Data Processing Addendum

Last Updated: June 6, 2026

This Data Processing Addendum (“DPA”) is incorporated by reference into the Terms of Service or other written agreement (“Agreement”) between SalesQuant LLC, a California limited liability company (“SalesQuant,” “Processor”), which operates the SmokeQuant platform (“SmokeQuant”), and the customer identified in the Agreement (“Customer,” “Controller”), and governs Customer Data that SmokeQuant processes on behalf of Customer.

1. Definitions

Unless otherwise defined in this DPA, capitalized terms have the meanings given in the Agreement.

• “Applicable Privacy Law” means any U.S. federal or state privacy, data protection, or data security law that applies to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, “CCPA”) and the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other U.S. states as applicable.
• “Customer Personal Data” means personal information within Customer Data that SmokeQuant processes on behalf of Customer under the Agreement.
• “Data Subject” means the identified or identifiable individual to whom Customer Personal Data relates.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• “Subprocessor” means a third party engaged by SmokeQuant to process Customer Personal Data.

Terms such as “business,” “service provider,” “consumer,” “sell,” “share,” and “process” have the meanings given in the CCPA.

2. Roles and Scope

2.1 Roles. For purposes of Applicable Privacy Law, Customer is the “business” (or controller) and SmokeQuant is the “service provider” (or processor) with respect to Customer Personal Data.

2.2 Scope. This DPA applies only to Customer Personal Data that SmokeQuant processes on behalf of Customer. It does not apply to data for which SmokeQuant is itself the business or controller (for example, information SmokeQuant collects directly from Customer’s account administrators to manage the relationship).

3. Processing of Customer Personal Data

3.1 Processing on Documented Instructions. SmokeQuant will process Customer Personal Data only on Customer’s documented instructions, which are: (a) as set forth in the Agreement and this DPA, (b) as necessary to provide and support the Services, and (c) as reasonably necessary to comply with applicable law.

3.2 No Sale or Sharing. SmokeQuant will not sell or share Customer Personal Data (as those terms are defined under the CCPA).

3.3 Purpose Limitation. SmokeQuant will not:

• Retain, use, or disclose Customer Personal Data for any purpose other than the specific purpose of performing the Services, except as permitted by Applicable Privacy Law;
• Retain, use, or disclose Customer Personal Data outside the direct business relationship between SmokeQuant and Customer; or
• Combine Customer Personal Data with personal information received from or on behalf of another person, or collected from SmokeQuant’s own interaction with a consumer, except as permitted by Applicable Privacy Law.

3.4 Compliance. SmokeQuant will comply with applicable obligations under Applicable Privacy Law and will provide the same level of privacy protection as required of a business under the CCPA.

3.5 Notice of Non-Compliance. SmokeQuant will notify Customer if it determines it can no longer meet its obligations under Applicable Privacy Law.

3.6 Right to Audit. Customer may take reasonable and appropriate steps to ensure that SmokeQuant uses Customer Personal Data in a manner consistent with Customer’s obligations under Applicable Privacy Law, including by requesting certifications or a current third-party audit report (such as a SOC 2 report, when available).

4. Subject Matter, Duration, and Categories

4.1 Subject Matter. Provision of the Services as described in the Agreement.

4.2 Duration. The term of the Agreement plus the period required for deletion or return of Customer Personal Data.

4.3 Nature and Purpose. Hosting, storing, processing, analyzing, transmitting, and otherwise handling Customer Personal Data as needed to provide the Services.

4.4 Categories of Data Subjects. Customer’s prospects, leads, contacts, customers, employees, representatives, and other individuals whose personal information Customer uploads to or creates in the Services.

4.5 Categories of Customer Personal Data. May include: name; business name; job title; business email address; business phone number; mailing address; communications content; notes and tags entered by Customer; usage and engagement data; and other information Customer chooses to upload.

4.6 Sensitive Data. Customer agrees not to upload sensitive personal information (such as Social Security numbers, financial account numbers, precise geolocation, health information, or biometric data) to the Services unless expressly agreed in writing.

