How we work together.

Version 1.0 — Effective: ________, 2026

Introduction

This Data Processing Addendum ("DPA") supplements and is incorporated into the RevenueBase Terms of Service ("Terms"). Capitalized terms used but not defined in this DPA have the meanings given in the Terms.

When this DPA applies. This DPA becomes effective when you execute it — by checking the applicable box on an Order Form, signing a separate DPA acceptance form, or other written acceptance — and applies when:

(a) You are subject to the GDPR, UK GDPR, CCPA/CPRA, or a similar data protection law that imposes specific obligations on how you handle personal data you receive or disclose in connection with a data licensing arrangement; or

(b) You process personal data included in the Licensed Materials on behalf of your own clients (for example, as a marketing agency, SDR-as-a-service firm, or platform operator).

In the event of a conflict between this DPA and the Terms regarding the processing of personal data, this DPA controls.

1. Definitions

In this DPA:

"Controller" means a party that determines the purposes and means of processing personal data.

"Data Subject" means the natural person to whom Personal Data relates — in the context of the Licensed Materials, primarily the business professionals whose contact information is included in our database.

"EU SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries approved by the European Commission under Decision 2021/914/EU, in the applicable module.

"GDPR" means the EU General Data Protection Regulation (Regulation (EU) 2016/679) and, where applicable, the UK GDPR (as defined in the UK Data Protection Act 2018).

"Personal Data" means any information relating to an identified or identifiable natural person, including "personal information" as defined under the CCPA/CPRA and equivalent terms under other applicable privacy laws.

"Personal Data Breach" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data included in the Licensed Materials that you hold or control.

"Processor" means a party that processes Personal Data solely on behalf of and under the instructions of a Controller.

"Processing" means any operation or set of operations performed on Personal Data, including collection, storage, use, disclosure, alteration, and deletion.

"Security Incident" means any confirmed Personal Data Breach or any unauthorized access to systems in which Licensed Materials are stored.

"Sub-processor" means a third party engaged by you to process Personal Data from the Licensed Materials on your behalf and in connection with your obligations under this DPA.

"Submitted Data" has the meaning given in the Terms (Section 1): data you submit to or through the Platform, including API inputs, uploads, and records synced through integrations you enable.

"UK GDPR" means the GDPR as retained in UK law under the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

All other capitalized terms have the meanings given in the Terms.

2. Roles of the Parties

2.1 RevenueBase as Independent Controller of the Licensed Materials

RevenueBase is an independent Controller of the Personal Data in the Licensed Materials. We collect, verify, maintain, and license this data under the lawful bases described in our Privacy Policy, and we determine the purposes and means of our own processing independently of you. Nothing in this DPA makes RevenueBase a Processor of your data or of your clients' data.

2.2 Customer as Independent Controller of Received Licensed Materials

Upon your receipt of Licensed Materials, you become an independent Controller of the Personal Data contained in those materials. You independently determine how you use the Licensed Materials, for what purposes, and for how long, and you bear sole responsibility for ensuring your use complies with applicable data protection law.

Nothing in this DPA transfers RevenueBase's controller responsibility to you, nor does it make RevenueBase responsible for your downstream use of the Licensed Materials. You may not represent to a regulator, court, or third party that RevenueBase has accepted controller liability for your processing activities.

2.3 When You Act as a Processor for Your Own Clients

If you process Personal Data from the Licensed Materials on behalf of your own clients — for example, if you are an agency running outbound campaigns on a client's behalf, or a platform operator delivering data services to your subscribers — then with respect to that processing, you are acting as a Processor for those clients (who are the Controllers). Sections 6 and 7 of this DPA set out additional obligations that apply in this capacity.

2.4 Roles with Respect to Submitted Data

Submitted Data flows in the opposite direction — from you to RevenueBase — and the parties process it in two distinct capacities:

(a) Service delivery. To the extent RevenueBase processes Personal Data in your Submitted Data in order to return results to you (for example, verifying an email address you submit and returning the verification result, or matching a company record you submit and returning the enriched profile), RevenueBase processes that Personal Data on your behalf as a Processor, solely as needed to provide the Services ("Service Processing"), subject to the processor terms in Section 5.6, and without prejudice to RevenueBase's separate, independent processing under paragraph (b).

