of the Federal Court of Australia and the courts of New South Wales in respect of any matter arising under clause 7.4, clause 10.7 or Schedule 7.

16.8 United States state privacy laws. Where the Customer's processing is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act, or to another United States state privacy law that distinguishes between controllers and processors, NextGen acts as a service provider or processor (as applicable), shall not sell or share Customer Personal Data, shall not retain, use or disclose it except to provide the Services or as permitted by this Agreement, and shall comply with the applicable restrictions on combining Customer Personal Data with data from other sources.

16.9 Counterparts. This Agreement may be executed in counterparts, including by electronic signature, each of which is an original and all of which together constitute one instrument. This clause applies only where the Parties sign; execution is not required for this Agreement to take effect under clause 15.4.

---

SIGNATURES

A signed copy is optional. This Agreement takes effect without signature when the Customer accepts the Standard Form under clause 15.4 — by incorporation into the Underlying Agreement, or by accepting the Standard Form itself. Complete the signature table below only where the Customer has asked for a signed counterpart, and then execute against the single NextGen Group entity for the Customer's territory (clause 0.2) and delete the other limb. A completed-but-accepted copy needs only clause 15.4(b) on its face.

Accepted without signature (clause 15.4(b)):

---

SCHEDULE 1 — DETAILS OF PROCESSING

1.1 Subject matter. The processing of Customer Personal Data by NextGen in order to provide the Services under the Underlying Agreement, including the hosting, storage, retrieval, transmission, organisation, structuring, consultation, use, disclosure by transmission within the Services, and erasure of Customer Personal Data.

1.2 Duration. The term of the Underlying Agreement, plus the period required for return or deletion under clause 12.

1.3 Nature and purpose of the processing. Providing the customer relationship management platform and related features selected by the Customer, including: contact, company and lead records; pipeline and opportunity management; calendars, bookings and scheduling; forms and submissions; email, SMS, MMS and voice communications; marketing automation and workflows; ticketing and support; invoicing and payment records; websites, funnels, courses, memberships and communities; reporting and analytics over the Customer's own data; media and file storage; and the artificial-intelligence features enabled by the Customer.

1.4 Categories of Data Subjects. The Customer's contacts, leads, prospects, customers, patients or clients; the Customer's personnel, agents and representatives; the Customer's suppliers and partners; and any other individual whose Personal Data the Customer submits to the Services. This may include children where the Customer collects personal information about minors (see paragraph 1.6A).

1.5 Types of Personal Data. Identification and contact data (name, job title, employer, email address, telephone number, postal address); communication content and metadata (emails, messages, call records, notes, and where the Customer enables it, voice recordings and transcripts); commercial and transactional data (orders, invoices, payment status, subscriptions); geolocation data where the Customer uses mapping or route features; account and usage data (account identifiers, IP address, device and browser data, audit and access logs); and any other Personal Data the Customer configures or submits.

1.6 Sensitive Data. The Services are not designed for Sensitive Data unless the Customer has enabled the applicable configuration and, where required, entered into the appropriate supplemental terms. NextGen permits Sensitive Data only where:

• (a) the Customer has configured the Services to handle it (for example by enabling the health-data configuration in the United States region under the separate HIPAA add-on, or by enabling the encryption and access controls available for restricted fields);
• (b) the Customer has ensured a condition in Article 9(2) GDPR (or the equivalent in Australian Privacy Law) applies, or has obtained the individual's consent as required by APP 3 for sensitive information; and
• (c) where NextGen so requires for the category concerned, the Parties have entered into a supplemental agreement for it.

Where those conditions are not met, the Customer must not submit Sensitive Data to the Services. The Customer is responsible for configuring the Services accordingly.

1.6A Children's Personal Data. Where the Customer collects Personal Data about a child, the Customer is responsible for obtaining any consent or authorisation required under Applicable Data Protection Law and, in Australia, for complying with the Children's Online Privacy Code once it is registered under the Privacy Act 1988 (Cth). The Customer shall not use the AI features to interact directly with a child without appropriate safeguards.

