Telgorithm Data Processing Addendum

Last Updated: October 2, 2026 · Effective: October 2, 2026

This Data Processing Addendum (this “DPA”) forms part of and is subject to the Telgorithm Terms of Service (the “Agreement”) between Telgorithm Inc. (“Telgorithm”) and the customer that accepts the Agreement (“Customer”). This DPA is incorporated into the Agreement and is accepted by Customer upon Customer’s acceptance of the Agreement. All capitalized terms that are not expressly defined in this DPA will have the meanings given to them in the Agreement. If and to the extent any language in this DPA conflicts with the Agreement, this DPA shall control with respect to the Processing of Customer Personal Data. For purposes of this DPA and applicable Data Protection Laws, Customer is the controller or business, and Telgorithm is the processor or service provider, with respect to the Processing of Customer Personal Data.

1. Definitions

For the purposes of this DPA, the following terms and those defined within the body of this DPA apply.

1.1 “Customer Personal Data” means Customer Data that is Personal Data Processed by Telgorithm on behalf of Customer under the Agreement.

1.2 “Data Protection Laws” means the privacy and data protection laws, rules, and regulations applicable to a Party’s Processing of Customer Personal Data under the Agreement. “Data Protection Laws” may include, but are not limited to, the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act) (“CCPA”); other comprehensive U.S. state privacy laws; and the Telephone Consumer Protection Act and similar state laws (in each case, as amended, adopted, or superseded from time to time).

1.3 “Personal Data” has the meaning assigned to the term “personal data” or “personal information” under applicable Data Protection Laws.

1.4 “Process” or “Processing” means any operation or set of operations that is performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection; recording; organization; structuring; storage; adaptation or alteration; retrieval; consultation; use; disclosure by transmission, dissemination, or otherwise making available; alignment or combination; restriction; erasure; or destruction.

1.5 “Security Incident(s)” means a breach of security of Telgorithm’s or its Subprocessors’ systems leading to the unauthorized disclosure of, or unauthorized access to, Customer Personal Data Processed by Telgorithm or, with respect to Customer Personal Data Processed by a Subprocessor, to the extent Telgorithm has been notified by such Subprocessor of the occurrence of such incident. A Security Incident does not include (a) any incident affecting only Customer Personal Data that was encrypted in accordance with Section 3, where the applicable encryption keys were not compromised, or (b) any unauthorized access resulting from compromise of the credentials or systems of Customer, its Authorized Users, or its Customer Clients, except to the extent caused by Telgorithm.

1.6 “Services” means the services that Telgorithm performs under the Agreement.

1.7 “Subprocessor” means a third party that Telgorithm has engaged to Process Customer Personal Data on Telgorithm’s behalf in connection with providing the Services. Subprocessors do not include Participating Carriers, aggregators, telephone number providers, or other telecommunications providers that originate, transmit, route, or terminate communications sent or received through the Services.

2. Processing Terms for Customer Personal Data

2.1 Documented Instructions. Telgorithm shall Process Customer Personal Data to provide the Services in accordance with the Agreement, this DPA, and any instructions agreed upon by the Parties.

2.2 Authorization to Use Subprocessors. Customer authorizes Telgorithm to engage Subprocessors. Customer acknowledges that Subprocessors may further engage vendors, provided that Telgorithm shall ensure that any such further engagement is subject to data protection obligations substantially equivalent to those set forth in Section 2.3.

2.3 Telgorithm and Subprocessor Compliance. Telgorithm shall enter into a written agreement with Subprocessors that imposes data protection requirements for Customer Personal Data on such Subprocessors that are consistent with this DPA.

2.4 Subprocessor Changes. Telgorithm maintains a current list of Subprocessors at https://legal.telgorithm.com/en/subprocessors, including the date of each update. Telgorithm will update that list before a new Subprocessor begins Processing Customer Personal Data, and such posting constitutes notice to Customer for purposes of this Section. Customer may object to a Subprocessor at any time on reasonable grounds relating to data protection by providing written notice to Telgorithm. If the Parties are unable to resolve the objection, Customer’s sole and exclusive remedy is to terminate the Agreement in accordance with the Agreement. Notwithstanding the foregoing, a new Subprocessor may begin Processing Customer Personal Data prior to such update where reasonably necessary to maintain the availability or security of the Services or to comply with applicable law, in which case Telgorithm will update the list promptly thereafter.