(b) Independent use under the Terms. Separately, and as licensed under Section 6.1 of the Terms, RevenueBase processes Submitted Data as an independent Controller for the purposes described in Section 6 of the Terms and our Privacy Policy — retaining, verifying, and using Submitted Data to operate, provide, maintain, and improve RevenueBase's products, services, and data. RevenueBase determines the purposes and means of this processing, is responsible for its own compliance with applicable law in this capacity, and does not act as your Processor with respect to it.

(c) Your responsibilities. As the disclosing Controller (or, where Section 2.3 applies, as Processor authorized by your client Controllers), you are responsible for ensuring that your disclosure of Personal Data to RevenueBase in Submitted Data is lawful — including providing any required notices and establishing a lawful basis or obtaining any required permissions — as set out in Section 6.4 of the Terms.

3. Personal Data in the Licensed Materials

3.1 Categories of Data Subjects

The Licensed Materials contain Personal Data relating to business professionals: individuals whose professional contact information has been collected from publicly available sources, licensed from third-party data providers, or received and independently verified as described in our Privacy Policy, and who are employed by companies worldwide.

3.2 Categories of Personal Data

The Licensed Materials may contain the following categories of Personal Data about business professionals:

• - First and last name
• - Job title, department, and seniority level
• - Work email address and email deliverability status
• - Direct phone number and mobile phone number
• - Employer name, business address, and website
• - LinkedIn profile URL
• - Professional verification timestamps

The Licensed Materials are not intentionally designed to include special categories of Personal Data (as defined under Article 9 GDPR), such as health data, racial or ethnic origin, religious beliefs, or political opinions. If you discover what you believe to be special category data in the Licensed Materials, you must notify us promptly at privacy@revenuebase.ai, and must not process that data pending our joint assessment.

3.3 Nature and Purpose of Processing

The Licensed Materials are licensed to you for the purposes permitted under your license tier as set out in the Terms (Section 4). You may not process Personal Data in the Licensed Materials for purposes that are incompatible with those permitted under your license tier.

4. Your Obligations as an Independent Controller

As an independent Controller of received Licensed Materials, you must:

(a) Establish a lawful basis. Determine and maintain a valid legal basis for each processing activity you conduct using the Licensed Materials. For B2B outreach, this will typically be legitimate interests; for other uses, you must assess what applies.

(b) Provide notice to Data Subjects. Where required by applicable law, provide Data Subjects with appropriate notice that their personal data may have been sourced from a third-party data provider and inform them of their rights, including the right to object to direct marketing.

(c) Respect opt-out and erasure requests. If a Data Subject contacts you to opt out of marketing, object to processing, or request deletion of their data: (i) honor the request within the timeframe required by applicable law; (ii) notify us at privacy@revenuebase.ai within five (5) business days if the request requires us to add the individual to our suppression list; and (iii) cease processing that individual's data from the Licensed Materials for the requested purpose.

(d) Implement security safeguards. Apply the technical and organizational security measures described in Section 8.1 of this DPA to all Personal Data received from us.

(e) Comply with marketing and communications laws. Ensure your use of the Licensed Materials for outbound calling, emailing, or texting complies with the TCPA, National Do Not Call Registry, CAN-SPAM Act, and any equivalent applicable law, as further addressed in Section 10.3 of the Terms.

(f) Flow-down to sub-licensees. Where you make the Licensed Materials available to third parties under a permitted license tier (Sections 4.2(a), 4.2(b), or 4.2(c) of the Terms), ensure those third parties are bound by data protection obligations at least as protective as this DPA and the Terms.

5. Submitted Data

5.1 Scope of Personal Data in Submitted Data

Submitted Data may include business contact Personal Data of your prospects, customers, or contacts — such as names, work email addresses, job titles, employer information, business phone numbers, and related professional information — that you submit through API calls, file uploads, or integrations you enable.

5.2 Prohibited submissions

You must not submit the categories of data prohibited by Section 6.5 of the Terms (government identifiers; financial account, payment, or credential data; health, medical, or biometric data; data about minors; or other sensitive or special-category data). RevenueBase may delete prohibited data without notice and has no liability for prohibited data you submit.