1.6B Payment instruments are prohibited, and are not stored. The Customer shall not enter, store, transmit, or permit any user to enter into the Services, any payment card number, card verification value, full magnetic-stripe or chip data, or any other payment instrument credential (a "Payment Instrument"), in any field or feature of the Services. This includes contact fields, account-defined custom fields, pipeline, ticket and product fields, notes, comments, message and email bodies, form elements, file or media uploads, and workflow configuration.

The Services do not store Payment Instruments. Where the Customer takes payments, card and bank details are collected by the payment provider the Customer connects, and are tokenised by that provider. The Services receive and store only a token or reference, the last four digits, the card brand and the expiry date, and never the number itself.

Where NextGen becomes aware that a Payment Instrument has been entered in breach of this paragraph, it may delete or redact it, and shall do so on the Customer's written instruction. The Customer is responsible for any assessment, notification, forensic investigation or remediation required as a result of a Payment Instrument being entered in breach of this paragraph. Nothing in this Agreement makes NextGen a party to the Customer's cardholder-data obligations, including any obligation arising under the Payment Card Industry Data Security Standard, and NextGen makes no representation that any configuration of the Services is PCI DSS compliant.

1.7 Frequency of processing. Continuous, for the term of the Underlying Agreement, as determined by the Customer's use of the Services.

1.8 Retention. Customer Personal Data is retained for the term of the Underlying Agreement and deleted or returned under clause 12, subject to clauses 12.3 and 12.4.

1.9 Automated decision-making. The Services may perform automated processing and scoring (for example engagement scoring, lead classification and segmentation). Where the Customer uses the AI features or these functions to make decisions that have a legal effect or similarly significantly affect an individual, or that are decisions of a kind referred to in APP 1.7, the Customer is the decision-maker and is responsible for the human review, for the lawful basis, and for the disclosures required by Article 22 GDPR and APP 1.7.

---

SCHEDULE 2 — TECHNICAL AND ORGANISATIONAL MEASURES

2.1 NextGen shall implement and maintain at least the following measures, which may be updated under clause 16.2 provided the overall level of protection is not reduced.

2.2 Encrypted fields as at the Effective Date. Application-level encryption (AES-256-GCM) is applied to the following, and to no other fields:

Not encrypted: free-text notes, messages and conversation content, ticket descriptions and comments, form submissions, call logs and recordings, and any contact field that is not flagged as encrypted. An inaccurate statement here is a representation, so this list is deliberately exhaustive: if it is not in the table above, it is not encrypted.

2.2A Key rotation. DEK rotation is performed as a documented manual key ceremony, at least annually, using a maintenance window and a current verified backup, and is recorded in NextGen's key rotation log. Rotation is also performed on suspicion of compromise and on account deletion (cryptographic erasure).

---

SCHEDULE 3 — AUTHORISED SUB-PROCESSORS

3.1 The following Sub-processors are authorised as at the Effective Date. NextGen shall update this Schedule in accordance with clause 7.3. Every row is supported by a written contract imposing the obligations required by clause 7.4; the contract reference is available to the Customer on request.

3.2 Self-operated components. The following are operated by NextGen on infrastructure located in the region the Customer selects, and are not Sub-processors: the database engine; the queue and state store; secrets and key management; the global router and its regional replicas (see clause 10.8); the mail transfer agent (self-hosted, used for inbound and outbound email on NextGen's own infrastructure); and the Android SMS and WhatsApp messaging bridge (operated by NextGen on its own server, which transmits and briefly holds message content to deliver it through those channels); together with TLS termination.

3.3 The following are not Sub-processors of NextGen for the purposes of this Agreement:

• Payment processors and payment service providers, including Stripe, PayPal, GoCardless, NMI and Authorize.Net. The Customer connects its own account with each provider under the Customer's own agreement with that provider, and NextGen connects to it only on the Customer's instruction. Where NextGen itself processes payment data as a controller — for example in billing the Customer for the Services or operating the Customer's prepaid wallet — that processing is governed by the NextGen Privacy Policy, not by this Agreement. Payment records must not be used to carry Sensitive Data.
• Third-party integrations that the Customer chooses to enable, including Meta (Facebook, Instagram, WhatsApp), Slack, Telegram, Google services, YouTube, Gmail, Google Business Profile, GoHighLevel, social or advertising providers, messaging providers the Customer connects with its own credentials (including Twilio and TextGrid), and email delivery services the Customer connects with its own credentials (including SendGrid and Mailgun). These are engaged by the Customer under the Customer's own agreement with the provider, and the Customer is the controller of any transfer to them. Where the Customer enables a Meta Conversions API integration, the Customer's own pixel and access token are used and the Customer determines what is sent.
• Any third-party service that the Customer connects through an outbound webhook, API call or export.

