·Apollo Integration Partner Agreement

·Last Updated: December 1, 2025

·This Integration Partner Agreement (the "Agreement") constitutes a legally binding agreement between the individual or entity accessing or using the services ("Partner") and ZenLeads, Inc. dba Apollo.io ("Apollo"). By clicking the "Accept," "Agree," "Submit," or similar button, or by accessing or using Apollo's services, platform, or website, the Partner acknowledges having read, understood, and agreed to be bound by all terms and conditions contained in this Agreement. The act of clicking the acceptance button or continuing to use the Services constitutes the Partner's electronic signature and manifests the Partner's intent to be bound by the terms of this Agreement. If the Partner does not agree to these terms, the Partner must not access or use the Services.

11. DEFINITIONS

• 1"APIs" means the application program interfaces and supporting documentation made generally available to Partner by Apollo or to Apollo by Partner, as the case may be.
• 2"Apollo Product Documentation" means the technical documentation regarding the Apollo Services generally made available to Customers, system integrators, Partners and other third parties to facilitate development work related to the Apollo Services and Apollo APIs, as well as the documentation related to Apollo Services provided by Apollo to Partner in connection with this Agreement and may include without limitation API documentation.
• 3"Apollo Services" means the suite of services that enable partners and Customers to integrate, enrich, and orchestrate go-to-market workflows via Integration with the Apollo Platform.
• 4"Customer" means a customer that has contracted for services from both Apollo and Partner via separate agreements.
• 5"Integration" means the integration from the Apollo Services to the Partner's Products
• 6"Integration Testing" means the development, testing, and validation of software integrations, APIs, or applications that connect with or utilize the Apollo Platform for the purposes of creating third-party products or services,
• 7"Intellectual Property" means patents, trademarks, copyright and trade secrets.
• 8"Mark" means each of the trademarks, service marks, logos, name graphics, trade names, trade dress, slogans and other similar devices owned by a party.
• 9"Marketing Materials" means marketing materials, graphics and other materials in paper or electronic format relating to each party's respective products and/or services.
• 10"Partner's Products" means the products and or services provided to Customers by Partner and for which the parties desire to create the Integration.
• 11"Partner Product Documentation" means the technical documentation regarding the Partner Products generally made available to customers, system integrators, Partners and other third parties to facilitate development work related to the Partner Products and Partner APIs as well as the documentation related to the Partner Products provided by Partner to Apollo in connection with this Agreement and may include without limitation API documentation.
• 12"Platform" means the software or other technology provided by or through Apollo to Partner pursuant to this Agreement, and all other software, systems, applications, interfaces, APIs, tools, software development kits (SDKs), programs, and any accompanying or related infrastructure, functionality, technology, or analytics made available by or through Apollo in connection therewith and/or which are otherwise required to access or utilize the Platform including, without limitation, all updates and derivative works thereof, the Usage Data, the Contributor Database. The Platform does not include Partner Products.
• 13"Platform Generated Information" or "PGI" means outputs created by Customer through use of the Services, including for example: (i) customized prospect lists; (ii) segmentation analyses; (iii) campaign performance reports; and (iv) other Customer-specific analytics. Platform Generated Information includes, without limitation, any modified, enhanced, filtered, analyzed, segmented, organized, structured, or combined information derived from the Platform, Contributor Database, or Services, as well as any reports, visualizations, contact lists, prospect lists, market analyses, or other business intelligence outputs resulting from Customer's use of the Services
• 14"Contributor Database" means Apollo's proprietary database of Business Contact Information and other business information that Apollo makes available to Partner and other Apollo Customers through the Platform.
• 15"Usage Data" means data and information related to Partner's use of the Platform or Apollo's provision of the Platform, including but not limited to, system performance data, usage statistics, and data on the deliverability of communications. For the avoidance of doubt, Usage Data does not include Partner Data or any Personal Information.

