ProIQ, LLC

Effective Date: October 28, 2026

This Data Processing Addendum ("DPA") forms part of and is incorporated into the ProIQ Agreement or Terms of Service (the "Terms") between ProIQ, LLC ("ProIQ," "we," or "us") and the Client ("you"). It governs the processing of Personal Data when you upload or process it through the Platform. Capitalized terms not defined here have the meaning given in the Terms.

Part A — Core Terms (Apply to All Clients)

1. Scope and Roles

1.1 If there is a conflict between this DPA and the Terms as to the processing of Personal Data, this DPA controls; the applicable Jurisdiction Module in Part B controls over this Core in case of conflict for Clients or data subjects in that jurisdiction.

1.2 With respect to Personal Data you upload to or process through the Platform about your business contacts and about your customers, prospects, leads, and other individuals ("Client Personal Data"):

1. You are the controller / business (as applicable) and determine the purposes and means of processing; and
2. ProIQ is the processor / service provider (as applicable) and processes Client Personal Data only on your documented instructions and on your behalf.

1.3 ProIQ's provision of the Services under the Terms is your documented instruction to process Client Personal Data as necessary to provide lead capture from social media platform and web forms, CRM storage, client-directed follow-up communications, audience and conversion-event sync at Client's direction, reporting, and as further instructed through your use of the Platform.

1.4 The subject matter, nature, purpose, and duration of processing, the types of Personal Data, and the categories of data subjects are described in Schedule 1.

2. Definitions

2.1 Applicable Data Protection Law means all U.S. data protection and privacy laws applicable to the processing of Client Personal Data under this DPA, including as set out in the applicable Jurisdiction Module in Part B.

2.2 Personal Data / Personal Information means information relating to an identified or identifiable individual (or household, where applicable), as defined under Applicable Data Protection Law.

2.3 Process / Processing means any operation performed on Personal Data, whether or not by automated means.

2.4 Sub-processor means a third party engaged by ProIQ to process Client Personal Data in connection with the Services, including the Underlying Platform Provider (GoHighLevel) and communications, AI, and payment vendors.

2.5 Security Incident / Confidentiality Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data.

3. ProIQ's Obligations

ProIQ will:

3.1 Process Client Personal Data only (a) on your documented instructions, and (b) as required by applicable law, informing you first unless the law prohibits it.

3.2 Not sell or share Client Personal Data for its own purposes or for the benefit of any party other than Client. Transfers to advertising platforms described in Schedule 2, Section E occur only at Client’s documented instruction, are disclosures made by Client, are governed by the platform’s terms, and are not a sale or sharing by ProIQ. Client is responsible for the notices, consents, and opt-out handling those transfers require.

3.3 Ensure persons authorized to process Client Personal Data are bound by confidentiality.

3.4 Implement and maintain the technical and organizational measures in Schedule 3.

3.5 Provide the level of protection required of it under Applicable Data Protection Law and, taking into account the nature of processing, assist you in meeting your own obligations (data-subject requests, security, breach notification, and any required assessments) as detailed in the applicable Jurisdiction Module and Sections 6, 7, and 9A.

3.6 Notify you if, in its opinion, an instruction infringes Applicable Data Protection Law.

3A. No Sale or Sharing of Client Personal Data

ProIQ does not sell or share Client Personal Data for its own purposes or for the benefit of any party other than Client. Transfers to advertising platforms described in Schedule 2, Section E occur only at Client’s documented instruction, are disclosures made by Client, are governed by the platform’s terms, and are not a sale or sharing by ProIQ. Client is responsible for the notices, consents, and opt-out handling those transfers require.

4. Your Obligations

You will:

4.1 Comply with your obligations under Applicable Data Protection Law, including providing required notices to and obtaining required consents from data subjects.

4.2 Have all necessary rights, lawful bases, notices, and consents to upload Client Personal Data and to instruct ProIQ to process it.

4.3 Be solely responsible for the accuracy, quality, and legality of Client Personal Data and how you acquired it, including communications consent under the Terms, the TCPA and CAN-SPAM.

4.4 Be responsible for privacy policy and form disclosures covering pixels, conversion API, and audience use, and for cookie and consent banners.

5. Sub-processors

5.1 You authorize ProIQ to engage the Sub-processors listed in Schedule 2, including GoHighLevel and communications, AI, and payment vendors.