2.5 Confidentiality. Any person authorized to Process Customer Personal Data shall be subject to a duty of confidentiality.

2.6 Personal Data Inquiries and Requests. Telgorithm shall provide reasonable assistance to Customer as required by applicable Data Protection Laws in response to any requests from individuals exercising their rights in Customer Personal Data granted to them under applicable Data Protection Laws.

2.7 Data Protection Assessment. To assist Customer with any data protection assessment required by applicable Data Protection Laws, Telgorithm will make available its standard security and privacy documentation describing the Processing performed under the Agreement. Any assistance beyond the provision of such standard documentation is subject to a separate written agreement between the Parties and to Telgorithm’s then-current professional services rates.

2.8 Demonstrable Compliance. Telgorithm shall provide any information in its possession reasonably necessary to demonstrate compliance with this DPA as required by applicable Data Protection Laws upon Customer’s reasonable request.

2.9 California-Specific Terms. To the extent that Telgorithm’s Processing of Customer Personal Data is subject to the CCPA, this Section 2.9 also applies. Customer discloses or otherwise makes available Customer Personal Data to Telgorithm for the limited and specific purpose of enabling Telgorithm to provide the Services to Customer in accordance with the Agreement and this DPA. Telgorithm shall (i) comply with its applicable obligations under the CCPA; (ii) provide the same level of protection as required under the CCPA; (iii) notify Customer if it can no longer meet its obligations under the CCPA; (iv) not “sell” or “share” (as such terms are defined by the CCPA) Customer Personal Data; (v) not retain, use, or disclose Customer Personal Data for any purpose (including any commercial purpose) other than to provide the Services under the Agreement or as otherwise permitted under the CCPA; (vi) not retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and Telgorithm; and (vii) unless otherwise permitted by the CCPA, not combine Customer Personal Data with Personal Data that Telgorithm (a) receives from, or on behalf of, another person, or (b) collects from its own, independent consumer interaction. Telgorithm will permit Customer, upon reasonable request, to take reasonable and appropriate steps to ensure that Telgorithm Processes Customer Personal Data that is subject to this Section 2.9 in a manner consistent with the obligations of a “business” under the CCPA by requesting that Telgorithm attest to its compliance with this Section 2.9. Following any such request, Telgorithm will promptly provide that attestation or an explanation of why it cannot provide it. Upon notice to Telgorithm, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data subject to this Section 2.9, including by ceasing to make Customer Personal Data available to Telgorithm or terminating the Agreement, and the Parties will work together in good faith to remediate any such unauthorized Processing.

2.10 Other U.S. State Privacy Laws. To the extent that Telgorithm’s Processing of Customer Personal Data is subject to any other comprehensive U.S. state privacy law (including but not limited to the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, and Texas Data Privacy and Security Act), Telgorithm shall: (i) Process Customer Personal Data only on documented instructions from Customer and only for the limited and specified purposes set forth in the Agreement or this DPA; (ii) ensure that personnel authorized to Process Customer Personal Data are subject to confidentiality obligations; (iii) impose substantially equivalent data protection obligations on its Subprocessors; (iv) provide reasonable assistance to Customer in responding to data subject rights requests; (v) make available to Customer information reasonably necessary to demonstrate Telgorithm’s compliance with such laws; (vi) at Customer’s direction, delete or return Customer Personal Data at the end of the provision of Services as provided in, and subject to the retention rights set forth in, Section 6; and (vii) allow for and contribute to reasonable assessments by Customer or its designated assessor under such laws.

