Data Processing Agreement

Revised October 12, 2026 | Effective date: October 12, 2026

1. Incorporation, scope, and definitions

This Data Processing Agreement ("DPA") supplements the accepted PeopleLinx Terms of Use and applicable Order Form between Game Time Updates LLC dba PeopleLinx ("PeopleLinx," "we," or "us") and the customer ("you"). It applies where PeopleLinx processes personal data on your behalf to provide agreed Services, including data you upload, make available through authorized connections, or authorize us to obtain or process for your campaigns. It does not depend solely on a manual upload.

"Applicable Data Protection Law" means privacy and data-protection laws applicable to the processing, including, where applicable, the EU GDPR, UK GDPR and UK Data Protection Act 2018 as amended, Swiss Federal Act on Data Protection, and applicable U.S. state privacy laws, including the California Consumer Privacy Act as amended ("CCPA"). These references do not make a law applicable where its jurisdictional requirements are not met.

"Customer Personal Data" means personal data PeopleLinx processes on your behalf under this DPA. "Instructions" means your lawful documented processing instructions in the agreement, this DPA, and authorized service settings or subsequent written directions. "Subprocessor" means a provider engaged by PeopleLinx to process Customer Personal Data on your behalf. "Personal Data Breach" means a breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. "SCCs" means the EU standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914. Controller, processor, business, service provider, and similar terms have their applicable statutory meanings.

PeopleLinx provides agency services using its proprietary technologies and third-party platforms operated by independent providers. PeopleLinx and those providers are separate organizations. This DPA covers PeopleLinx's processing and responsibilities, not a claim that PeopleLinx owns or operates a provider's underlying platform. Where this DPA refers to a platform provider, PeopleLinx will identify that provider by name in the accepted Order Form, in a service-specific provider schedule, or in writing on request.

2. Roles and processing instructions

You act as controller or business, or as a processor authorized by the relevant controller; PeopleLinx acts as processor, subprocessor, service provider, or contractor as applicable. You determine the purposes of processing and are responsible for lawful collection, notices, consent or other legal basis, and authority to give Instructions. If you are a processor, you must obtain the controller's authorization for PeopleLinx and applicable subprocessors.

PeopleLinx will process Customer Personal Data only to deliver the agreed Services and under lawful Instructions, unless law requires otherwise. Where legally permitted, we will inform you of a legal requirement before processing outside Instructions. We will promptly inform you if we believe an Instruction infringes applicable data-protection law and may suspend the affected processing pending clarification. Neither an opt-in nor a contractual disclaimer authorizes unlawful processing.

PeopleLinx remains responsible for its obligations under applicable law and this DPA. Each party will cooperate reasonably with the other to address processing issues. Exhibit A describes processing activities; Exhibit B explains third-party platform provider arrangements and how to obtain the current provider list; Exhibit C describes security and retention responsibilities; Exhibit D addresses engagement-specific transfer documentation. The accepted Order Form, lawful Instructions, and any agreed processing or transfer annex supplement these exhibits for the services actually used.

3. Use restrictions and U.S. privacy requirements

PeopleLinx will not sell or share Customer Personal Data as those terms are defined in the CCPA. We will not retain, use, or disclose it outside the direct business relationship or for purposes other than the specified business purposes in the agreement, except as permitted by applicable law. We will not combine it with personal data obtained from other persons or our own interactions except as permitted by applicable law for the agreed services. We will provide the level of privacy protection required by applicable law and comply with restrictions applicable to service providers or contractors.

PeopleLinx certifies that it understands and will comply with these restrictions. You may take reasonable and appropriate steps to verify compliance and stop or remediate unauthorized use. We will notify you if we determine that we can no longer meet these obligations. We will not use Customer Personal Data for general-purpose AI model training or permit a provider to do so without express written authorization from you and compliance with applicable law. Any approved AI processing remains subject to Instructions, subprocessor requirements, and agreed data-use limits.

4. Confidentiality

PeopleLinx will limit access to Customer Personal Data to authorized personnel and providers with a need to know. Authorized personnel must be bound by confidentiality obligations or an appropriate statutory duty. We will disclose Customer Personal Data only as authorized by lawful Instructions, necessary for agreed service delivery under this DPA, or legally required. Where legally permitted, we will notify you before compelled disclosure, disclose only what is required, and reasonably assist efforts to obtain protection.