These exclusions are substantive, not formal. Where the Customer connects its own integration — for example by adding its own Twilio or TextGrid messaging connection, its own SendGrid or Mailgun email connection, or any other third-party product — that processing is outside this Agreement: NextGen is not the processor or sub-processor for it, gives no warranty about it, and its security, retention, location and onward transfers are matters between the Customer and that provider (clause 2.8). NextGen's own messaging and voice transmission is provided through the Sub-processors listed in paragraph 3.1, which as at the Effective Date means Telnyx, and the self-operated messaging bridge in paragraph 3.2.

3.4 NextGen shall verify, before engaging a Sub-processor, that the Sub-processor is able to meet the obligations in clause 7.4, and shall record that assessment.

3.5 Where a Sub-processor processes Customer Personal Data in a country outside the EEA, NextGen shall ensure the applicable transfer mechanism in clause 10.2 is in place before processing begins.

---

SCHEDULE 4 — INTERNATIONAL TRANSFERS

4.1 Incorporation of the Standard Contractual Clauses. For each Restricted Transfer, the Standard Contractual Clauses are incorporated into and form part of this Agreement as follows:

• (i) Where the Customer is a controller and NextGen is its processor, the Standard Contractual Clauses, Module Two (controller to processor), apply.
• (ii) Where the Customer is itself a processor (clause 2.2) and NextGen acts as its sub-processor, the Standard Contractual Clauses, Module Three (processor to processor), apply.
• (iii) Where NextGen makes an onward transfer to a Sub-processor, the Standard Contractual Clauses apply with the docking clause in Clause 7 in operation, so that the Sub-processor accedes as an importer for the benefit of the Customer.

The completed clauses are:

• (a) Clause 7 (docking clause) applies.
• (b) Clause 9 applies, with Option 2 (general written authorisation) selected for Sub-processors, subject to clause 7.3 of this Agreement.
• (c) Clause 11 applies, and the optional independent dispute resolution language does not apply.
• (d) Clause 13 applies; the supervisory authority is the supervisory authority of the Member State in which the Customer is established, or, where the Customer is not established in the European Economic Area, the supervisory authority of the Member State in which the Customer's representative (or, where the Customer has none, NextGen's Article 27 representative) is established.
• (e) Clause 17 applies; the governing law is the law of the Member State whose supervisory authority is selected at (d).
• (f) Clause 18(b) applies; the courts are those of the Member State selected at (d).
• (g) Annex I is completed by Schedule 1.
• (h) Annex II is completed by Schedule 2.
• (i) Annex III is completed by Schedule 3.

4.1A Transfers to the United Kingdom. The Processor for every Customer outside the United States — including Customers in the EEA, the UK and Australia — is NextGen OS LLP, which is established in the United Kingdom. Transfers from the EEA to the United Kingdom are currently permitted under the European Commission's adequacy decision for the United Kingdom, so they are not Restricted Transfers. If that adequacy decision lapses, is suspended or is repealed, then for so long as the United Kingdom is not the subject of an adequacy decision, (a) a transfer of Customer Personal Data from the Customer to NextGen, and (b) any remote access by NextGen to Customer Personal Data held in the European region, are Restricted Transfers to which the Standard Contractual Clauses, Module Two or Module Three as applicable, apply by this paragraph 4.1A without further action by the Parties, and NextGen shall notify the Customer promptly.

4.2 UK transfers. For Restricted Transfers subject to the UK GDPR, the UK Addendum is incorporated into and forms part of this Agreement, completed as follows: Tables 1, 2 and 3 are completed with the information in this Agreement, Schedule 1, Schedule 2 and Schedule 3; the start date is the Effective Date; and the Importer and Exporter are as set out in this Agreement. Where the UK Addendum applies, references to the GDPR are read as references to the UK GDPR.