2.11 Disclosures to Certain Third Parties. Customer agrees that Telgorithm may disclose Customer Personal Data: (i) to government agencies or law enforcement authorities solely to the extent required by applicable law, and Telgorithm shall, where legally permitted, provide Customer with prompt prior notice of any such required disclosure so that Customer may seek a protective order or other appropriate remedy; (ii) to Subprocessors engaged in accordance with Section 2 of this DPA, and to the telecommunications providers excluded from Subprocessors under Section 1.7, as necessary to provide the Services; and (iii) as reasonably necessary to investigate, prevent, or respond to a Security Incident or to comply with a binding legal obligation. Any disclosure under this Section 2.11 shall be limited to the minimum Customer Personal Data reasonably necessary for the disclosed purpose.

2.12 Service Optimization. Where permitted by Data Protection Laws, Telgorithm may Process Customer Personal Data (i) for its internal uses to maintain, support, and improve the quality and security of the Services provided to Customer, provided that any such use complies with the requirements of “service provider” or “processor” under applicable Data Protection Laws; (ii) to prevent, detect, or investigate Security Incidents; or (iii) to protect against malicious, deceptive, fraudulent, or illegal activity.

2.13 Aggregation and De-Identification. Telgorithm may (i) compile aggregated and/or de-identified information in connection with providing the Services provided that such information cannot reasonably be used to identify Customer or any data subject to whom Customer Personal Data relates (“Aggregated and/or De-Identified Data”); and (ii) use Aggregated and/or De-Identified Data for its lawful business purposes.

3. Information Security Program

Telgorithm shall implement and maintain reasonable administrative, technical, organizational, and physical safeguards designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access. At a minimum, such safeguards shall (a) align with, or be designed to achieve alignment with, a recognized industry framework (e.g., the AICPA SOC 2 Trust Services Criteria, ISO/IEC 27001, or NIST SP 800-53); (b) include encryption of Customer Personal Data in transit over public networks using TLS 1.2 or higher, and encryption of Customer Personal Data at rest on persistent storage media (including databases, object storage, and backups) using AES-256 or equivalent, which may be implemented at the volume, disk, or storage-service level; and (c) include role-based access controls and the principle of least privilege. Upon Customer’s reasonable request (no more than once per calendar year), Telgorithm shall provide a summary of its security controls, to the extent Telgorithm maintains such documentation, under appropriate confidentiality obligations.

4. Security Incidents

Telgorithm shall provide written notice to Customer’s primary contact and account administrator without undue delay following, and in any event no later than seventy-two (72) hours after, Telgorithm’s confirmation of a Security Incident. Such notice shall include, to the extent then known: (a) a description of the nature of the Security Incident, including the categories and approximate number of affected data subjects and records; (b) the likely consequences of the Security Incident; (c) the measures taken or proposed to address the Security Incident and mitigate its possible adverse effects; and (d) the name and contact details of Telgorithm’s point of contact for the matter. Telgorithm shall provide updates as further information becomes available. Telgorithm will provide reasonable assistance to Customer by making available information in Telgorithm’s possession that Customer reasonably requires for notifications Customer is required to make under Data Protection Laws or applicable breach notification laws. Customer is solely responsible for determining whether notification to data subjects, regulators, or any other party is required and for making any such notification. Telgorithm will not make notifications on Customer’s behalf and bears no responsibility for the costs of Customer’s notifications, credit monitoring, call center, or similar remediation measures. Customer acknowledges that Telgorithm’s ability to comply with the foregoing timelines may be affected by the nature and scope of the Security Incident, ongoing forensic investigation, or requirements of law enforcement.

5. Audits and Assessments

Upon Customer’s reasonable written request (no more than once per calendar year), Telgorithm will make available a third-party security audit report or a summary of its security controls prepared by a qualified third party, to the extent Telgorithm maintains such documentation, under confidentiality obligations, together with reasonable responses to Customer’s follow-up questions, to demonstrate Telgorithm’s compliance with this DPA. On-site audits are not available for self-serve accounts, except where required by a government authority with jurisdiction over the Processing of Customer Personal Data or following a confirmed Security Incident affecting Customer Personal Data, in which case any such audit will be conducted during Telgorithm’s regular business hours, on reasonable advance notice, in a manner that avoids unnecessary disruption, and subject to confidentiality.