Your protection of PeopleLinx's nonpublic solutions, methodologies, workflows, tools, configurations, data, and related disclosures is governed by Section 6 of the Terms, incorporated into this DPA. That section applies to validly accepted prospective and actual engagements and to confidential information disclosed during sales, demonstrations, onboarding, training, support, and audits. It does not make public information confidential or authorize additional use of Customer Personal Data. Confidentiality obligations cannot prevent data subjects, controllers, supervisory authorities, or auditors from exercising mandatory rights.

5. Security

PeopleLinx will implement and maintain technical and organizational measures appropriate to the nature, scope, context, and risks of processing, as described in Exhibit C and any agreed service-specific security schedule. Measures must address appropriate access controls, confidentiality duties, secure handling and transmission, availability and recovery, and periodic assessment. Updates must not materially reduce the agreed overall level of protection during the engagement.

Personnel with access will receive appropriate confidentiality and data-handling instruction. PeopleLinx is responsible for its agency personnel, authorized access, handling of customer data, and managed configurations. Platform providers are responsible for the infrastructure they operate under their applicable arrangements. Provider reports describe the provider and covered scope, not a PeopleLinx certification. Additional security information may be requested from PeopleLinx, subject to appropriate confidentiality protections and mandatory audit rights.

You are responsible for appropriate customer-side permissions, lawful uploads, authorized connections, and secure use. Your assessment or acceptance of safeguards does not waive PeopleLinx's own duties or constitute a conclusive certification of their adequacy.

6. Subprocessors

You give general authorization for the platform providers identified to you by name in an accepted Order Form, a service-specific provider schedule, or in writing on request, where they process Customer Personal Data on PeopleLinx's behalf for the agreed services. A reference to an optional provider is not authorization to use it for every engagement. PeopleLinx will identify any additional applicable provider and processing purpose before engaging it for your data. Before appointing a new subprocessor or replacing one for Customer Personal Data, PeopleLinx will provide at least 30 days' advance written notice, except where an urgent security or legal need requires shorter notice, in which case we will provide notice as early as practicable. No shorter notice may override mandatory law or applicable SCC requirements.

You may object within the notice period on reasonable data-protection grounds. The parties will work in good faith to resolve the concern through safeguards or a commercially reasonable alternative. If unresolved, you may terminate the affected service before the new processing starts without a termination penalty for that affected service and receive a prorated refund of prepaid fees for undelivered affected services. Accrued fees for delivered services remain due.

PeopleLinx will enter into written arrangements imposing relevant data-protection obligations no less protective than this DPA and legally required transfer safeguards; limit access to the necessary data; and remain responsible for subprocessors' performance of their delegated obligations as required by law and the agreement. Client approval of a provider does not waive these duties.

7. Client-elected tools and platform terms

The client-elected tool requirements in Section 8 of the Terms apply to optional integrations and automation. You must assess and comply with provider and affected-platform terms, permissions, acceptable-use rules, and applicable law before directing or initiating use. You must obtain the authority necessary to disclose personal data to any independently engaged provider. PeopleLinx may decline prohibited instructions.

Where a provider is independently engaged and controlled by you and processes data under your direct arrangement, you are responsible for that arrangement and its lawful data transfers. PeopleLinx will transmit Customer Personal Data to that provider only within lawful documented Instructions and any applicable transfer requirements.

Where PeopleLinx engages a provider to process Customer Personal Data on its behalf, the provider is a subprocessor under Section 6 regardless of referral, client election, branding, or whose account is used. Roles depend on actual functions. These provisions do not disclaim PeopleLinx's responsibility for its own processing, managed activities, subprocessors, or nonwaivable duties.

8. Data rights and regulatory assistance

Taking into account the processing and information available, PeopleLinx will reasonably assist you with data-subject requests, privacy assessments, prior consultations, transfer assessments, and security or breach obligations under applicable law. We will promptly forward requests relating to Customer Personal Data and will not provide a substantive response without Instructions unless legally required. We may acknowledge receipt and explain that the request has been forwarded.