5.2 ProIQ will impose data protection obligations on each Sub-processor substantially similar to those in this DPA to the extent applicable, and remains responsible for their performance, subject to the limitations of liability in the Terms.

5.3 ProIQ may add or replace Sub-processors from time to time. ProIQ will notify you of a new Sub-processor by updating the Sub-processor list (including the list referenced in Schedule 2) or through its normal notification channels. You may object to a new Sub-processor within forty-five (45) days of notice by providing a written objection stating reasonable data-protection grounds. If no objection is received within that period, you are deemed to have consented. If you object, the parties will work together in good faith toward a commercially reasonable resolution. If no resolution is reached, your sole remedy is to stop using the affected Service and terminate the affected portion of the Services under the Terms.

6. Data-Subject Requests

6.1 Taking into account the nature of processing, ProIQ will provide reasonable assistance to help you respond to verifiable data-subject requests under Applicable Data Protection Law.

6.2 If ProIQ receives a request directly from a data subject, it will, where legally permitted, direct the individual to you or forward the request and not respond except on your instructions or as required by law.

6.3 ProIQ will apply Client-instructed suppression and deletion inside the Platform. Client is responsible for honoring opt-out signals (including Global Privacy Control), and for removing individuals from audiences and deleting data inside the social media platforms and other platforms, since ProIQ can't act on data already in the Client's ad accounts without their access.

7. Security Incidents

7.1 ProIQ will notify you without undue delay after becoming aware of a Security Incident affecting Client Personal Data, and in any event no later than seventy-two (72) hours after becoming aware, or within any shorter timeframe required by Applicable Data Protection Law.

7.2 The notice will describe, to the extent known, the nature of the incident, affected data and data subjects, likely consequences, and measures taken. ProIQ will reasonably cooperate to help you meet your notification obligations.

7.3 Notification is not an acknowledgment of fault; liability is subject to the limitations in the Terms and Section 10.1 of this DPA.

8. Deletion and Return

Upon termination, ProIQ will delete or return Client Personal Data within a commercially reasonable timeframe, except where retention is required by law.

9. Audits and Records

9.1 Security and Compliance Information. ProIQ maintains reasonable administrative, technical, and organizational safeguards appropriate to the nature of its Services and the information it processes. Upon reasonable written request, ProIQ may, at its discretion, provide available information regarding its security and data protection practices, subject to applicable confidentiality, security, and legal restrictions. Such information may include existing security policies, summaries of security practices, or available third-party documentation. ProIQ is not obligated to prepare custom reports, complete customer-specific security questionnaires, or conduct audits solely in response to a Client request, except where required by Applicable Data Protection Law.

9.2 Customer-Requested Audits. ProIQ does not provide routine customer-requested audits, on-site inspections, penetration tests, or independent security assessments as part of its standard Services. Clients are not granted general access to ProIQ's internal systems, infrastructure, personnel, facilities, or confidential business records for auditing purposes. Any voluntary audit or assessment outside ProIQ's standard Services requires prior written agreement between the parties.

9.3 Legally Required Audits and Cooperation. Where Applicable Data Protection Law expressly requires audit rights, compliance verification, or related cooperation, ProIQ will fulfill its applicable legal obligations. To the extent permitted by law, ProIQ may propose reasonable alternative verification methods, including existing documentation, written responses, or available independent third-party assessments, where these methods satisfy the applicable legal requirements. Any legally required audit or inspection shall, to the extent permitted by law, be subject to reasonable advance written notice, appropriate confidentiality and security safeguards, reasonable scheduling, and measures designed to minimize disruption to ProIQ's operations and protect other customers' information.

9.4 Costs and Expenses. Unless otherwise required by Applicable Data Protection Law or agreed in writing, the Client shall be responsible for reasonable costs associated with any separately agreed customer-requested audit or assessment, including applicable third-party expenses and reasonable administrative costs. Any fees shall be disclosed and agreed upon in writing before the assessment begins.

9.5 Third-Party Service Providers. ProIQ utilizes third-party platforms, infrastructure, and service providers in delivering its Services. ProIQ does not grant Clients independent audit or inspection rights over such third parties. Access to third-party compliance documentation, security reports, or audit materials remains subject to the applicable provider's policies, licensing terms, and disclosure restrictions. Nothing in this provision limits any obligation imposed on ProIQ by Applicable Data Protection Law.

