Data Processing Addendum

Terms used in this DPA have the meanings given in the UK GDPR / EU GDPR (as applicable), the CCPA, and the master subscription agreement between the parties. In addition:

• "Customer Personal Data" means any Personal Data that Warm AI processes on behalf of the Customer in providing the Services.
• "Services" means the Warm AI products and APIs the Customer is licensed to use under the master subscription agreement, including the tracker script, identification APIs, partner APIs, and supporting infrastructure.
• "Sub-processor" has the meaning given in Article 28 of the UK / EU GDPR.

• Customer is the Data Controller with respect to Customer Personal Data. Customer determines the purposes and means of processing.
• Warm AI is the Data Processor with respect to Customer Personal Data. Warm AI processes Customer Personal Data only on documented instructions from the Customer, except where otherwise required by applicable law.
• Where Warm AI processes data for its own administrative purposes (e.g. billing, account management, security monitoring), Warm AI is an independent Controller for that limited processing.

The subject matter of processing is the identification of website visitors and provision of the related Warm AI Services. Processing continues for the duration of the master subscription agreement, plus any retention period required for billing, audit, or legal compliance.

Warm AI processes Customer Personal Data to:

• Identify the company and (where permitted) individual behind anonymous website visitors;
• Deliver real-time and historical visitor identification data to the Customer via dashboard, API, and webhook;
• Operate the underlying infrastructure (logging, monitoring, billing, support).

Visitors to the Customer's website(s) where the Warm AI tracker is installed, and the Customer's own employees who use the Warm AI dashboard.

• IP address, user-agent string, browser metadata
• Session and page-view event data
• For US visitors only: business email, full name, LinkedIn profile URL, job title, employer firmographics (via sub-processor Retention.com / RB2B, server-side geofenced to US visitors)
• For Customer users: account email, login records, billing details (last 4 of card via Stripe — Warm AI never sees full card numbers)

The Customer instructs Warm AI to process Customer Personal Data only:

• As necessary to provide the Services in accordance with the master subscription agreement;
• As documented in this DPA;
• As otherwise instructed in writing by the Customer.

Warm AI will inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

The Customer authorises Warm AI to engage Sub-processors to provide the Services. The current list of Sub-processors is published at getwarmai.com/sub-processors.

Warm AI will:

1. Maintain a written agreement with each Sub-processor imposing data protection obligations substantially equivalent to those in this DPA;
2. Remain liable to the Customer for the acts and omissions of its Sub-processors;
3. Provide at least 30 days' notice to the Customer before engaging a new Sub-processor that processes Customer Personal Data, via the change-notification list (subscribe by emailing compliance@warmai.uk);
4. Allow the Customer to object to a new Sub-processor within the notice period. If Warm AI cannot accommodate the objection, the Customer may terminate the affected Services.

Warm AI implements appropriate technical and organisational measures to protect Customer Personal Data, including:

• TLS 1.2+ for all data in transit
• Encryption at rest for stored data (AES-256 via Supabase and Cloudflare R2)
• Access controls and least-privilege for engineering staff
• Logging and monitoring of administrative access
• Regular review of sub-processor security posture
• Defined incident response procedures

A full description of current security measures is available on request to compliance@warmai.uk.

Where Customer Personal Data is transferred outside the UK / EEA, Warm AI relies on:

• Adequacy decisions where available; or
• The UK International Data Transfer Addendum to the EU Standard Contractual Clauses (UK Addendum) and / or the 2021 EU Standard Contractual Clauses (Modules 2 and 3 as applicable), pre-executed with each Sub-processor whose processing involves such a transfer.

A copy of executed SCCs / UK Addendum with any given Sub-processor is available on request.

Warm AI will assist the Customer in responding to requests from data subjects exercising rights under applicable data protection law (access, rectification, erasure, restriction, portability, objection). Customer requests should be sent to compliance@warmai.uk; Warm AI will respond within 30 days of receipt.

For visitor opt-out specifically (CCPA "Do Not Sell or Share"), see getwarmai.com/ccpa-opt-out.

Warm AI will notify the Customer without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data breach affecting Customer Personal Data. The notification will include the information required by Article 33(3) UK / EU GDPR to the extent then known.

The Customer (or an independent auditor mandated by the Customer) may audit Warm AI's compliance with this DPA no more than once in any 12-month period, on at least 30 days' written notice, during business hours, and subject to reasonable confidentiality obligations. Warm AI may satisfy audit rights by providing recent third-party audit reports or attestations where available.

Upon termination of the master subscription agreement, Warm AI will return or delete Customer Personal Data within 90 days, except where retention is required by law (e.g. tax records, billing). On written request before deletion, Warm AI will provide an export of Customer Personal Data in machine-readable format.

This DPA is governed by the laws of England and Wales. Any dispute arising under this DPA is subject to the exclusive jurisdiction of the courts of England and Wales.

In the event of conflict between this DPA and the master subscription agreement, the terms of this DPA take precedence to the extent the conflict concerns the processing of Customer Personal Data.

• Warm AI Ltd — registered in England and Wales, company number 16672983
• Registered office: 107 Highfield Lane, Oving, Chichester, PO20 2NN
• ICO registration: ZC135250
• Privacy contact: compliance@warmai.uk

• Sub-processors list — current third parties engaged
• GDPR & Privacy overview — plain-English summary
• CCPA opt-out — for California visitors
• Cookies & Consent integration guide — for customers implementing the tracker