Data Processing Addendum

1. Definitions

Capitalised terms not defined here have the meanings in the Terms or in the GDPR. "GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as incorporated into UK law; "Data Protection Laws" means the GDPR, UK GDPR, and any other applicable data protection laws.

2. Roles of the parties

For the processing described in Annex 1, Customer acts as Controller and Persephone acts as Processor. Each party complies with its obligations under Data Protection Laws.

This DPA does not address Persephone's processing of personal data as a Controller in its own right (such as processing of investor enrichment data sourced from licensed providers), which is addressed in the Privacy Policy.

3. Processing instructions

Persephone processes Customer Personal Data only on documented instructions from the Customer (including the Terms and this DPA), except where required by applicable law. Persephone informs the Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Confidentiality

Persephone ensures personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations.

5. Security measures

Persephone implements appropriate technical and organisational measures (Annex 2) to ensure a level of security appropriate to the risk.

6. Sub-processors

Customer grants Persephone a general authorisation to engage sub-processors. A current list (Annex 3) is available on request. Persephone:

• Imposes data protection obligations on each sub-processor materially equivalent to those in this DPA;
• Remains liable to the Customer for the acts and omissions of its sub-processors;
• Notifies the Customer of any intended addition or replacement at least 30 days in advance, allowing reasonable objection.

7. Data subject rights

Persephone assists the Customer, by appropriate technical and organisational measures and insofar as possible, in fulfilling its obligation to respond to data subject requests.

8. Personal data breach

Persephone notifies the Customer without undue delay (and within 72 hours) after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing reasonable information to enable the Customer to meet its obligations under Articles 33–34 GDPR.

9. Data Protection Impact Assessments

Persephone provides reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities required under Articles 35–36 GDPR.

10. International transfers

Where Persephone or its sub-processors transfer Customer Personal Data outside the EEA or UK, the parties rely on the European Commission Standard Contractual Clauses (Module 2 or 3 as applicable), and the UK International Data Transfer Addendum where applicable, incorporated by reference.

11. Audit

Persephone makes available all information reasonably necessary to demonstrate compliance with this DPA. Customer may, no more than once per year and on at least 30 days' written notice, conduct an audit (or appoint a qualified independent auditor), subject to reasonable confidentiality and security restrictions. Persephone may satisfy this obligation by providing third-party audit reports (e.g., SOC 2, ISO 27001) where available.

12. Return or deletion

Upon termination or expiry of the Terms, Persephone, at the Customer's choice, deletes or returns all Customer Personal Data, unless retention is required by applicable law.

13. Liability

Liability under this DPA is subject to the limitations of liability in the Terms.

14. Order of precedence

In case of conflict between this DPA and the Terms, this DPA prevails on data protection matters.

Annex 1 — Description of processing

Subject matter: provision of the Persephone investor intelligence platform.
Duration: for the term of the Terms.
Nature and purpose: hosting, processing, and analysis of Customer-provided data and Customer-connected third-party account data to deliver the Service.
Categories of data subjects: Customer's personnel; investors and contacts identified by the Customer; the Customer's network connections accessed via Customer-authorised integrations.
Categories of personal data: names, business contact details, professional information, communication content drafted or sent through the Service, engagement data.

Annex 2 — Technical and organisational measures

Persephone implements measures including: encryption of data in transit (TLS) and at rest; role-based access controls; least-privilege principle; logging and monitoring; vendor due diligence and contractual safeguards; secure development practices; incident response procedures; periodic review of measures.

Annex 3 — Sub-processors

Current sub-processors include: Supabase (database & hosting), Stripe (payments), Lovable AI Gateway (AI), Instantly.ai (email outreach), PostHog (analytics). Updated list available on request.