5.3 RevenueBase's handling

In its independent-Controller capacity under Section 2.4(b), RevenueBase will: (a) process Personal Data in Submitted Data in accordance with applicable law, this DPA, and its Privacy Policy; (b) apply verification and quality processes before incorporating records derived from Submitted Data into the Licensed Materials; (c) honor Data Subject rights requests directed to RevenueBase with respect to data it holds as a Controller, including maintaining a suppression mechanism; and (d) not resell or redistribute your Submitted Data as a standalone dataset attributable to you, and not identify you as the source of any Submitted Data, as set out in Section 6.2 of the Terms.

5.4 Duplicate and independently sourced data

You acknowledge that RevenueBase may receive the same or similar Personal Data from multiple customers or from its own independent collection and verification processes. Nothing in this DPA restricts RevenueBase's processing of Personal Data that it obtains independently of your Submitted Data, even where that data is identical to data you submitted.

5.5 No processing instructions

For clarity, RevenueBase's independent-Controller processing under Section 2.4(b) is not performed on your documented instructions, and you are not responsible for RevenueBase's compliance in that capacity, except for your disclosure-side obligations in Sections 2.4(c) and 5.2.

5.6 Processor Terms for Service Processing

To the extent RevenueBase performs Service Processing (Section 2.4(a)), the following terms apply:

(a) Instructions. RevenueBase will process the relevant Personal Data only to verify, match, enrich, and return results for your submissions, and to provide, secure, and support the Services, as documented in the Agreement — these constitute your complete documented instructions. RevenueBase will inform you if, in its opinion, an instruction infringes applicable data protection law. RevenueBase's independent processing under Section 2.4(b) is not performed on your instructions and is outside the scope of this Section 5.6.

(b) Confidentiality. RevenueBase ensures that persons it authorizes to perform Service Processing are bound by appropriate confidentiality obligations.

(c) Security. RevenueBase implements and maintains the technical and organizational measures described in Section 8.2.

(d) Sub-processors. You provide general written authorization for RevenueBase to engage sub-processors for Service Processing. The current sub-processor list is available at revenuebase.ai/subprocessors. RevenueBase will provide at least thirty (30) days' notice of any addition or replacement (via that page or email), during which you may object on reasonable data-protection grounds; if the parties cannot resolve a reasonable objection, you may terminate the affected Services. RevenueBase imposes data-protection obligations on sub-processors consistent with this Section 5.6 and remains responsible for their performance.

(e) Assistance. Taking into account the nature of the processing, RevenueBase will provide reasonable assistance with data subject requests concerning Service Processing and with your obligations under Articles 32 to 36 GDPR, to the extent the relevant information is available to RevenueBase.

(f) Deletion and return. On your written request, or on termination of the Terms, RevenueBase will delete Personal Data held solely for Service Processing, except as retention is required by applicable law. For clarity, this obligation does not apply to Personal Data RevenueBase processes as an independent Controller under Section 2.4(b) (including records incorporated into its database after verification), whose handling is governed by the Terms (Section 6) and the Privacy Policy.

(g) Audit. RevenueBase will make available information reasonably necessary to demonstrate compliance with this Section 5.6 and, where required by applicable law, allow for audits, subject to: no more than once per twelve (12) months (absent a Personal Data Breach affecting Service Processing or a supervisory-authority requirement); at least sixty (60) days' written notice; conduct by you or a mutually agreed independent auditor (not a RevenueBase competitor) bound by confidentiality, during business hours and without unreasonable disruption; and at your expense. RevenueBase may satisfy audit requests by providing its then-current SOC 2 Type II report or equivalent third-party certification, and you agree to accept such reports to the extent they reasonably address the audit objective.

6. Additional Obligations When You Act as a Processor for Your Clients

The following additional obligations apply when you process Personal Data from the Licensed Materials on behalf of your own clients (the Controllers):

6.1 Documented Instructions

You may only process Personal Data from the Licensed Materials pursuant to your clients' documented and lawful instructions. If you receive instructions from a client that you believe would cause you or RevenueBase to violate applicable data protection law, you must: (a) notify the client before carrying out the instructions; and (b) notify us at privacy@revenuebase.ai if you believe the instructions would expose us to legal risk.