22. GRANT OF LICENSE; OWNERSHIP; SUPPORT

• 1Grant of License to Partner. Subject to Partner's compliance with this Agreement, the Documentation, the License Restrictions in Section 4 below, and all applicable laws, rules, and regulations, Apollo grants to Partner for the Term of this Agreement a non-exclusive, non-transferrable, non-sublicensable license to access and use the Platform for the purpose of developing and testing Integrations and making such Integrations available to Customers.
• 2Grant of License to Apollo.
• 2.1Subject to the terms of this Agreement, Partner grants Apollo a perpetual, worldwide, transferable, non- exclusive license, together with the right to sublicense, to use, distribute (directly and indirectly), modify, extend, and make derivative works from the Integration, solely in connection with enabling Customers to use the Apollo Services as integrated with Partner's Products, including without limitation as necessary to allow mutual Customers to authenticate into their account with Partner via the Integration, to support or facilitate Partner's Integration with, and the delivery of Partner's Products via the Apollo Services and to make the Integration publicly available.
• 2.2Subject to the terms of this Agreement, Partner hereby grants Apollo a worldwide, non-exclusive, royalty-free, fully paid up, license to use those Partner APIs and Partner Product Documentation as may be necessary to integrate the Apollo Services with Partner's Products in connection with this Agreement.
• 3Ownership.
• 3.1Except as specifically set forth herein, each party will retain all intellectual property rights in its intellectual property and for any works or materials which it creates in connection with this Agreement. Except as explicitly licensed herein, this Agreement does not transfer any intellectual property rights between the parties. Other than as expressly set forth in this Agreement, no license or other rights in or to a party's products, services, or intellectual property is granted, and all such licenses and rights are hereby expressly reserved.
• 3.2For clarification purposes, Partner retains all right, title, and interest in the Partner's Products and all improvements and modifications thereto and all derivative works thereof, as well as, the Partner Product Documentation, Partner Marketing Materials, Partner APIs, and all improvements and modifications thereto and all derivative works thereof.
• 3.3For clarification purposes, Apollo retains all right, title, and interest in and to its products and services, including without limitation the Apollo Services, Apollo Product Documentation, Apollo Marketing Materials, Apollo APIs, and all improvements and modifications thereto and all derivative works thereof.
• 4Mark Usage Rights. During the term of this Agreement, each party may display and use the Marks of the other party to promote the Integration, or as otherwise authorized by this Agreement. Each party's use of the other party's Marks will be in accordance with any usage guidelines that may be established and communicated by the other party. No other use of a party's Marks is authorized. Each party agrees that the other party is the owner of its Marks and all goodwill attaching thereto.
• 5Feedback. Partner grants to Apollo and its affiliates a worldwide, perpetual, irrevocable, royalty-free license to use and incorporate into the Apollo Services any suggestion, enhancement, recommendation, correction, or other feedback provided by Partner relating to the Apollo Partner Program, the Integration, or the Apollo Services. Apollo grants to Partner and its affiliates a worldwide, perpetual, irrevocable, royalty-free license to use and incorporate into Partner's Products any suggestion, enhancement, recommendation, correction, or other feedback provided by Apollo relating to the Partner's Products.

33. INTEGRATION OBLIGATIONS

• 1Support. Partner will continue to support the Integration to ensure the continued efficacy of the Integration for the term of this Agreement. Partner will also be responsible for all Customer support services for its products or services, and Apollo will refer questions relating to Partner's Products or services to Partner.
• 2Marketing. In Partner's discretion, Partner may market and promote the Apollo Services to its Customers, provided, that such marketing and promotion will (i) be consistent with the Apollo Product Documentation or other information provided by Apollo with respect to same, (ii) otherwise accurately portray the Apollo Services and (iii) be in compliance with all applicable laws.
• 3Terms of Service. Any use of the Partner Products by any Customer in connection with the Integration will be subject to the terms of service or other agreement entered into between such mutual Customer and Partner. For the avoidance of doubt, Apollo will have no liability with respect to any such Customer's use of the Partner Products.