You remain responsible for controller decisions and responses where applicable. Assistance charges may be agreed for extraordinary work, but must be reasonable and must not prevent fulfillment of mandatory duties. Neither party is required to provide prohibited information or another customer's confidential records.

You may contact info@peoplelinx.com or pbaynes@peoplelinx.com at any time to request access, correction, export, restriction, or deletion of Customer Personal Data, or information about providers and retention. Identify your organization, the relevant account or campaign, the data concerned, and the action requested; do not include passwords or unnecessary sensitive information. PeopleLinx will verify the requester's authority, explain any relevant limitations, and carry out lawful Instructions or coordinate them with the applicable providers without undue delay and within applicable legal deadlines. Making a request does not guarantee immediate deletion from every system or cancel a separate commercial commitment. Mandatory rights are not reduced by provider processes.

9. Personal Data Breach

PeopleLinx will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification will not be delayed until a full investigation or final confirmation is complete. We will investigate, take appropriate containment and mitigation steps, and cooperate with your legally required response.

As information becomes available, we will provide the nature of the breach; affected data and approximate numbers of records and individuals where known; likely consequences; measures taken or proposed; and a contact for further information. Information may be provided in stages without undue further delay. Notice will be sent to your designated security or account contact; keep those details current. Reporting does not constitute an admission of liability.

You determine and make controller notifications to authorities and individuals where applicable; PeopleLinx retains any notification duties directly imposed on it by law. Routine unsuccessful attacks that do not compromise Customer Personal Data are not reportable under this section unless law requires otherwise. No automatic blanket reimbursement of PeopleLinx's incident-response costs applies; cost allocation follows the agreement, actual responsibility, and law.

10. Audits

PeopleLinx will make available information reasonably necessary to demonstrate compliance and allow and contribute to legally required audits, including inspections by you or an authorized independent auditor. Existing relevant reports and documentation may be used first where sufficient.

Routine audits will generally occur no more than once in 12 months, on reasonable notice, during business hours, and with appropriate confidentiality and security arrangements. These limits do not apply where a regulator, applicable law, a Personal Data Breach, or reasonable evidence of material noncompliance requires an additional or urgent audit. An NDA may protect information but must not prevent mandatory audit rights or lawful disclosure to authorities.

Audits must avoid unnecessary disruption and protect other customers' information. Reasonable measures such as redaction, segregated evidence, or independent verification may be used without defeating the audit's purpose. Each party bears its own ordinary compliance costs; extraordinary assistance fees must be agreed in advance and may not obstruct legally required access.

11. International transfers

Customer Personal Data may be processed in the United States and other countries where the applicable authorized providers operate, as explained in Exhibit B. Provider corporate addresses alone do not establish every storage, processing, or support location. The locations relevant to a particular engagement must be identified in its processing or transfer documentation before a restricted transfer is initiated. PeopleLinx will ensure a lawful transfer mechanism and required supplementary measures for transfers it makes, and will reasonably assist you with necessary transfer assessments. Neither party may initiate a restricted transfer before the applicable required safeguards and annex information are in place.

For a restricted EEA transfer to PeopleLinx, the SCCs are incorporated by reference, using Module 2 where you are controller and Module 3 where you are processor, with the particulars recorded in the applicable engagement documentation described in Exhibit D. The official text is at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. Optional Clause 7 is not used; Clause 9 uses general written authorization with the Section 6 notice period; optional Clause 11 language is not used. The parties, competent authority, processing particulars, security measures, and applicable clause selections must be recorded for the relevant transfer before relying on the SCCs. Merely posting this DPA does not complete a customer-specific transfer arrangement.

For a restricted UK transfer, the ICO's International Data Transfer Addendum to the EU SCCs, version B1.0 in force March 21, 2022 or a legally required successor, is incorporated together with its mandatory clauses and engagement-specific tables described in Exhibit D. The EU SCCs alone do not establish a UK transfer mechanism. No contract modification may reduce their mandatory protection.

For a restricted Swiss transfer relying on the SCCs, references to GDPR include applicable Swiss law, the FDPIC is the competent authority for Swiss-law matters, and covered individuals in Switzerland retain their applicable rights and access to competent Swiss courts. Required Swiss adaptations and transfer details are documented for the engagement as described in Exhibit D. This provision does not extend personal-data protection to legal entities where current law does not do so.

