Data processing agreement

• Controller: the Customer that instructs SUUS to process personal data.
• Processor: SUUS IQ B.V., established in Amsterdam, Chamber of Commerce (KvK) 42050357, VAT identification number NL869478783B01.
• Personal Data: any information relating to an identified or identifiable natural person as referred to in Article 4 GDPR.
• Processing: any operation performed on personal data as defined in Article 4(2) GDPR.
• Data Subject: the natural person to whom the personal data relates.
• Personal data breach: a breach of security leading to the destruction, loss, alteration or unauthorised disclosure of, or access to, personal data.

SUUS processes personal data solely for the purpose of providing the Field Sales Intelligence System as described in the Terms and Conditions. The processing comprises:

• Categories of data subjects: customers, prospects and business contacts of the Controller
• Categories of personal data: name, job title, e-mail address, telephone number, company name, visit history, call notes, voice transcriptions
• Nature of the processing: storage, structuring, consultation, alteration, erasure
• Purpose: maintaining a CRM system and automating field sales workflows

The DPA runs in parallel with the underlying service agreement and terminates automatically upon termination thereof.

SUUS undertakes the following:

• To process personal data only on documented instructions from the Controller, unless required to do so by a legal obligation.
• To ensure that persons authorised to process personal data have committed themselves to confidentiality.
• To take appropriate technical and organisational measures to secure personal data in accordance with Article 32 GDPR.
• To engage other processors (Sub-processors) only as provided in Article 6.
• To assist the Controller in fulfilling its obligations with respect to the rights of data subjects.
• To provide on request all information necessary to demonstrate compliance with the obligations under the GDPR.
• After the end of the provision of services, at the choice of the Controller, to erase or return all personal data and to delete existing copies, unless a statutory retention obligation applies. Return takes place in a machine-readable format (JSON, files in their original format) via a secure download link; the data remains available for retrieval for at least 30 days. SUUS then erases it, back-ups expire within seven days, and SUUS confirms the erasure by e-mail. See the page Switching and export.

SUUS implements appropriate technical and organisational measures, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256)
• Role-based access control and the “need-to-know” principle; data of different customers is segregated per organisation
• Two-factor authentication for administrator access to the application and systems
• Daily automatic back-ups of the database, retained for seven days
• An audit log of significant operations, such as data exports
• Timely application of security updates to the software used

In the event of a personal data breach, SUUS informs the Controller without undue delay and no later than 24 hours after discovery. The notification contains at least:

• The nature of the breach, including the categories and approximate number of data subjects and personal data records
• The name and contact details of the data protection officer or contact person
• The likely consequences of the breach
• The measures taken or proposed to be taken

SUUS provides all cooperation necessary for notification to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).

The Controller gives SUUS general written authorisation to engage Sub-processors, subject to the conditions of this Article. SUUS engages the following Sub-processors (as at 13 oktober 2026):

