ScanLead Data Processing Agreement (DPA)

Version dated 13 October 2026.

Preamble

This Data Processing Agreement (the "DPA") supplements the ScanLead Terms of Service (the "Terms") and applies as a matter of law whenever the User (the "Customer") uses the Service to process personal data of third parties (for example, trade show visitors whose contact details are captured).

In the event of a conflict between this DPA and the Terms regarding the processing of personal data, this DPA shall prevail.

This DPA is intended to implement the requirements of Article 28 of the General Data Protection Regulation 2016/679 ("GDPR").

1. Parties

• The Customer: natural or legal person holding a ScanLead account, acting as controller within the meaning of Article 4(7) GDPR.
• The Processor: Quantum Liquid LLC, a Wyoming Limited Liability Company, with its registered office at 30 N Gould St, Sheridan, WY 82801, United States of America, operating the ScanLead Service, acting as processor within the meaning of Article 4(8) GDPR.

2. Subject matter, duration, nature, and purpose of processing

2.1 Subject matter

The Processor processes personal data on behalf of the Customer solely for the purpose of providing the ScanLead Service, as defined in the Terms.

2.2 Duration

This DPA takes effect on the date the Customer accepts the Terms and remains in force for the entire duration of the Subscription, plus the return and deletion periods provided for in Section 11.

2.3 Nature of processing

Collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, communication by transmission, restriction, erasure, backup.

2.4 Purpose

To enable the Customer to capture, store, organize, export, and sync to its third-party tools (CRM, spreadsheets) contact data provided by natural persons met at trade shows.

3. Categories of data and categories of data subjects

3.1 Categories of data

• First name, last name.
• Company and job title.
• Business email address.
• Business phone number.
• Free-form notes entered by the Customer.
• Photographs of business cards.
• Timestamp and location (name of the trade show) of the capture.

No special category of data within the meaning of Article 9 GDPR is processed. The Customer undertakes not to introduce such categories into the Service.

3.2 Categories of data subjects

• Visitors and exhibitors at trade shows.
• Business contacts whose details are provided to the Customer in a commercial or institutional context.

4. Obligations of the Processor

In accordance with Article 28(3) GDPR, the Processor undertakes to:

4.1 Documented instructions

Process personal data only on documented instructions from the Customer, including with regard to transfers to third countries. The Terms, account settings, use of the interface, and formal requests sent to support@scanlead.io constitute documented instructions. If an instruction, in the Processor's opinion, constitutes an infringement of the GDPR or other Union or Member State data protection provisions, the Processor shall immediately inform the Customer.

4.2 Confidentiality

Ensure that persons authorized to process the data are subject to a duty of confidentiality (contractual or statutory) and receive the necessary training.

4.3 Security

Implement the technical and organizational measures described in Annex II, in accordance with Article 32 GDPR.

4.4 Sub-processors

Engage sub-processors only under the conditions of Section 5 of this DPA.

4.5 Assistance to the Customer

Assist the Customer, by appropriate technical and organizational measures, in:

• Responding to requests for the exercise of data subjects' rights (Articles 15 to 22 GDPR).
• Complying with security obligations, breach notifications, impact assessments, and prior consultations (Articles 32 to 36 GDPR).

4.6 Breach notification

Notify the Customer of any personal data breach without undue delay, and no later than 72 hours after becoming aware of it, providing all relevant information to enable the Customer to comply, where applicable, with its own notification obligations to supervisory authorities and data subjects.

4.7 Return or deletion

At the end of the service, return or delete the data in accordance with Section 11 of this DPA.

4.8 Documentation and audits

Make available to the Customer all information necessary to demonstrate compliance with the obligations of Article 28 GDPR, and allow for audits under the conditions of Section 8 of this DPA.

5. Sub-processors

5.1 General authorization

The Customer authorizes the Processor to engage the sub-processors listed in Annex I.

5.2 New sub-processors

Any material change to the list (addition or replacement) shall be notified to the Customer at least 30 days before implementation. The Customer has 30 days to object on legitimate and reasonable grounds. In the event of objection, the Processor may propose an alternative, failing which the Customer may terminate its Subscription.

5.3 Obligations imposed on sub-processors

The Processor shall enter into a written contract with each sub-processor imposing data protection obligations equivalent to those of this DPA. The Processor remains fully liable for the performance by the sub-processor of its obligations.

