Data Processing Addendum

Parties and relationship to Terms

This Data Processing Addendum (“DPA”) is between the Customer and TEAL Infotech (proprietorship of Varinder Pal Singh, GSTIN 03BQPPS8444C1ZM). It applies when LeadArivo processes Customer Data on the Customer’s instructions. It forms part of the Terms of Service. For a signed copy, email info@leadarivo.com.

This DPA does not mean LeadArivo is certified under GDPR, ISO 27001 or similar schemes. International transfer clauses (including Standard Contractual Clauses) are not attached to this public page and would require separate legal adoption.

Roles, purpose and duration

For Customer Data, Customer determines purposes and instructions as controller / Data Fiduciary where applicable. TEAL Infotech acts as processor / Data Processor for that instructed processing, including hosting, security, support, backups and enabled AI or integration features. TEAL Infotech separately determines purposes for its own website, account, billing and security records under the Privacy Policy.

Processing covers the subscription or trial and the agreed return/deletion arrangements. Any wind-down period, legally retained records and backup/provider limitations must be identified for the account; no universal retention or erasure deadline is stated here.

Categories of data and people

Customer Data typically includes names, contact details, enquiry content, source/channel labels, Assignee, follow-up, activity and outcome fields the Customer chooses to store. Data subjects are usually the Customer’s leads, contacts, staff (Authorized Users) and other people the Customer records.

Customer must not instruct us to process special-category health data or children’s data unless a written agreement says otherwise. LeadArivo is not offered as a HIPAA product on this website.

Instructions, confidentiality and security

Customer instructions must be documented, including enabled features, authorized integrations and any transfer instructions. We will process Customer Data on those instructions unless applicable law requires otherwise, with notice where legally permitted. Tell us if an instruction changes or involves data outside the agreed service scope.

Access to Customer Data is to be limited to authorized personnel subject to contractual or statutory confidentiality obligations. This is a processing obligation; this page does not attest that every personnel agreement or Production access control has been independently verified. Technical measures and their verified scope are described on the Security page.

Subprocessors, requests and incidents

Use of a Customer Data subprocessor requires authorization under the applicable customer agreement and appropriate protective contractual obligations. We remain responsible for the processing we entrust to them under that agreement. The Subprocessors and recipients page distinguishes these suppliers from website recipients and customer-connected platforms. Production providers and their countries/contracts still require verification; this page is not a complete supplier attestation.

Before a material subprocessor change, the applicable agreement must identify the notice route and an opportunity to raise a reasoned data-protection objection. Contact us for the verified provider list and agreed notice/objection process before approving a provider-dependent workflow. No unverified notice period or automated notification system is promised here.

We will assist with reasonable data-subject requests that concern Customer Data we process, after verifying the request. Customer is primarily responsible for requests from its own leads.

If we become aware of a personal-data breach affecting Customer Data, we will notify the Customer without undue delay using account or notice email, with information we can share without increasing security risk.

We will provide reasonable assistance with applicable security and breach obligations, including available information about affected processing, containment and recovery, and cooperation on data-protection assessments where required. Assistance is subject to verified facts, lawful restrictions and the applicable agreement; no fixed incident response SLA is offered by this page.

Return, deletion, audits and liability

For Google/YouTube-derived data, the specific recipients, use, refresh and deletion rules in the Privacy Policy and Data Deletion page apply. General retention or wind-down wording in this DPA does not extend the applicable Google/YouTube deadlines.

On verified Customer instruction or termination, Customer may request return or deletion of eligible Customer Data under an agreed scope and schedule. We must identify records retained under applicable law or a justified legal hold and restrict their use. Backups follow their verified expiry arrangements; external-provider copies, attachments, exports, authorization revocation and billing cancellation require separate steps. Database deletion alone is not confirmation that all those steps are complete. We do not promise immediate erasure of every copy or confirm deletion until the required steps have been verified.

The Data Deletion page explains the available request channels and distinguishes deleting LeadArivo-stored data from disconnecting an integration or deleting data held independently by a connected provider.

We will provide information and reasonable cooperation needed to demonstrate the processing obligations under the applicable agreement and law. Audit arrangements, including any inspection required by applicable law, must protect other customers, confidentiality and service security and be agreed with the Customer. Public trust pages alone are not a substitute for evidence or mandatory audit rights.

Liability under this DPA follows the limitation of liability in the Terms, except where applicable data-protection law does not allow that limit.