6.2 Flow-Down to Clients

You must ensure that each of your clients, as the relevant Controller, is bound by data protection obligations that are at least as protective of Data Subjects as the Terms and this DPA. You are responsible for your clients' compliance with those obligations.

6.3 Confidentiality of Processing

You must ensure that each person you authorize to process Personal Data from the Licensed Materials on behalf of your clients is bound by a written confidentiality obligation.

6.4 Sub-processors

(a) Authorization. You may engage Sub-processors to assist in processing Personal Data from the Licensed Materials, provided you comply with this Section 6.4.

(b) Written agreement. You must enter into a written agreement with each Sub-processor that imposes data protection obligations equivalent to those in this DPA and that limits the Sub-processor's processing to what is necessary for the services it provides to you.

(c) Notification to RevenueBase. You must notify us of any Sub-processors you engage to process Personal Data from the Licensed Materials by emailing privacy@revenuebase.ai before the Sub-processor begins processing. We reserve the right to object to a Sub-processor within fifteen (15) days of notification if we reasonably determine that the Sub-processor poses a material compliance or security risk. If we object and you cannot resolve the concern, you must discontinue the Sub-processor's processing of Licensed Materials.

(d) Your liability. You remain fully liable to us and to your clients for the acts and omissions of your Sub-processors to the same extent as if you had performed the processing yourself.

7. Data Subject Rights

7.1 Requests Directed to You

If a Data Subject submits a rights request to you (including requests for access, rectification, erasure, restriction, portability, or to object to processing), you must:

(a) Respond within the timeframe required by applicable law (for GDPR requests, within one (1) month, extendable by two (2) months for complex requests with notice to the Data Subject);

(b) Notify us at privacy@revenuebase.ai within five (5) business days of receiving a request for erasure or restriction, so we can update our suppression list accordingly; and

(c) Cooperate with us in responding to the request to the extent necessary.

7.2 Requests Directed to Us

If a Data Subject submits a rights request directly to us that concerns Personal Data you hold, we will forward the request to you promptly and provide reasonable assistance at no additional charge. You must respond to the Data Subject directly and in compliance with applicable law. Requests concerning Personal Data RevenueBase holds as an independent Controller (including data derived from Submitted Data and incorporated into our database) are handled by RevenueBase as described in our Privacy Policy.

7.3 Our Assistance

We will provide you with reasonable technical and organizational assistance to help you fulfill your obligations regarding Data Subject rights, to the extent we hold information or controls relevant to the request. We may charge a reasonable fee for assistance beyond what is reasonable in scope.

8. Security

8.1 Your Security Obligations

You must implement and maintain appropriate technical and organizational measures to protect Personal Data included in the Licensed Materials against unauthorized access, disclosure, alteration, loss, or destruction. At a minimum, these measures must include:

• Encryption of Personal Data in transit (using TLS 1.2 or higher) and at rest (using AES-256 or equivalent);
• Access controls that limit access to Personal Data to authorized personnel on a need-to-know basis, including multi-factor authentication for access to systems containing the Licensed Materials;
• Regular security risk assessments and vulnerability testing; and
• Documented procedures for detecting, investigating, and responding to Security Incidents.

Your security measures must be appropriate to the nature of the Personal Data, the volume of records you hold, and the risks of your processing activities, and must be at least as protective as the measures you use for your own most sensitive business data.

8.2 Our Security Obligations

We implement and maintain appropriate technical and organizational security measures to protect the Licensed Materials before and during delivery to you, and to protect Submitted Data on our systems. Details of our current security practices are available upon request to legal@revenuebase.ai. We perform annual security assessments and maintain SOC 2 controls over our production environment.

9. Personal Data Breach Notification

9.1 Notification by You to Us

If you become aware of a Security Incident — including any unauthorized access to, loss of, disclosure of, or destruction of Personal Data from the Licensed Materials that you hold — you must notify us at privacy@revenuebase.ai without undue delay, and in any event within seventy-two (72) hours of becoming aware. Your notification must include, to the extent then available:

(a) A description of the nature of the Security Incident, including the categories and approximate number of Data Subjects affected and the categories and approximate volume of Personal Data involved;

(b) The likely consequences of the Security Incident; and

(c) The measures taken or proposed to address the Security Incident and to mitigate its effects.