• Supabase, Supabase Pte. Ltd. (Singapore) — Database, sign-in and file storage. Location: EU (Ireland, AWS eu-west-1).
• Vercel, Vercel Inc. (VS) — Hosting of the app and the API. Location: Servers in the EU (Frankfurt); Vercel also processes in the US.
• Upstash, Upstash, Inc. (VS) — Temporary storage: cache, rate limiting and the state of ongoing conversations. Location: EU (Frankfurt, AWS eu-central-1).
• Trigger.dev, API Hero Ltd, handelend als Trigger.dev (VK) — Background jobs: enrichment, summaries, synchronisation and daily overviews. Location: Execution in the EU (Frankfurt); job data and logs in the US (AWS us-east-1).
• Sentry, Functional Software, Inc., handelend als Sentry (VS) — Error reporting and performance monitoring. Location: EU (Germany); account and organisation data in the US.
• Resend, Plus Five Five, Inc., handelend als Resend (VS) — Transactional email: invitations, notifications, daily overviews and contracts. Location: Sent from the EU (Ireland); stored in the US.
• LiveKit Cloud, LiveKit Incorporated (VS) — Audio connection for voice calls and hosting of the voice agent. Location: Voice agent in the EU (Frankfurt); live audio via the nearest LiveKit server (in the EU for users in the Netherlands and Belgium); session data and logs in the US. LiveKit does not store call recordings or transcripts.
• Deepgram, Deepgram, Inc. (VS) — Real-time speech recognition during voice calls. Location: EU (Deepgram's EU endpoint).
• Speechmatics, Cantab Research Ltd, handelend als Speechmatics (VK) — Speech recognition of company names during voice calls. Location: EU (EU1 endpoint, processing within the EEA).
• OpenAI, OpenAI Ireland Ltd. (Ierland) — AI processing: understanding, summarising and transcribing conversations, and assistant replies. Location: US.
• Cartesia, Cartesia AI, Inc. (VS) — The voice of the voice agent (text to speech). Location: US.
• Nylas, Nylas, Inc. (VS) — Calendar integration with Google Workspace and Microsoft 365. Location: United Kingdom (London).
• Meta (WhatsApp Business Platform), WhatsApp Ireland Limited (Ierland) — WhatsApp messages with leads and feedback on the outcome of lead requests. Location: EU (Ireland) and US.
• Apify, Apify Technologies s.r.o. (Tsjechië) — Collecting signals from public sources, with scrapers the customer selects. Location: US (Amazon Web Services and MongoDB Atlas).
• Higgsfield, Higgsfield Inc. (VS) — Creating ad images for lead gen campaigns. Location: US.
• Twilio, Twilio Ireland Limited (Ierland) — Phone line of the voice assistant (inbound and outbound calls), SMS verification (sign-in codes), SMS to leads and WhatsApp reminders. Location: US.
• Google Workspace, Google Cloud EMEA Limited (Ierland) — Business email and documents of SUUS IQ: support and contracts. Location: Worldwide (Google's data centres).
• Anthropic, Anthropic Ireland, Limited (Ierland) — AI assistance (Claude) for support and error analysis. Location: US.

The current overview is on our sub-processors page, listing for each Sub-processor the data and the location and, once concluded, the data processing agreement and the legal basis for transfer outside the EEA.

SUUS imposes on each Sub-processor, in writing, substantially the same obligations as those in this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. SUUS remains liable to the Controller for their performance, subject to Article 10.

If SUUS wishes to add or replace a Sub-processor, SUUS notifies the Controller at least 14 days in advance by e-mail and on the sub-processors page. Within those 14 days the Controller may object, stating its reasons, via info@suusiq.com. SUUS will then seek a solution in good faith. If no solution is found before the effective date, the Controller may terminate the contract free of charge as of that date; any amount paid in advance for the period thereafter is refunded by SUUS pro rata.

The sub-processors engaged by SUUS's own Sub-processors are not subject to the 14-day period. They are disclosed in accordance with the respective Sub-processor's own data processing agreement.

Personal data may be transferred to countries outside the European Economic Area (EEA). SUUS ensures that any such transfer takes place on the basis of an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework and the decision for the United Kingdom), standard contractual clauses (Implementing Decision (EU) 2021/914) or binding corporate rules (BCR). The legal basis for each Sub-processor is listed on the sub-processors page.

Upon a request from a Data Subject (access, rectification, erasure, restriction, portability or objection), SUUS informs the Controller in a timely manner and provides technical assistance to comply with the request. SUUS does not act independently on requests from data subjects, unless required to do so by law.

The Controller has the right to verify compliance with this DPA by means of an audit, carried out by an independent auditor bound by a duty of confidentiality. Such an audit takes place no more than once a year, after at least 30 days' written notice, and at the expense of the Controller.

SUUS may satisfy the audit obligation by submitting valid certifications (ISO 27001, SOC 2 or equivalent).

Each party is liable for damage suffered by the other party or by data subjects as a result of non-compliance with this DPA. The liability of SUUS as Processor is limited to the amount paid by the Customer in the twelve months preceding the event giving rise to the damage, with the same amount as the maximum per calendar year, as set out in Article 13 of the terms and conditions. The limitation does not apply in the event of intent or gross negligence on the part of SUUS or its management.

This DPA is governed by the laws of the Netherlands. Disputes shall be submitted exclusively to the competent court in Amsterdam.

This DPA enters into force automatically upon acceptance of the Terms and Conditions of SUUS. Organisations that require a signed version may contact us via info@suusiq.com. We will then send a copy to be signed by both parties.