6. Customer Personal Data Deletion

At the expiry or termination of the Agreement, Telgorithm shall delete Customer Personal Data (excluding any backup or archival copies, which shall be deleted in accordance with Telgorithm’s standard backup and retention practices and in any event no later than one hundred twenty-eight (128) days after the expiry or termination of the Agreement), except that Telgorithm may retain (i) billing, usage, transaction, and other account records for as long as required for billing, dispute resolution, tax, accounting, and legal-compliance purposes, and (ii) any Customer Personal Data that Telgorithm is required to retain under applicable laws. With respect to any Customer Personal Data so retained, Telgorithm will restrict any further Processing of it to the purposes for which it is retained. Telgorithm shall confirm deletion in writing upon Customer’s request. Customer may retrieve Customer Personal Data using the export functionality Telgorithm makes available through the Subscription Services while Customer’s account is active. Telgorithm has no obligation to return Customer Personal Data by any other means.

7. Customer’s Obligations; Liability

7.1 Customer Representations and Warranties. Customer represents and warrants that (i) it has complied and will comply with Data Protection Laws; (ii) it has obtained and will obtain and continue to have, during the term, all necessary rights, lawful bases, authorizations, consents, and licenses for the Processing of Customer Personal Data as contemplated by the Agreement; and (iii) Telgorithm’s Processing of Customer Personal Data in accordance with the Agreement will not violate Data Protection Laws or cause a breach of any agreement or obligations between Customer and any third party.

7.2 Indemnification. Customer shall indemnify, defend, and hold harmless Telgorithm and its officers, directors, employees, and agents from and against any third-party claims to the extent arising out of Customer’s breach of Section 7.1, and any reasonable attorneys’ fees and costs awarded to such third party or incurred in defending such claims.

7.3 Limitation of Liability. Each Party’s liability arising out of or relating to this DPA — including any claim relating to Customer Personal Data or a Security Incident — is part of, and not in addition to, its liability under the Agreement, and in all cases is subject to the exclusions, disclaimers, and limitations of liability set forth in the Agreement (including the section titled “Disclaimer; Limitation of Liability”), regardless of the theory of liability.

7.4 Survival. This Section 7 shall survive termination or expiration of the Agreement.

8. Processing Details

8.1 Duration. The Processing will continue until the expiration or termination of the Agreement.

8.2 Nature and Purpose of the Processing. The purpose of the Processing of Customer Personal Data by Telgorithm is the performance of the Services.

8.3 Types of Customer Personal Data. Categories of data subjects: end users and recipients who have provided their contact information to Customer or its clients and who have opted in to receive messages, parties to voice calls placed through the Services, and Customer’s authorized personnel who use the Services. Categories of Customer Personal Data: name, telephone number, communications content (SMS and MMS message content and metadata, and voice call recordings and transcripts), voice call metadata (call detail records, including calling and called numbers and call date, time, and duration), and engagement signals.

9. Account Data

Telgorithm may Process Personal Data about Customer’s authorized users’ use of the Services (“Account Data”) in accordance with its Privacy Policy available at https://legal.telgorithm.com/en/privacy-policy (as updated from time to time). Account Data is not Customer Data.

10. HIPAA

The Services are not intended for, and Customer shall not use the Services to transmit, protected health information (“PHI”) as defined under HIPAA. Telgorithm does not act as a business associate and does not make Business Associate Agreements available for accounts governed by the Agreement. Customer acknowledges that SMS and MMS are not secure channels and that Participating Carriers do not treat their messaging services as HIPAA-compliant transport. Customer remains solely responsible for its own compliance with HIPAA and applicable Data Protection Laws.

This DPA is incorporated into and forms part of the Agreement. By accepting the Agreement — including by checking the acceptance box and clicking to accept at sign-up — Customer accepts this DPA. No separate signature is required.