4.3 Switzerland is outside the scope of this Agreement. This Agreement does not cover Customer Personal Data subject to the Swiss Federal Act on Data Protection. NextGen does not offer the Services to Customers established in Switzerland, and the Standard Contractual Clauses as incorporated by this Schedule are not completed for a Swiss transfer. If NextGen begins offering the Services in Switzerland, it will appoint a representative in Switzerland and amend this Agreement before onboarding any such Customer.

4.4 Government access and transfer impact assessments. NextGen shall inform the Customer if it becomes subject to a legally binding request under the laws of a third country for disclosure of Customer Personal Data, and shall challenge the request where there are reasonable grounds to do so, as set out in clause 10.5. Where required, NextGen shall document a transfer impact assessment for each Restricted Transfer and provide it to the Customer on request.

---

SCHEDULE 5 — NOTICES AND CONTACTS

5.1 The Parties shall notify each other promptly of any change to the contacts above.

5.1A Escalation route. The out-of-hours route for both Parties is email, using the addresses above. For a Personal Data Breach or a suspected Eligible Data Breach, the Customer should mark the subject line "URGENT — data protection" so that it is triaged ahead of general correspondence. NextGen may supplement the email route with a telephone number by notice under clause 5.1, but an email to the address above is sufficient to start the notification period in clause 11.1.

5.2 Article 27 representative — the position, and what is required. NextGen OS LLP is established in the United Kingdom and is not established in the European Union. For processing subject to the GDPR it must therefore designate in writing a representative in a Member State in which the Data Subjects whose Personal Data it processes are located (Article 27(1) and (3) GDPR). The representative must be a natural or legal person established in the Union; a UK- or US-based person cannot hold the role. The representative's identity and contact details must be recorded in this Schedule and published in the NextGen Privacy Policy.

The Article 27(2) exemption does not apply here: it requires the processing to be occasional and not to involve large-scale monitoring or large-scale special-category data, and a hosted platform that continuously processes its Customers' contact and communication data for the life of the subscription is not "occasional" processing.

5.2A Article 27 representative. The Processor has appointed Andrew Hewerdine (legal@mail.thenextgencrm.com) as its representative for the purposes of Article 27 GDPR, and he is established in a Member State of the European Union; the requirements of paragraph 5.2 are therefore met. His identity and contact details are recorded in this Schedule and published in the NextGen Privacy Policy. The Processor will keep the appointment under review and will replace the representative without undue delay if he ceases to be established in the Union, notifying Customers under paragraph 5.1. Where the representative receives a communication from a Data Subject or a Supervisory Authority, the Processor shall respond to it without undue delay.

---

SCHEDULE 6 — JURISDICTION-SPECIFIC PROVISIONS

6.1 United Kingdom. Where Customer Personal Data is processed in connection with the UK GDPR, references to the GDPR in this Agreement are read as references to the UK GDPR, references to a Supervisory Authority include the Information Commissioner's Office, and the UK Addendum in paragraph 4.2 applies to Restricted Transfers.

6.2 United States state privacy laws. Clause 16.8 applies. NextGen does not sell or share Customer Personal Data, does not use it for cross-context behavioural advertising, and does not combine it with personal data from other sources except as permitted for a service provider under applicable law.

6.4 Australia. Where Customer Personal Data is processed in connection with Australian Privacy Law, Schedule 7 applies. Nothing in this Agreement limits the operation of the Privacy Act 1988 (Cth), and the Customer's obligations as an APP entity are not displaced by this Agreement.

6.5 Controller-to-controller processing. Where NextGen processes Personal Data as a controller or independent controller (for example account registration, billing, support and security data that NextGen determines the purposes of), that processing is governed by the NextGen Privacy Policy and not by this Agreement.

---

SCHEDULE 7 — AUSTRALIA

7.1 Application. This Schedule applies where the Customer is established in Australia, or where the processing is otherwise subject to the Privacy Act 1988 (Cth).

7.2 Roles. For the purposes of Australian Privacy Law, the Customer is the APP entity responsible for the Personal Information it submits to the Services, and NextGen processes that Personal Information on the Customer's behalf as its service provider. NextGen acknowledges that the Customer remains accountable for the acts and practices of NextGen and its Sub-processors in relation to the Personal Information, and shall do what is reasonably necessary to enable the Customer to meet its obligations under the APPs.