5. Data Subject Rights

5.1 Cooperation. SmokeQuant will provide reasonable assistance to Customer in responding to requests from Data Subjects to exercise their rights under Applicable Privacy Law, including rights of access, deletion, correction, portability, and opt-out.

5.2 Direct Requests. If SmokeQuant receives a request from a Data Subject directly, SmokeQuant will promptly inform Customer and will not respond to the request except on Customer’s instructions or as required by law.

6. Security

6.1 Technical and Organizational Measures. SmokeQuant will implement and maintain reasonable and appropriate technical, administrative, and physical measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. Current measures include:

• Encryption of Customer Personal Data in transit (TLS 1.2 or higher)
• Encryption of Customer Personal Data at rest for database storage
• Role-based access controls with least-privilege principles
• Authentication requirements for all personnel with access to Customer Personal Data
• Regular security patching of infrastructure
• Logging and monitoring of access to production systems
• Business continuity and disaster recovery procedures
• Secure software development practices

6.2 Personnel. SmokeQuant will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and have received appropriate privacy and security training.

7. Personal Data Breach

7.1 Notification. SmokeQuant will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

7.2 Information Provided. The notification will include, to the extent known: (a) the nature of the breach, (b) the categories and approximate number of Data Subjects affected, (c) the likely consequences, and (d) measures taken or proposed to address the breach and mitigate its effects.

7.3 Cooperation. SmokeQuant will reasonably cooperate with Customer’s investigation and response, and will assist Customer in meeting Customer’s own breach notification obligations under Applicable Privacy Law.

8. Subprocessors

8.1 General Authorization. Customer grants SmokeQuant general authorization to engage Subprocessors to process Customer Personal Data, subject to the requirements of this Section 8.

8.2 Current Subprocessors. A current list of Subprocessors is available at https://smokequant.com/subprocessors (the “Subprocessor Page”).

8.3 Notification of New Subprocessors. SmokeQuant will notify Customer of any intended changes to Subprocessors at least fifteen (15) days before the change takes effect, by updating the Subprocessor Page and, at Customer’s request, by email.

8.4 Objection. Customer may object to a new Subprocessor for reasonable data protection grounds by notifying SmokeQuant within ten (10) days of notification. The parties will work together in good faith to resolve the objection. If the objection cannot be resolved, Customer may terminate the affected portion of the Agreement.

8.5 Subprocessor Obligations. SmokeQuant will impose on each Subprocessor data protection obligations materially equivalent to those in this DPA. SmokeQuant remains liable to Customer for the performance of each Subprocessor’s obligations.

9. International Transfers

SmokeQuant processes Customer Personal Data in the United States only. SmokeQuant will not transfer Customer Personal Data outside the United States without Customer’s prior written consent.

10. Deletion or Return of Customer Personal Data

10.1 On Termination. Upon termination or expiration of the Agreement, SmokeQuant will, at Customer’s choice, delete or return to Customer all Customer Personal Data, unless retention is required by applicable law.

10.2 Retention Period. Unless Customer requests deletion earlier, SmokeQuant will retain Customer Personal Data for up to thirty (30) days after termination to allow for data export, after which SmokeQuant will delete Customer Personal Data from active systems. Residual copies in backups will be deleted in the normal course of backup rotation, typically within ninety (90) days.

10.3 Certification. Upon Customer’s written request, SmokeQuant will provide written certification of deletion.

11. Conflict

In the event of any conflict between this DPA and the Agreement with respect to the processing of Customer Personal Data, this DPA controls.

12. Liability

The liability provisions of the Agreement apply to this DPA. The aggregate liability of each party under the Agreement and this DPA is governed by and subject to the limitations in the Agreement.

13. Changes

SmokeQuant may update this DPA from time to time, provided that any update will not materially reduce the protections for Customer Personal Data. SmokeQuant will post the updated DPA at https://smokequant.com/dpa and notify Customer of material changes.

14. Contact

For questions about this DPA or to submit a request covered by it:

Email: support@smokequant.com