If full information is not yet available within 72 hours, provide what you have and supplement as more information becomes available.

9.2 Notification by Us to You

If we become aware of a Security Incident affecting the Licensed Materials on our systems prior to delivery, or affecting Personal Data in your Submitted Data on our systems, we will notify you without undue delay, providing sufficient detail to help you assess your own notification obligations.

9.3 Regulatory and Data Subject Notifications

Each party is responsible for its own notification obligations to supervisory authorities and Data Subjects under applicable law with respect to Personal Data it controls or holds. The parties will provide each other reasonable cooperation and information to support those notifications.

10. International Data Transfers

10.1 Transfers from Us to You (Licensed Materials)

RevenueBase maintains the Licensed Materials in the United States. If you are located in the EEA, UK, or another jurisdiction that restricts the transfer of personal data to countries that have not received an adequacy determination, the transfer of Personal Data from us to you is subject to the EU SCCs set out in Exhibit A to this DPA, which are incorporated herein by reference.

Applicable module. Where you receive Personal Data as an independent Controller (Section 2.2), Module 1 (Controller to Controller) applies. Where you receive Personal Data and process it as a Processor for your clients (Section 2.3), Module 2 (Controller to Processor) applies. In both cases, RevenueBase is the "data exporter" and you are the "data importer."

10.2 Transfers from You to Us (Submitted Data)

Where you are located in the EEA or UK (or another restricted-transfer jurisdiction) and your Submitted Data includes Personal Data, your transfer of that Personal Data to RevenueBase in the United States is covered as follows:

(a) SCCs (operative mechanism). The EU SCCs in Exhibit A apply to these transfers, with you as "data exporter" and RevenueBase as "data importer": where you act as a Controller of the Submitted Data, Module 2 (Controller to Processor) applies to Service Processing under Section 2.4(a), and Module 1 (Controller to Controller) applies to RevenueBase's independent-Controller processing under Section 2.4(b). Where you act as a Processor for your own clients (for example, as an agency), Module 3 (Processor to Processor) applies to Service Processing. For clarity, information that individuals provide directly to RevenueBase (for example, your users' own account registration data) is collected directly by RevenueBase and is not a restricted "transfer" under this Section.

(b) Data Privacy Framework (additional basis). If and for so long as RevenueBase maintains an active certification under the EU-U.S. Data Privacy Framework (and, for UK transfers, the UK Extension), the transfer may additionally rely on that adequacy mechanism.

(c) Agency submissions are service-only by default. Where you submit Personal Data as a Processor for your own clients, RevenueBase performs Service Processing only with respect to that data, and does not process it under Section 2.4(b), unless and until the relevant client (the Controller) has authorized that use, in which case that client is the appropriate Module 1 counterparty for the independent-Controller flow. You are responsible for your authority to make each transfer. (Annexes for the inbound flow to be completed at execution.)

10.3 Your Onward Transfers

If you transfer Personal Data from the Licensed Materials to a country outside the EEA, UK, or another jurisdiction with transfer restrictions, you are responsible for ensuring that transfer complies with applicable law, including by executing appropriate EU SCCs or relying on another lawful transfer mechanism. You must maintain records of your transfer mechanisms and provide them to us upon request.

11. Audit Rights

You have the right, on reasonable written notice of not less than thirty (30) days, to audit or instruct an independent third-party auditor to audit RevenueBase's compliance with this DPA, provided:

(a) Audits occur no more than once per calendar year (unless required by a data protection authority);

(b) The audit is conducted during normal business hours and in a manner that does not unreasonably disrupt our operations;

(c) The auditor is bound by appropriate confidentiality obligations; and

(d) You bear all costs of the audit.

We may satisfy this audit obligation by providing you with a current third-party security audit report, SOC 2 Type II report, or equivalent certification, and you agree to accept such reports in lieu of a direct audit to the extent they adequately address your audit objectives.