7.3 Overseas disclosure — APP 8. Before NextGen discloses Personal Information to an overseas recipient (including a Sub-processor, a NextGen Group entity, or another regional deployment of the Services), NextGen shall take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs (other than APP 1) in relation to that Personal Information. Those steps include:

• (a) the written contractual obligations in clause 7.4, which include obligations materially the same as, or stricter than, the APPs as they apply to the Personal Information;
• (b) the technical and organisational measures in Schedule 2, including encryption of the fields listed in paragraph 2.2 and encryption in transit;
• (c) ensuring that an overseas recipient of Personal Information processed in the Australian region is itself subject to a law or binding scheme that provides protection substantially similar to the APPs, or is bound by contract as described in (a); and
• (d) recording the assessment that the steps taken are reasonable for each disclosure.

NextGen acknowledges that Australia has no list of approved countries and that a recipient being in a jurisdiction with a GDPR-style law does not by itself satisfy APP 8.1; the basis relied on is therefore the contractual steps in (a) and (b), supported by the assessment in (d), and sub-paragraph (c) is a supporting factor rather than the basis. Where NextGen discloses Personal Information that it holds in the Australian region to a NextGen Group entity or to another regional deployment of the Services — including through the customer-initiated transfers described in clause 10.7 — the same steps and the same assessment apply, and NextGen remains accountable under section 16C of the Privacy Act for a breach by that recipient as if NextGen had committed it.

7.4 Obligations imposed on overseas recipients. NextGen shall require each overseas recipient to which it discloses Personal Information to: process it only for the purposes of providing the Services and in accordance with the Customer's documented instructions; protect it in a manner consistent with the APPs; restrict onward disclosure; cooperate with the Customer and the OAIC; and notify NextGen of any eligible or suspected Eligible Data Breach affecting it, without undue delay and in any event within the period in clause 11.1.

7.5 APP 1.4(e) transparency. NextGen shall maintain the list of countries in which overseas recipients are likely to be located, shall make it available to the Customer in Schedule 3 and on the sub-processor notice page, and shall notify the Customer promptly of any change so that the Customer can update its own privacy policy and APP 1.4(e) disclosures. Where the Customer uses the Services to disclose Personal Information to a third party it connects itself, the Customer is responsible for that disclosure and for its own APP 8 and APP 1.4(e) compliance.

7.6 APP 11 security. The technical and organisational measures in Schedule 2 are the measures NextGen takes to give effect to the Customer's obligations under APP 11.1. Where NextGen provides a service that will hold Personal Information and it becomes aware that a destruction or de-identification obligation applies under APP 11.2, it shall comply with clause 12.

7.7 APP 12 and APP 13 — access and correction. NextGen shall provide in-product functionality and documented procedures (Schedule 2, paragraph 2.1) to enable the Customer to access, correct, export and delete Personal Information without needing to request NextGen's assistance, and shall respond to a request for assistance under clause 8.3 within five (5) business days. Where NextGen receives an APP 12 or APP 13 request directly from an individual, clause 8.2 applies, and NextGen shall forward the request to the Customer within five (5) business days.

7.8 APP 1.7 — automated decision-making transparency. NextGen shall provide the Customer with the information the Customer needs in order to disclose, in its own privacy policy, any automated decision-making the Customer uses that has a significant effect on an individual and the kinds of Personal Information used. The facilities that perform automated processing are described in Schedule 1, paragraph 1.9, and Schedule 8.

7.9 Notifiable Data Breaches. If NextGen becomes aware of an actual or suspected Eligible Data Breach affecting Personal Information it processes under this Agreement, it shall notify the Customer in accordance with clause 11.1 and shall provide the information the Customer requires to conduct the assessment required by Part IIIC of the Privacy Act 1988 (Cth) and, where there are reasonable grounds to believe an Eligible Data Breach has occurred, to prepare the statement and notify the OAIC and affected individuals. NextGen shall cooperate with the assessment for the full thirty (30) day period permitted by that Part, and shall not take steps that would prevent the Customer from meeting its obligations under it.