Mandatory SCCs and UK Addendum provisions prevail over conflicting Terms or DPA language, including liability caps, governing law, venue, audit limits, and termination provisions. PeopleLinx's importer duties under Module 3 are not shifted wholesale to you. Each party retains its own required cooperation with the relevant controller and authorities.

12. Return, deletion, and retention

You may request return or deletion of Customer Personal Data at any time by contacting info@peoplelinx.com or pbaynes@peoplelinx.com. At the end of processing services, PeopleLinx will, at your choice, return the data in a reasonably usable format or delete it and remaining copies, unless applicable law requires retention. PeopleLinx will implement lawful requests without undue delay, coordinate required provider actions, and comply with applicable legal deadlines and any stricter agreed schedule. An earlier lawful deletion Instruction takes priority over an optional export window.

Exports depend on the data available, authorized access, applicable provider functionality, and third-party licenses; these limitations do not override mandatory return or data-rights obligations. We will explain the applicable process, estimated completion timing, and any lawful exceptions when handling the request. Customers should request any desired export before closing an independent provider account or instructing irreversible deletion.

For data hosted on a third-party platform, that provider's current data-processing terms provide for return and/or deletion upon request or through available service functionality, subject to their stated legal and retention exceptions. Those terms do not specify a universal active-data deletion deadline or maximum backup-retention period. PeopleLinx does not promise an unverified provider deadline; where a specific period is required for your engagement, it must be agreed and supported by the relevant provider before the affected processing begins.

Records retained to comply with law are limited to the necessary scope and period and protected against unrelated use. Limited suppression records may be retained to honor opt-out requests and prevent further outreach. Routine backup copies that cannot reasonably be removed individually are restricted from ordinary use and expire under the applicable provider's documented cycle, subject to applicable law and mandatory transfer clauses. PeopleLinx will seek relevant provider retention information for your request; this exception is not authorization for indefinite retention. If data is restored, applicable deletion Instructions must be reapplied. We will provide confirmation of completed deletion on request, identify outstanding backup or legally required retention where applicable, and provide any certification required by mandatory clauses.

Personal-data return, deletion, and statutory rights must not be withheld solely to collect unpaid fees. This does not grant additional ownership or licenses in third-party datasets or PeopleLinx intellectual property. Requests concerning an independently controlled provider account may require the customer's action or authorization; PeopleLinx will reasonably assist within its authority.

13. Term, conflict, and contact

This DPA remains effective while PeopleLinx processes Customer Personal Data, including permitted retention after the commercial agreement ends. Confidentiality and other continuing obligations survive as required. If processing becomes unlawful, affected processing must be suspended until compliant; either party may terminate the affected service if the problem cannot reasonably be resolved, without limiting statutory remedies.

The Terms otherwise continue. This DPA prevails for personal-data processing, subject to the priority of mandatory transfer clauses. Material DPA changes require the agreement process applicable to the engagement and may not reduce mandatory protections through a website update alone.

Notices to PeopleLinx: pbaynes@peoplelinx.com or legal@peoplelinx.com. General privacy inquiries: info@peoplelinx.com. Customer notices go to the contact designated in the Order Form or Exhibit D.

Exhibit A. Processing details

Subject matter and purpose: personal-data processing to deliver the prospect research, campaign operations, communications, lead management, reporting, and account support included in the accepted Order Form and lawful Instructions.

Nature: authorized collection, receipt, verification, enrichment, organization, storage, retrieval, transmission, campaign delivery, response handling, reporting, export, and deletion, as applicable to the agreed service. Third-party outreach platforms support the outreach activities enabled for the engagement; not every available platform feature is used for every customer.

Duration: the engagement and limited retention necessary under Section 12, applicable law, and any agreed service-specific schedule.

Data categories: names and business contact identifiers, job titles, employers, business email addresses and telephone numbers, campaign participation and response status, relevant message content, and authorized account or integration identifiers, to the extent needed for the agreed service. The actual fields and permitted sources are determined by the Order Form, authorized campaign records, and documented Instructions; additional categories require lawful authorization.

Data subjects: customer personnel, authorized Users, business prospects, customers or contacts in authorized campaigns, and persons identified in relevant communications, as applicable.

