Earn 20% per user every month no limit, no expiration. Lifetime offer →

Data Processing Addendum

Last Updated: June 23, 2026

Company: Meeze Technologies · Contact: hello@meeze.io

This Data Processing Addendum ("DPA") is entered into by and between Meeze Technologies ("Meeze", "Processor", "Service Provider") and the customer identified in the applicable Subscription Agreement, Terms of Service, Order Form, or Master Services Agreement ("Customer").

This DPA forms part of and supplements the Agreement between the Parties. This DPA applies whenever Meeze Processes Customer Personal Data on behalf of Customer in connection with the provision of the Services.

In the event of any conflict between this DPA and the Agreement regarding the Processing of Personal Data, the terms of this DPA shall prevail.

This DPA shall become effective on the Effective Date of the Agreement and shall remain in force until termination of the Agreement.

1. Definitions

For purposes of this DPA: "Applicable Data Protection Law" means all applicable privacy, data protection, cybersecurity, and electronic communications laws and regulations, including but not limited to the GDPR, UK GDPR, CCPA, CPRA, and any applicable state, federal, or international privacy laws. "Controller" means the entity that determines the purposes and means of Processing Personal Data. "Processor" means the entity that Processes Personal Data on behalf of a Controller. "Customer Personal Data" means Personal Data Processed by Meeze on behalf of Customer through the Services. "Data Subject" means an identified or identifiable natural person. "GDPR" means Regulation (EU) 2016/679. "Personal Data" means any information relating to an identified or identifiable individual. "Process" or "Processing" means any operation performed on Personal Data including collection, storage, organization, transmission, analysis, modification, retrieval, disclosure, deletion, or destruction. "Security Incident" means any confirmed unauthorized access, acquisition, disclosure, alteration, destruction, or loss of Customer Personal Data Processed by Meeze. "Services" means the CRM, AI assistants, AI voice agents, automation tools, marketing tools, customer communication services, integrations, and related software services provided by Meeze. "Subprocessor" means any third party engaged by Meeze to Process Customer Personal Data on Customer's behalf. "UK GDPR" means the GDPR as incorporated into United Kingdom law.

2. Data Processing and Protection

2.1 Processing Instructions

Meeze shall Process Customer Personal Data solely:

To provide the Services;
In accordance with Customer's documented instructions;
As required by Applicable Data Protection Law.

Meeze shall not: • Sell Customer Personal Data; • Share Customer Personal Data for cross-context behavioral advertising; • Use Customer Personal Data for purposes unrelated to providing the Services; • Disclose Customer Personal Data except as authorized by Customer or required by law.

2.2 Scope of Processing

Customer instructs Meeze to Process Customer Personal Data for:

CRM management
Lead management
Sales pipeline management
Appointment scheduling
Workflow automation
Email communications
SMS communications
AI chatbot interactions
AI voice assistant interactions
Customer support
Reporting and analytics
Third-party integrations authorized by Customer

2.3 Compliance

Each Party shall comply with its respective obligations under Applicable Data Protection Law. Customer remains responsible for obtaining all necessary consents and providing all legally required privacy notices to Data Subjects.

2.4 Confidentiality

Meeze shall ensure that all employees, contractors, and personnel authorized to Process Customer Personal Data:

Are bound by confidentiality obligations;
Receive appropriate privacy and security training;
Access Personal Data only as necessary to perform their duties.

2.5 Security Measures

Meeze shall maintain appropriate technical and organizational measures designed to protect Customer Personal Data. Technical Controls:

Encryption in transit using TLS
Encryption at rest
Role-based access controls
Multi-factor authentication
Network monitoring
Audit logging
Backup and disaster recovery procedures

Organizational Controls: • Security awareness training • Access reviews • Vendor management procedures • Incident response procedures Meeze may update its security measures from time to time provided that such updates do not materially reduce the overall level of protection.

2.6 Data Retention and Deletion

Upon termination of the Services and upon written request from Customer:

Meeze shall return Customer Personal Data in a commercially reasonable format; or
Securely delete Customer Personal Data.

Meeze may retain Personal Data where required by applicable law, regulatory obligations, dispute resolution requirements, or legitimate business purposes. Archived backups shall be securely isolated and deleted according to Meeze's backup retention policies.

2.7 AI Processing

Where Customer utilizes AI-powered features, including AI assistants, AI chatbots, AI voice agents, and workflow automation:

Customer remains responsible for the content submitted to the Services;
Meeze processes AI interaction data solely for providing and improving the Services;
Meeze does not use Customer data to train public foundation models unless expressly agreed in writing;
AI-generated outputs may require human review and verification.

3. Data Subject Rights Assistance

Customer is responsible for responding to Data Subject requests. To the extent required by Applicable Data Protection Law and reasonably possible, Meeze shall assist Customer in responding to requests relating to:

Access
Correction
Deletion
Restriction
Portability
Objection

If Meeze receives a request directly from a Data Subject regarding Customer Personal Data, Meeze may direct the individual to Customer unless otherwise required by law.

4. Security Incident

4.1 Notification

Meeze shall notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The notification shall include, where available:

Nature of the incident
Categories of affected data
Estimated number of affected records
Measures taken to mitigate the incident
Recommended actions for Customer

Notification does not constitute an admission of fault or liability.

4.2 Mitigation

Meeze shall take commercially reasonable measures to:

Investigate the incident
Contain the incident
Mitigate potential harm
Prevent recurrence

5. Audits

Upon reasonable written request, Meeze shall provide information reasonably necessary to demonstrate compliance with this DPA. Such information may include:

Security policies
Available security information
Relevant data-processing information

Customer may request a reasonable audit no more than once per calendar year, subject to: • Confidentiality obligations • Reasonable notice • Non-disruption of Meeze operations

6. Subprocessors

Customer authorizes Meeze to engage Subprocessors as necessary to provide the Services. Subprocessors may include providers of:

Cloud infrastructure
AI services
Communication services
Payment processing
Customer support
Analytics services

Meeze shall maintain written agreements with Subprocessors that provide protections substantially similar to those contained in this DPA. Meeze remains responsible for the performance of its Subprocessors.

7. International Data Transfers

Where Customer Personal Data is transferred internationally, Meeze shall implement appropriate safeguards including:

Standard Contractual Clauses (SCCs)
UK International Data Transfer Addendum (UK IDTA)
Other lawful transfer mechanisms recognized by Applicable Data Protection Law

8. Limitation of Liability

Each Party's liability arising from this DPA shall be subject to the liability limitations and exclusions set forth in the Agreement.

9. Miscellaneous

This DPA forms part of the Agreement and shall be governed by the governing law provisions set forth in the Agreement. If any provision of this DPA is determined to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. Meeze may update this DPA from time to time where reasonably necessary to comply with Applicable Data Protection Law.

Attachment 1 – Scope of Processing

Subject Matter

Provision of CRM, AI, automation, communication, and customer engagement services.

Duration

For the duration of the Agreement and any applicable retention period.

Categories of Data Subjects

Customer employees
Customer representatives
Leads
Prospects
Clients
End users
Website visitors

Processing Activities

Collection
Recording
Storage
Organization
Analysis
Transmission
Retrieval
Automation
Reporting
Deletion

Purpose of Processing

To provide the Meeze platform, CRM services, AI services, workflow automation, communication services, integrations, customer support, analytics, and related functionality.