9A. Data Protection Assessments

Taking into account the nature of the processing and the information available to ProIQ, ProIQ will provide you with reasonable assistance and relevant information to help you carry out any data protection impact assessment or prior consultation with a supervisory authority that you are required to conduct under Applicable Data Protection Law, in each case solely with respect to Client Personal Data processed by ProIQ.

10. General

10.1 Liability. Each party's liability arising out of or related to this DPA, whether in contract, tort, or any other theory, is subject to the exclusions and limitations of liability set out in the Terms, and any reference to liability in the Terms includes liability under this DPA. The combined aggregate liability of each party under the Terms and this DPA, taken together, will not exceed the limit stated in the Terms. Nothing in this DPA limits either party's liability to the extent such limitation is not permitted by Applicable Data Protection Law, including liability that cannot lawfully be excluded or capped.

10.2 Updates to Schedules. ProIQ may update the Schedules to this DPA by posting the current version on its website and providing notice through its normal channels. Changes to the Sub-processor list in Schedule 2 are governed exclusively by Section 5.3 and are not subject to this Section 10.2. For all other Schedule updates, material changes take effect thirty (30) days after notice. If you object to a material change on reasonable data-protection grounds within that period, the parties will work in good faith toward a resolution; if none is reached, your sole remedy is to stop using the affected Service and terminate the affected portion of the Services. Where a Schedule other than Schedule 2 is maintained online, the current online version controls over the version attached to this DPA. This Section applies only to the Schedules and does not permit ProIQ to unilaterally change the substantive obligations in Parts A or B of this DPA.

10.3 Non-Compliance. If ProIQ determines that it can no longer meet its obligations under this DPA or Applicable Data Protection Law, it will notify you of that determination. In such case, you may direct ProIQ to stop processing the affected Client Personal Data, or ProIQ will take reasonable and appropriate steps to remediate the non-compliance. This Section does not limit any other right or remedy available to you under the Terms.

10.4 Controlling Agreements. The Terms apply to all matters not expressly addressed in this DPA. If there is a conflict between this DPA and the Terms, this DPA controls. Except as expressly modified by this DPA, the Terms remain in full force and effect.

Part B — Jurisdiction Modules

Each module applies only to Clients established in, or data subjects located in, the stated jurisdiction, and supplements Part A.

Module US — United States (State Privacy Laws)

US-1. Applicable laws: CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), and comparable state statutes, as applicable.

US-2. Service provider / processor status: ProIQ acts as a "service provider" or "processor." ProIQ doesn't sell or share Client Personal Data for its own purposes. Transfers to ad platforms occur only at Client's documented instruction, are Client's disclosures, and are governed by the platform's terms. Client is responsible for the notices and opt-out handling those transfers require.

US-3. ProIQ provides the same level of privacy protection as required of you as a business/controller with respect to the Services.

Schedules for the Data Processing Agreement

Schedule 1 — Types of Personal Data

ProIQ may process the following categories of Personal Data on behalf of its Clients, depending on the Services utilized, the features enabled, and the information collected or submitted by the Client or its end users.

1. Identity and Contact Information. Names, business names, email addresses, telephone numbers, mailing addresses, business addresses, and other contact or identification information.
2. Customer and Lead Information. Customer profiles, prospect information, lead sources, contact records, tags, notes, customer preferences, service interests, inquiry details, and customer relationship management records.
3. Communications Data. Email messages, SMS and other text messages, chat communications, voicemail messages, call recordings, call transcripts, AI-assisted conversations, communication history, and related metadata, where such features are enabled.
4. Appointment and Service Information. Appointment details, scheduling information, calendar records, booking history, service requests, service preferences, and related customer interactions.
5. Transaction and Billing Information. Invoice records, transaction amounts, payment status, purchase history, subscription details, billing contact information, and payment-related records made available through the Services. Payment card information and payment credentials may be processed separately by authorized third-party payment processors, subject to their applicable terms and security requirements.
6. Marketing and Website Interaction Data. Website form submissions, survey responses, marketing preferences, communication consent records, campaign interactions, lead attribution information, website activity, IP addresses, device information, social media lead and click identifiers, social media hashed identifiers for conversion API and/or audience matching, and related analytics data where collected through the Services.
7. Client-Provided Content and Media. Photographs, videos, documents, written content, uploaded files, creative materials, and other information supplied by the Client or its end users.
8. Artificial Intelligence Interaction Data. Information submitted to or generated through enabled AI-powered features, including chatbot conversations, voice interactions, transcripts, prompts, customer inquiries, and automated communication records.
9. Other Client-Submitted Personal Data. Other Personal Data that the Client or its authorized users submit, collect, or process through the Services in accordance with these Terms, the Data Processing Agreement, and Applicable Data Protection Law.