7.10 Children. Where the Customer collects Personal Information about a child, the Customer is responsible for obtaining any consent required under Australian Privacy Law and for complying with the Children's Online Privacy Code once registered. NextGen shall provide reasonable assistance and shall not use the AI features to interact directly with a child unless the Customer has taken the steps it considers necessary. NextGen shall not knowingly use the Services to collect Personal Information directly from a child as a controller.

7.11 Direct marketing, telemarketing and spam. Where Personal Information is used for direct marketing, the Customer is responsible for compliance with the following, and the Services are provided on that basis:

• (a) Electronic messages — the Spam Act 2003 (Cth) and APP 7. The Customer must obtain and record consent, clearly identify the sender, and provide a functional unsubscribe facility that is honoured within 5 business days. The Services provide unsubscribe functionality and consent recording; the Customer must keep unsubscribe enabled for marketing communications and must not use the platform to send unsolicited commercial electronic messages.
• (b) Voice calls — the Do Not Call Register Act 2006 (Cth) and the Telemarketing and Research Calls Industry Standard 2017. The Customer must wash its calling lists against the Do Not Call Register before a campaign (and at least every 30 days), observe the permitted calling times (Monday to Friday 9am–8pm and Saturday 9am–5pm, and not on Sundays or national public holidays), identify the caller and the purpose of the call, and cease calling a number on request. The Customer must not use the Services to make an unsolicited telemarketing call to a number on the Do Not Call Register without consent.
• (c) APP 7, including the source of the information. Where Personal Information was obtained from a third party, the Customer is responsible for satisfying itself that the consents and notices it relies on were given.

The Customer must ensure that consent is recorded at the level of the individual, the channel and the purpose, that opt-outs are honoured across the relevant channels, and that any suppression it configures is applied. NextGen provides the tooling for consent recording, suppression and unsubscribe handling, but does not determine the Customer's marketing purposes and does not verify the Customer's consent. Where NextGen markets its own services to an individual, that is NextGen's own obligation and is outside this Agreement.

7.12 Correction of factual errors and the statutory tort. Nothing in this Agreement limits the Customer's or an individual's rights under the statutory tort for serious invasions of privacy, or under any other provision of the Privacy Act 1988 (Cth) as amended. NextGen shall cooperate reasonably with the Customer in responding to a complaint made to the OAIC or to the Australian Information Commissioner.

---

SCHEDULE 8 — ARTIFICIAL INTELLIGENCE

8.1 Purpose. This Schedule records how responsibility for the artificial-intelligence features of the Services is allocated, and the transparency measures NextGen implements under clause 6.

8.2 Roles. NextGen builds and provides the AI features and makes them available to the Customer. The Customer decides which AI features to enable, the instructions, prompts and data it supplies, the actions the AI features are permitted to take on its behalf, and what it does with the output. In AI Act terms, the Customer is responsible as a deployer of the AI features it uses, and NextGen is responsible for the properties of the features it provides and for the transparency measures in paragraph 8.3.

8.3 Transparency measures.

8.4 Data used by AI features.

• (a) Inference is performed by the Sub-processors in Schedule 3. The primary text-inference Sub-processor operates under contractual zero data retention.
• (b) Customer Personal Data is not used to train, fine-tune or improve any model (clause 2.5(c) and clause 6.2).
• (c) The Customer is responsible for the data it submits to the AI features, and must not submit Sensitive Data, or the personal data of children, to an AI feature unless clause 1.6 permits it and the Customer has taken the steps it considers necessary.

8.5 Knowledge-base and retrieval. Where a Customer enables AI features over its own content (for example a knowledge base or site content), that content is retrieved and supplied to the model in order to answer the query, and is not used for training or retained by the inference Sub-processor beyond the response, consistent with paragraph 8.4(a).

8.6 No prohibited or high-risk use. NextGen does not design or market the AI features for a purpose prohibited by Article 5 of the AI Act, or for emotion recognition or biometric categorisation in the workplace or in education (clause 6.7). The Customer shall not use the Services for those purposes.

8.7 Changes. NextGen shall notify the Customer under clause 16.2 of a material change to the AI features that affects the measures in this Schedule or a Customer's compliance position.

---

CHANGE LOG