Sensitive data: no sensitive or specially regulated data is authorized unless expressly agreed in writing with the permitted categories, necessity, processing limitations, and appropriate safeguards. Do not place passwords or prohibited sensitive information in campaign records.

Frequency: continuous or periodic as needed for authorized service activity. The nature, subject matter, and duration of any processing performed for a customer that is itself a processor follow that customer's lawful controller-authorized Instructions.

Exhibit B. Third-party platform provider arrangements

Outreach platform provider

Role and purpose: The outreach platform provider operates the third-party outreach technology used for the agreed services. Where PeopleLinx engages a provider to process Customer Personal Data for a managed agency service, that provider is PeopleLinx's subprocessor for the delegated platform activities. Where the customer contracts directly with and controls a provider, that provider's role follows the direct agreement, and PeopleLinx acts within the customer's authorized agency access. Account branding or a referral does not change the actual role or eliminate PeopleLinx's own duties. PeopleLinx will name the provider for your engagement in the accepted Order Form, a provider schedule, or in writing on request.

Data: authorized business contact records, campaign content, messages, response information, and account or integration information necessary for the features used.

Locations: The outreach platform provider's current data-processing terms describe processing generally in the United States and other jurisdictions where the provider or its subprocessors operate; they do not provide a complete list of storage or support locations for each customer. Contact PeopleLinx for the service-specific location information needed for your engagement or transfer assessment.

Provider references: The applicable provider's current data-processing terms, privacy policy, and security or trust materials are available from PeopleLinx on request, and the version relied on will be identified for your engagement. Where a provider's terms incorporate EU SCC Modules 2 or 3 as applicable and address the UK Addendum and Swiss transfers, those provisions concern transfers covered by that provider's agreement; they do not automatically establish a transfer mechanism for PeopleLinx or certify PeopleLinx.

Outreach platform provider's downstream providers

The outreach platform provider's current data-processing terms identify Microsoft Corporation and Microsoft Ireland Operations Limited for Azure hosting and data operations; Google LLC and Google Ireland Limited for email, calendar and scheduling; Cloudflare, Inc. for routing, network security and delivery; Twilio, Inc. for calling and messaging; Cobisi Research TM, Inc. (Verifalia) for email validation; OpenAI OpCo, LLC for AI capabilities; and Unipile SAS for messaging, email and calendar functionality. These are that provider's listed providers, not a statement that PeopleLinx directly engages every provider or enables every feature. The full list may be requested from PeopleLinx.

Applicable providers depend on the service and enabled features. Publicly listed company addresses must not be treated as a complete data-location register. PeopleLinx will coordinate requests for the relevant current provider details and identify direct subprocessors separately before authorizing additional processing.

Other services and data sources

The agreed engagement may include authorized communications, scheduling, reporting, business-data sources such as ZoomInfo, or customer-selected integrations. A business-data supplier acting independently is not automatically a subprocessor. Its role depends on whether it supplies its own licensed data or processes Customer Personal Data on PeopleLinx's behalf. PeopleLinx will identify the applicable provider, legal entity, purpose, data categories, role, and required location or transfer details in the service-specific documentation before using an additional subprocessor.

Customers may request the providers applicable to their service, processing purposes, relevant locations, and available privacy or security documentation at any time through info@peoplelinx.com or pbaynes@peoplelinx.com. A public provider link is supporting information, not a waiver of PeopleLinx's Section 6 obligations or a substitute for necessary contractual arrangements.

Exhibit C. Security responsibilities and retention

PeopleLinx agency safeguards

PeopleLinx's documented cybersecurity policies address the following areas. Applicable technical configurations depend on the services, permissions, and systems used. These policy requirements are not an independent audit or a claim that PeopleLinx holds a provider's certifications.