12. Retention and Deletion After Termination

12.1 Licensed Materials you retain. Following expiration or termination of the Terms, you may retain and continue to process Personal Data in Licensed Materials delivered to you during the term, to the extent permitted by Section 12.6(a) of the Terms. This DPA — including Sections 4, 7, 8, and 9 — continues to apply to retained Personal Data for as long as you retain it.

12.2 Where retention rights end. If your retention right ends under Section 12.6(a) of the Terms (for example, on termination for your uncured material breach of the license restrictions), you must, within thirty (30) days: (a) securely delete or destroy all affected Personal Data, including copies in backup or archival systems as those systems cycle; and (b) upon request, provide written certification signed by an authorized officer that deletion or destruction is complete. You may retain affected Personal Data beyond this period solely to the extent and for the duration required by applicable law, provided you: (i) notify us of the retention and its legal basis; (ii) process the retained data solely for the purpose required by law; and (iii) delete it as soon as the legal obligation no longer applies.

12.3 Data held by RevenueBase. Deletion of Personal Data RevenueBase holds for Service Processing is governed by Section 5.6(f). Personal Data RevenueBase processes as an independent Controller (including Submitted Data licensed under Section 6 of the Terms and records incorporated into its database) is retained in accordance with the Terms and our Privacy Policy.

13. Liability

Our respective liabilities under this DPA are subject to the limitations set out in Section 14 of the Terms (Limitation of Liability). This DPA does not create any additional liability beyond what is set out in the Terms.

14. Duration

This DPA is effective as of the date of your acceptance and remains in effect for as long as the Terms are in effect. It is automatically terminated upon termination of the Terms, except that the following obligations survive: Sections 2.4, 4, 5 (including 5.6(f)), 7, 8, 9, 10, 11, 12, and 13, in each case for as long as the relevant Personal Data is retained.

Exhibit A — Standard Contractual Clauses

The Standard Contractual Clauses set out in European Commission Implementing Decision 2021/914 of 4 June 2021 on Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 are incorporated herein by reference.

The applicable modules are determined as set out in Sections 10.1 and 10.2 of this DPA (the SCCs are the operative mechanism for the inbound flow; an active EU-U.S. Data Privacy Framework certification (with the UK Extension), once in place, provides an additional independent basis):

• Licensed Materials (RevenueBase → Customer): ##INLINE32## (Controller to Controller) where the Customer is an independent Controller; ##INLINE33## (Controller to Processor) where the Customer processes as a Processor for its own clients. RevenueBase is the "data exporter"; Customer is the "data importer."
• Submitted Data (Customer → RevenueBase): ##INLINE34## (Controller to Processor) for Service Processing where the Customer is a Controller; ##INLINE35## (Controller to Controller) for RevenueBase's independent-Controller processing where the Customer is a Controller; ##INLINE36## (Processor to Processor) for Service Processing where the Customer acts as Processor for its own clients (agency submissions are service-only per Section 10.2(c)). Customer is the "data exporter"; RevenueBase is the "data importer."

The following selections apply to the SCCs:

• Clause 7 (Docking clause): Does not apply.
• Clause 9 (Use of sub-processors): Option 2 (General written authorization) applies. The Customer must notify RevenueBase of intended Sub-processors as set out in Section 6.4 of this DPA.
• Clause 11 (Redress): The optional language does not apply.
• Clause 17 (Governing law): The SCCs are governed by the law of Ireland.
• Clause 18 (Choice of forum): Disputes are submitted to the courts of Ireland.
• Annex I.A (List of parties): To be completed upon execution.
• Annex I.B (Description of transfer): For the outbound flow, as set out in Sections 3.1, 3.2, and 3.3 of this DPA; for the inbound flow, as set out in Section 5.1 of this DPA.
• Annex I.C (Competent supervisory authority): The supervisory authority of the EU Member State in which the data exporter is established, or, if the data exporter is not established in an EU Member State, the Irish Data Protection Commission.
• Annex II (Technical and organizational measures): The security measures in Section 8 of this DPA constitute the technical and organizational measures for purposes of Annex II.

The complete text of the applicable EU SCC module(s), and the UK Addendum where UK transfers apply, is attached to this DPA at execution.

RevenueBase, Inc. | privacy@revenuebase.ai | 132 Adams St., Newton, MA 02460

© 2026 RevenueBase, Inc. All rights reserved.