Data Processing
Agreement

1. Definitions

"Personal Data": information relating to an identified or identifiable natural person. "Controller": the Client who determines the purposes and means of processing. "Processor": BoldPiq, acting on behalf of the Client. "Sub-Processor": third parties engaged by BoldPiq to process Personal Data in connection with the Services. "Applicable Law": includes, as applicable, the South African Protection of Personal Information Act (POPIA), EU/UK General Data Protection Regulation (GDPR/UK GDPR), the California Consumer Privacy Act (CCPA/CPRA), the Brazilian LGPD, and any other relevant data protection laws. "Data Subject": the individual to whom Personal Data relates. "Security Incident": a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by BoldPiq. "SCCs": the EU Standard Contractual Clauses (2021/914, Modules 2 and/or 3, as applicable), including any UK Addendum/IDTA and Swiss addendum where relevant.

2. Roles and Scope

The Client is the Controller. BoldPiq acts as a Processor for the limited purpose of providing services under the Agreement (e.g., CRM, website hosting, marketing automation, communication campaigns). BoldPiq shall only process Personal Data in accordance with documented instructions from the Client, unless required by law. Client instructs BoldPiq to process Personal Data solely as necessary to provide the Services and as further documented in this DPA and the Agreement. BoldPiq will promptly inform Client if, in its opinion, an instruction infringes Applicable Law. Client is responsible for the lawfulness of its instructions and for required notices/consents.

3. Processing Details

Subject Matter: processing of Client Personal Data to provide BoldPiq services. Duration: for the term of the Agreement, unless retention is required by law. Nature and Purpose: storage, transmission, and management of Personal Data for CRM, marketing, communications, and business automation. Types of Data: contact details, communications, transactional and engagement data, website content supplied by the Client, website visitor messages sent through an AI chat feature where the Client enables it, CMS user records (name, email address, role and edit history of the Client's authorised staff), and other data input by the Client. Categories of Data Subjects: Client's customers, leads, prospects, employees, and contractors as determined by the Client.

4. Security Measures

BoldPiq shall implement and maintain appropriate technical and organizational measures (TOMs) designed to protect Personal Data, including at a minimum: (a) access controls (role-based, least-privilege, unique accounts), including role-based access to the website CMS (Owner, Admin, Editor) enforced on BoldPiq's servers, one-time email codes for CMS sign-in, and a record of which user made each content change; (b) authentication (password policies; support for 2FA on staff accounts); (c) encryption (TLS in transit; encryption at rest as provided by the relevant Sub-Processor, including GoHighLevel, Cloudflare and GitHub); (d) confidentiality obligations for personnel; (e) logging and monitoring of access; (f) vulnerability management and patching on a risk-prioritized basis; (g) business continuity and disaster recovery proportional to the Services; (h) data minimization and retention controls; and (i) a documented incident response program. Security Incident Notice. BoldPiq shall notify Client without undue delay and no later than 72 hours after becoming aware of a Security Incident affecting Client Personal Data, and provide information reasonably available for Client to meet its breach-notification obligations.

5. Sub-Processors

BoldPiq engages the following Sub-Processors for delivery of its services: GoHighLevel (Zip360), USA – CRM, pipeline management, marketing automation, email/SMS communications, and AI-assisted receptionist and voice services. Cloudflare, Inc., USA (global network) – website hosting and delivery, security filtering, DNS, and the BoldPiq CMS sign-in and access-control service. GitHub, Inc. (a Microsoft company), USA – storage and version history of Client website source files and content. Resend, Inc., USA – delivery of CMS sign-in and team invitation emails. OpenRouter, Inc., USA, and the AI model provider selected through it – processing of website visitor chat messages, only where the Client enables the AI chat feature. BoldPiq restricts routing to providers that do not retain or train on that content. Hetzner Online GmbH, Germany – infrastructure for BoldPiq's self-hosted systems, including the n8n workflow automation engine. Client Personal Data processed by n8n stays within BoldPiq's controlled environment on this infrastructure. Payment processors (including Wise) – billing and transaction handling. BoldPiq will ensure each Sub-Processor provides data protection at least equivalent to this DPA. Where a Sub-Processor operates outside South Africa, appropriate transfer safeguards (including SCCs where applicable) are applied. A current list of Sub-Processors is available upon written request to support@boldpiq.com. BoldPiq will give at least 30 days' advance notice of material Sub-Processor changes. If the Client objects on reasonable data protection grounds, BoldPiq will seek an alternative, and if none is available the Client may terminate the affected Services without penalty. Client consents to BoldPiq's use of such Sub-Processors.

6. Data Subject Rights

BoldPiq will assist the Client in fulfilling obligations to respond to Data Subject requests, including rights of access, correction, deletion, objection, and portability. Requests may be directed to the Client, and BoldPiq shall support with reasonable cooperation. Data Subject requests sent directly to BoldPiq will be forwarded to the Client without undue delay.

7. International Data Transfers

Personal Data may be processed in jurisdictions where BoldPiq or its Sub-Processors operate, including the United States. Where such processing involves a restricted transfer under Applicable Law, the parties agree the SCCs (2021/914, Module 2 and/or 3 as applicable) are incorporated by reference and apply; for UK transfers, the UK Addendum/IDTA applies; and for Switzerland, the SCCs apply as adapted by the Swiss FDPIC guidance. Where required, BoldPiq will execute the SCCs upon Client request.