Access and authentication: individual approved accounts, least-privilege access based on responsibilities, multi-factor authentication where supported, role-based access adjustment, and prompt access removal when employment or contractor access ends.
Credentials and integrations: strong unique passwords, approved secure handling of shared secrets, restricted integration credentials, and approved services and configurations.
Personnel and data handling: confidentiality obligations, onboarding and periodic security education, necessary-only access and exports, and return or deletion of exports when no longer needed or required by lawful Instructions.
Devices: screen locks, supported operating systems, current security updates, appropriate endpoint protections, and device encryption where supported.
Incident response: use of available provider logs and alerts, prompt internal incident reporting, management-led assessment and containment, and review of material incidents. Customer notification follows Section 9.
Provider oversight and continuity: oversight of authorized providers, agency access and configurations, and practical continuity planning. Platform providers operate the underlying infrastructure, backups, and recovery for their services; this allocation does not remove PeopleLinx's DPA duties.
Review: policy review at least annually and after material changes in services, technology, providers, law, or risk. Security and continuity assessments are proportionate to the processing and risk.

Outreach platform safeguards and evidence

The outreach platform provider's published security materials describe encrypted transport, restricted production access, access controls, authentication, monitoring, vulnerability management, backup and recovery procedures, and incident response. Its trust materials list encryption and retention controls and an access-request resource titled SOC 2 Type II Report. Report access, audit period, covered systems, and exclusions must be checked in the actual report; this DPA does not represent that PeopleLinx is SOC 2 certified or that a provider report covers every agency activity.

Customers may ask PeopleLinx for available service-specific safeguards and supporting provider materials. Sensitive evidence may require confidentiality arrangements, subject to mandatory audit and regulatory rights. Where a particular technical measure is essential for a customer's processing, the parties must establish its applicability in the service-specific security schedule before relying on it.

Retention and deletion process

Agency working records and exports are kept only as needed for the agreed service and lawful retention purposes. Customers may request return or deletion at any time through the contacts in Section 12. PeopleLinx will coordinate the request with the applicable provider and explain timing and exceptions. Provider-managed backups follow the relevant documented retention cycle, not an assumed universal deadline. Specific active-data or backup limits required for an engagement must be supported and agreed before the relevant processing; a request-based process does not replace a legally required retention limit.

Accounting and tax records, legal holds, and limited opt-out suppression records may have different lawful retention needs from prospect lists or campaign content. Retained records are restricted to the applicable purpose. Section 12 governs deletion confirmation, backup restrictions, restored data, and mandatory rights.

Exhibit D. Engagement-specific international-transfer documentation

This public DPA establishes the framework in Section 11. Any customer-specific transfer annex, incorporated Order Form, and UK Addendum tables must identify the actual parties and processing before a restricted transfer relies on them. Contact pbaynes@peoplelinx.com to arrange the applicable documentation or request assistance with a transfer assessment. A request or a provider's certification alone is not a transfer mechanism.

Parties and contacts: the exporter is the customer identified by legal name, address, contact, and controller or processor role in the accepted Order Form or transfer annex. Where PeopleLinx is the importer, its legal name is Game Time Updates LLC dba PeopleLinx; address: 1252 Drexel Avenue, No. 7, Miami Beach, Florida 33139, United States; contact: pbaynes@peoplelinx.com. The applicable importer role and valid acceptance or signature details must be recorded for the transfer.

Processing and safeguards: Annex I.B follows Exhibit A and the actual authorized service; Annex II records the applicable PeopleLinx and provider measures described in Exhibit C, including assistance measures. Any required subprocessor particulars follow Exhibit B and the service-specific schedule. Sensitive-data transfers require an express agreement and additional safeguards.

Authority and clause selections: the competent EU supervisory authority is determined under SCC Clause 13 for the exporter. The relevant SCC module, EU Member State law permitting third-party beneficiary rights under Clause 17, competent EU Member State courts under Clause 18, and applicable authorization choices must be recorded in the transfer annex. The Swiss FDPIC is the competent authority for applicable Swiss-law matters. Delaware commercial governing-law provisions do not override mandatory SCC protections.

UK transfers: the UK Addendum tables identify the parties, applicable EU SCC version and module, completed annexes and selections, and which parties may end the Addendum under its mandatory Section 19. The mandatory Addendum text applies without reducing its protections.

Neither party may rely on incomplete transfer documentation. If the necessary particulars or safeguards are unavailable, the affected restricted transfer must not begin or must be suspended until compliant. PeopleLinx does not claim Data Privacy Framework certification on the basis of a provider's trust materials or assume that a provider's transfer arrangements cover a separate transfer to PeopleLinx.