6. Data subject rights

The Processor makes available to the Customer functionalities enabling responses to data subjects' requests: access, rectification, erasure, portability, restriction, objection, and in particular enables the export or deletion of a Lead from the interface.

Where a data subject contacts the Processor directly, the Processor shall forward the request to the Customer without undue delay and shall not respond itself save on contrary instruction.

7. International transfers

7.1 Primary hosting

The application is hosted by Vercel: it runs in Frankfurt (Germany), and pages and static files are delivered through its global network. The main database (accounts, trade shows, Leads) is hosted by Neon in Frankfurt (Germany). Account authentication and the daily database backups are hosted at Supabase, in the European Union, in Paris (France).

7.2 Transfers to the United States

The Processor is established in the United States. Data processed by the Processor itself (for support or administration purposes) and by certain sub-processors (Vercel, Neon, Stripe, Resend, PostHog) is transferred under the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 of 4 June 2021, Module 2 (controller to processor) or Module 3 (processor to processor), incorporated by reference into this DPA.

The following options are deemed selected in the SCCs:

• Clause 7 (docking clause): applicable.
• Clause 9: Option 2 (general authorization) with a 30-day notice period.
• Clause 11: dispute resolution mechanism by a European supervisory authority and court, without arbitration.
• Clause 17: applicable law of the Republic of Ireland.
• Clause 18: jurisdiction of the courts of Ireland.
• Annex I.A: Customer as exporter, Processor as importer.
• Annex I.B: see Sections 2 and 3 of this DPA.
• Annex II: see Annex II of this DPA.
• Annex III: sub-processors listed in Annex I of this DPA.

A Transfer Impact Assessment is available on request at support@scanlead.io.

8. Audit

The Customer may, once per twelve-month period, at its own expense and upon reasonable notice of at least 30 days, conduct or have conducted by an independent third party bound by confidentiality an audit to verify the Processor's compliance with the obligations of this DPA.

The Processor may satisfy its obligation by providing recognized audit reports or certifications (SOC 2, ISO 27001) obtained in respect of its own sub-processors or its own information system.

Any on-site audit shall not disrupt the Processor's operations. The specific arrangements (scope, schedule, auditor) shall be agreed between the Parties in advance. Competent supervisory authorities have a direct right of access within the limits of the GDPR.

9. Liability

Liability of the Processor under this DPA is governed by the provisions of Section 10 of the Terms, without the limitations set forth therein affecting the joint and several liability provided for in Article 82 GDPR vis-a-vis data subjects.

10. Term and termination

This DPA remains in force as long as the Processor processes personal data on behalf of the Customer. It terminates automatically at the end of the contractual relationship, without prejudice to the obligations of return and deletion.

11. Return or deletion at the end of the service

At the end of the service, namely the closure of the Customer's account, the Processor:

• Makes available for 30 days an export functionality in CSV and XLSX format allowing the Customer to retrieve all its data.
• Permanently deletes the data at the end of this period, together with backups within an additional maximum period of 30 days, save for legal retention obligations.
• Provides on request a certificate of deletion.

12. Notices

Any notice under this DPA is sent to support@scanlead.io for the Processor, and to the email address associated with the account for the Customer.

13. Governing law and jurisdiction

The provisions of the Terms relating to governing law and jurisdiction apply to this DPA. The Standard Contractual Clauses retain their own regime.

Annex I: authorized sub-processors

Annex II: technical and organizational security measures

II.1 Confidentiality

• Encryption of data in transit (TLS 1.2 minimum) and at rest (AES-256).
• Data isolation between Workspaces via Row Level Security in Postgres.
• Two-factor authentication available for all accounts.
• Strict password policy, passwords stored as salted hashes.
• Role-based access control for Processor personnel.
• Written confidentiality commitments for any person with access to the data.

II.2 Integrity

• Application-level integrity controls and logging.
• Mandatory code reviews before production release.
• Test environments isolated from production.

II.3 Availability and resilience

• One full database backup every day, compressed, kept for 30 days in private storage at Supabase (Paris), then deleted.
• Redundancy of hosting infrastructure.
• Documented disaster recovery plan, RTO target of 24 hours.

II.4 Resilience and testing procedures

• Annual penetration tests.
• Continuous vulnerability scanning.

II.5 Incident management

• Documented incident response procedure.
• Technical on-call rotation.
• Communication to the Customer within a maximum of 72 hours in the event of a breach.

II.6 Governance

• Records of processing activities in accordance with Article 30(2) GDPR.
• Internal data protection policy.
• Regular staff training.