8. Audits and Compliance

Upon written request, BoldPiq will make available information reasonably necessary to demonstrate compliance with this DPA. Once per 12-month period, Client may conduct (at Client's cost) an audit limited to systems and processes relevant to BoldPiq's Processing of Client Personal Data, on 30 days' prior written notice, during normal business hours, and without undue disruption. BoldPiq may satisfy audit requests by providing independent third-party audit reports or certifications (where available). The annual limitation does not apply where required by law or following a verified Security Incident. Audit findings constitute BoldPiq Confidential Information.

9. Return and Deletion of Data

Upon termination or expiry of the Services, Client may request a machine-readable export of Personal Data processed by BoldPiq. Within 30 days of termination (or as otherwise required by law), BoldPiq will delete Personal Data from active systems and complete scheduled deletion from backups within 90 days thereafter, unless retention is legally required. CMS user records are deleted within 30 days of termination, unless retention is legally required. Assistance beyond standard export/deletion tooling may incur reasonable fees.

10. Liability

Each party's liability under this DPA shall be subject to the limitations of liability set out in the Agreement, except where prohibited by Applicable Law.

11. Governing Law

This DPA shall be governed by and construed in accordance with the governing law set forth in the Agreement, subject to mandatory data protection law.

12. CCPA/CPRA (U.S.)

To the extent BoldPiq processes Personal Information (as defined by CCPA/CPRA) on behalf of Client, BoldPiq acts as a Service Provider/Contractor and shall: (a) process Personal Information solely to provide the Services and as permitted by CCPA/CPRA; (b) not sell or share Personal Information; (c) not retain, use, or disclose Personal Information outside the direct business relationship with Client; (d) not combine Personal Information received from Client with other data except as permitted by CCPA/CPRA; and (e) notify Client of any legally binding request for disclosure unless prohibited by law. BoldPiq will provide reasonable assistance for Client to meet its CCPA/CPRA obligations.

13. Contact Information

Questions or requests relating to this DPA, Sub-Processors, or Data Subject rights should be directed to: BoldPiq – Data Protection Contact support@boldpiq.com

14. Order of Precedence; Amendments

In the event of conflict between this DPA and the Agreement, this DPA controls to the extent of the conflict regarding Processing of Personal Data. The parties may update this DPA by mutual written agreement or as required by changes in Applicable Law.

15. UK GDPR and EU GDPR

15.1 Application. This Section applies where the Client, or the Data Subjects whose Personal Data BoldPiq processes on its behalf, are located in the United Kingdom or the European Economic Area, or where the processing is otherwise subject to the UK GDPR or the EU GDPR. It sets out BoldPiq's obligations under Article 28(3) GDPR and supplements Sections 2 to 9. 15.2 Processor obligations (Article 28(3)). BoldPiq shall: (a) process Personal Data only on the Client's documented instructions, including with regard to international transfers, unless required to do so by law, in which case BoldPiq shall inform the Client of that legal requirement before processing unless the law prohibits it; (b) ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) take all measures required under Article 32 GDPR, as described in Section 4; (d) engage Sub-Processors only in accordance with Section 5, imposing on each the same data protection obligations as set out in this DPA by way of a written contract, and remain fully liable to the Client for each Sub-Processor's performance; (e) taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures in responding to requests to exercise Data Subject rights under Chapter III GDPR, within five (5) business days of the Client's request; (f) assist the Client in ensuring compliance with Articles 32 to 36 GDPR (security, personal data breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to BoldPiq; (g) at the Client's choice, delete or return all Personal Data at the end of the provision of the Services in accordance with Section 9, and delete existing copies unless retention is required by law; (h) make available to the Client all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits in accordance with Section 8; and (i) immediately inform the Client if, in BoldPiq's opinion, an instruction infringes the GDPR or other Union, Member State or UK data protection provisions. 15.3 Personal data breaches. BoldPiq shall notify the Client of a personal data breach without undue delay and in any event within 72 hours of becoming aware of it, with the information described in Article 33(3) GDPR to the extent available, and shall update the Client as further information becomes available. 15.4 International transfers. South Africa is not the subject of an adequacy decision under Article 45 EU GDPR or the UK's adequacy regulations. Transfers of Personal Data from the Client to BoldPiq, and onward transfers to Sub-Processors outside the UK and the EEA, are made under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 Controller to Processor and Module 3 Processor to Processor, as applicable) and, for UK data, the International Data Transfer Addendum issued by the UK Information Commissioner, each incorporated into this DPA by reference, with the Agreement serving as the signature for them. BoldPiq shall assess, and where needed supplement, the protection given by each transfer mechanism. 15.5 Records of processing. BoldPiq maintains a record of the categories of processing it carries out on behalf of the Client in accordance with Article 30(2) GDPR and shall make it available to the Client or a supervisory authority on request. 15.6 Contact. Data protection enquiries under this Section may be sent to support@boldpiq.com.

See also: Terms of Service · Refund Policy · PAIA Manual