Details of Processing

Item	Description
Subject matter	ProIQ’s hosting and operation of Client’s Platform as a repository for lead and customer data, and related marketing services performed at Client’s direction.
Nature of processing	Collection, receipt, storage, organization, retrieval, tagging, transmission, and deletion of Client Personal Data within the GoHighLevel sub-account; automated follow-up messaging; and transmission of data to advertising platforms at Client’s documented instruction.
Purposes of processing	(a) Capturing leads from social media lead forms, website forms, and phone calls; (b) storing and managing contact records in the CRM; (c) sending follow-up communications by email, SMS, and voice/chat, if enabled at Client’s direction; (d) syncing contacts and conversion events to advertising platforms designated by Client, for audience building and campaign measurement; (e) reporting and performance analysis for Client; (f) security, support, and troubleshooting of the Client’s Platform.
Duration of processing	For the term of the Agreement, plus the post-termination export and deletion period in Section 8.
Categories of data subjects	Client’s leads, prospects, and customers; Client’s website visitors who submit forms; Client’s employees or applicants, if applicable; Client’s business contacts.
Types of Personal Data	As listed in the categories below.
Sensitive data	None intended. See the “Sensitive and Restricted Personal Data” paragraph below.
Frequency of transfer	Continuous, as leads and events are generated and as Client instructs.
Retention	Until Client instructs deletion or the Terms ends, then per Section 8.
Client instructions	Client’s documented instructions are this DPA, the Terms, and Client’s configuration and use of the Platform, including written requests to ProIQ.

Sensitive and Restricted Personal Data

Clients shall not use the Services to collect, store, transmit, or otherwise process highly sensitive or regulated Personal Data, including Social Security numbers, government-issued identification numbers, complete payment card credentials, financial account authentication credentials, medical records, protected health information subject to HIPAA, or other data requiring specialized regulatory safeguards, unless such processing is expressly authorized in writing by ProIQ and supported by the applicable Services and required agreements.

Certain Personal Data may be classified as sensitive under Applicable Data Protection Law depending on its nature, context, purpose, or use. Such information may include health-related details, information concerning minors, biometric information, or other specially protected categories.

Clients are responsible for determining whether their intended collection and processing of Personal Data is lawful, obtaining required notices and consents, and avoiding unnecessary collection of sensitive information.

Clients are responsible for lead form design, including custom questions and fields. ProIQ may disable fields or forms that collect restricted Personal Data.

ProIQ does not represent that the Services are suitable for all categories of regulated or sensitive Personal Data. Any processing of sensitive information must comply with Applicable Data Protection Law, the applicable platform requirements, and any additional written agreements required for such processing. Nothing in this Schedule authorizes processing that is otherwise prohibited by the Agreement or Applicable Data Protection Law.

Schedule 2 — Sub-processors

ProIQ utilizes third-party service providers to deliver, maintain, support, and enhance its Services. These providers may process Personal Data on behalf of ProIQ as necessary to perform their contracted functions.

A. Primary Platform Sub-Processor

Sub-Processor: HighLevel, Inc. and applicable affiliates

Purpose: CRM, websites, hosting, communications, marketing automation, scheduling, AI functionality, and related platform services

Processing Location: United States; additional processing or support access locations as disclosed by HighLevel, including India

B. Platform Sub-Processors

HighLevel engages additional sub-processors to support its services, including infrastructure, communications, payments, artificial intelligence, customer support, analytics, and workflow automation.

The current list of HighLevel's published sub-processors, including their processing purposes and locations, is available at: https://www.gohighlevel.com/sub-processors

Such providers may include Google Cloud Services, Amazon Web Services, Twilio, Mailgun, Stripe, OpenAI, Zapier, and other providers disclosed in HighLevel's maintained sub-processor list. The use of individual providers depends on the Services and functionality enabled.

C. Additional ProIQ Sub-Processors

ProIQ may engage additional service providers for customer support, technical assistance, artificial intelligence, integrations, and other contracted services. Any additional provider that processes Client Personal Data on ProIQ's behalf shall be identified and disclosed as required by Applicable Data Protection Law and the applicable Data Processing Agreement.

D. Changes to Sub-Processors

ProIQ may update its sub-processors as reasonably necessary to provide the Services, subject to applicable contractual obligations, legally required notification procedures, and any applicable rights of objection as set out in Section 5.3. ProIQ shall maintain appropriate contractual and data protection safeguards with its sub-processors as required by Applicable Data Protection Law.

E. Advertising Platforms and Other Client-Directed Recipients

Meta Platforms, Google, and any other advertising, analytics, or marketing platform to which Client directs ProIQ to transmit Client Personal Data (for example, through contact-list or audience uploads, conversion API or offline conversion events, or platform integrations) are recipients selected by Client. They are not Sub-processors of ProIQ and do not process Client Personal Data on ProIQ's behalf.

ProIQ transmits Client Personal Data to these platforms only at Client's documented instruction and for the purposes stated in Schedule 1. Each such transmission is a disclosure made by Client. Client's use of each platform is governed by that platform's own terms, data processing terms, and privacy policies, and Client is responsible for accepting and complying with them. Client is also responsible for the notices and consents these transmissions require, for honoring opt-out requests and opt-out preference signals, and for removing individuals from audiences and deleting data within the platform.

ProIQ is not responsible for a platform's use of Client Personal Data after transmission, and Section 5.2 does not apply to these platforms.

Schedule 3 — Technical and Organizational Security Measures

ProIQ implements and maintains technical and organizational measures appropriate to the nature and scope of its Services, the Personal Data processed, and the security capabilities of its underlying technology providers. ProIQ's security measures consist of controls implemented directly by ProIQ and controls provided by third-party platforms, infrastructure providers, and other authorized service providers.

1. Access Management

ProIQ manages access to customer accounts and information through the access-management capabilities made available by its underlying platforms. Access permissions and administrative privileges are assigned based on operational responsibilities and available platform controls. Access-management measures may include role-based permissions, individual user accounts, and multifactor authentication.

2. Data Encryption and Infrastructure Security

ProIQ relies on its underlying platform and authorized infrastructure providers for platform-level security, including encryption of data in transit and at rest where implemented by those providers. ProIQ does not independently operate or control all infrastructure-level encryption systems, hosting environments, or data storage mechanisms used to deliver its Services. Applicable infrastructure security measures are governed by the technical capabilities, configurations, and security practices of the respective providers.

3. Third-Party Platform Security

ProIQ utilizes third-party technology providers, including HighLevel and its applicable sub-processors, to deliver hosting, CRM functionality, communications, automation, artificial intelligence, and related services. Infrastructure-level security controls, system availability, network protection, and underlying platform security are administered primarily by the applicable providers. ProIQ is responsible for the security of the systems, credentials, permissions, and configurations within its operational control.

4. Personnel and Contractor Access

ProIQ limits access to customer information to personnel and authorized service providers with a legitimate business need related to delivering, maintaining, or supporting the Services. Personnel and third-party providers are expected to handle customer information in accordance with applicable confidentiality, contractual, and data protection obligations. ProIQ maintains responsibility for implementing applicable safeguards relating to personnel and contractor access within its control.

5. Logging and Security Monitoring

ProIQ utilizes available platform logging, account activity, and security-related features to the extent such capabilities are provided and enabled within the Services. The scope and availability of logging, monitoring, security alerts, and audit trails may vary depending on the underlying platform, subscribed services, and enabled configurations. ProIQ does not represent that it independently operates continuous infrastructure-level security monitoring or a dedicated security operations center.

6. Security Practices and Review

ProIQ evaluates security considerations in connection with its operational activities, system configurations, third-party service providers, and changes to its Services. Security safeguards may be reviewed and adjusted based on identified risks, operational requirements, platform capabilities, and applicable legal obligations. ProIQ does not represent that it conducts independent security certifications, formal penetration testing, or scheduled third-party security audits unless expressly confirmed in writing.

7. Shared Responsibility and Scope

The security of the Services depends on measures implemented by ProIQ, its authorized technology providers, and customers. Customers are responsible for appropriately managing their own account credentials, authorized users, access permissions, and use of the Services. ProIQ remains responsible for implementing the security measures applicable to its own operations and for fulfilling its obligations under the Data Processing Agreement and Applicable Data Protection Law. Nothing in this Schedule limits or excludes any security obligation imposed by applicable law.

ProIQ, LLC

(385) 786-9030

2720 Homestead Rd, Suite 210, Park City, UT 84098