44. LICENSE RESTRICTIONS

• 1General Usage Restrictions. Partner will not, and will not permit any third party (including a Customer) to:
• 1.1use the Services or data derived therefrom to create, train, or improve a product or service that directly competes with Apollo's core offerings. This restriction does not apply to Customer's internal systems or processes that are not commercially offered to third parties;
• 1.2resell, distribute, disclose, sublicense, transfer, sell, offer for sale, or make available any of the Contributor Database or any part of the Services to any third party;
• 1.3access the Platform on behalf of any person or entity other than Partner;
• 1.4incorporate any portion of the Platform or Contributor Database into Customer's own products or services;
• 1.5use the Services for any purpose governed by the Fair Credit Reporting Act, or for any illegal purpose, or in any way that violates marketing laws such as CAN-SPAM, CASL, or the TCPA;
• 1.6transmit false, misleading, or fraudulent information, or use the Services to: promote illegal products, firearms, adult content, or hate speech; engage in harassment or violate intellectual property rights; or transmit any malware, virus, or other harmful computer program.
• 2Platform Generated Information Restrictions. Partner will not:
• 2.1distribute, sell, or license PGI to third parties without ensuring compliance with all applicable data protection laws and Apollo's terms regarding the underlying Contributor Database;
• 2.2use PGI to create competing databases or services;
• 2.3combine PGI with other data sources in a manner that would circumvent the usage restrictions applicable to the underlying Apollo data; or
• 2.4use PGI in any manner that would violate the rights of data subjects whose information may be contained therein.
• 3Technical and Access Restrictions. Partner is permitted to use the Platform solely for the purpose of accessing and using the Platform as permitted by this Agreement. Partner may not:
• 3.1Reverse assemble, reverse engineer, decompile, disassemble, or otherwise attempt to derive source code from any of the Platform.
• 3.2Reproduce, modify, create, or prepare derivative works of any of the Platform or related Documentation.
• 3.3Use automated means, such as bots, crawlers, or data scraping, to access any data on the Platform or to extract information therefrom, except as expressly included within the Platform or approved in writing by Apollo.
• 3.4Employ any measure intended to circumvent usage limitations.
• 3.5Create any security interest in the Platform or alter, destroy, or otherwise remove any proprietary notices.
• 3.6Disclose the results of any Platform or program benchmark tests to any third parties without Apollo's prior written consent.
• 4API Usage Requirements.
• 4.1Access and Integration. Partner may not access the APIs via a third party's API credentials or integrate the Apollo APIs with Customer's own product or service. In addition, Partner will exclusively use OAuth 2.0 authentication protocol or other Apollo.io-approved authentication protocols of equivalent or superior security when accessing the Apollo.io API, with all requests including a valid authentication token obtained through authorized endpoints. Partner is expressly prohibited from using unauthorized authentication methods, attempting to bypass authentication mechanisms, using deprecated endpoints, or sharing credentials between applications without explicit authorization. All authentication implementations must comply with the OAuth 2.0 framework as defined in RFC 6749 and RFC 6750 (or applicable standards for any approved alternative method), Apollo.io's published implementation guidelines, industry standard security practices, and any additional specifications required by Apollo.io
• 4.2Usage Limitations. Partner may not circumvent or attempt to circumvent any limitations on access, calls, or other uses of the APIs. Further, Partner will not use the APIs in a manner that is excessive, abusive, or otherwise fails to comply with the Documentation or any applicable Apollo agreement.
• 4.3Prohibited Uses. Partner is expressly prohibited from doing any of the following:
• 4.3.1using any API to replicate or compete with any Apollo products or services, as determined by Apollo in its sole discretion;
• 4.3.2selling, sublicensing, or otherwise providing access to any API to any third party;
• 4.3.3transmitting any malware, virus, or other computer program that may damage, harmfully interfere with, surreptitiously intercept, or expropriate any system or data;
• 4.3.4reverse-engineering or attempting to extract the source code from any APIs or any other Apollo product or service; or
• 4.3.5attempting to gain unauthorized access to any systems or networks related to the APIs or to circumvent any authentication or security measures implemented by Apollo.
• 5Monitoring and Compliance. Apollo reserves the right to monitor Partner's use of the APIs to ensure quality, improve Apollo's products and services, and verify Partner's compliance with this Agreement. Partner agrees to cooperate with Apollo in such efforts, including by providing information about its use of the APIs upon reasonable request. Apollo may also employ technological measures to enforce reasonable use limits and prohibit excessive use, including but not limited to, rate limiting and blocking IPs that indicate a violation of this Agreement.

55. REPRESENTATIONS AND WARRANTIES

• 1Warranties. In addition to any other representation or warranty in this Agreement, each Party represents and warrants to the other that: (i) it is duly organized and validly existing and authorized to do business in the jurisdictions where it operates; (ii) it has the requisite power and authority to enter this Agreement and entering and complying with its obligations under this Agreement does not violate any legal obligation by which such party is bound; and (iii) it will comply with all applicable laws in connection with its rights and obligations under this Agreement.
• 2DISCLAIMER OF WARRANTIES. APOLLO DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, TITLE OR FITNESS FOR A PARTICULAR PURPOSE WITH RESPECT TO ANY APIs, APOLLO PRODUCT DOCUMENTATION, OR APOLLO SERVICES FURNISHED TO PARTNER OR TO A THIRD PARTY PURSUANT TO THIS AGREEMENT. PARTNER DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, TITLE OR FITNESS FOR A PARTICULAR PURPOSE WITH RESPECT TO ANY PARTNER'S PRODUCTS, APIS OR PARTNER PRODUCT DOCUMENTATION FURNISHED TO APOLLO OR TO A THIRD PARTY PURSUANT TO THIS AGREEMENT.

66. CONFIDENTIAL INFORMATION

• 1As used herein, "Confidential Information" means any and all information that is disclosed by either party to the other party, either directly or indirectly, in writing, orally or by inspection of tangible objects, which if disclosed in writing or tangible form is marked as "Confidential," or with some similar designation, or that should otherwise be reasonably understood to be confidential in light of the nature of the information and the circumstances surrounding disclosure. Confidential Information does not include information that: (i) is or becomes generally known to the public through no fault of or breach of this Agreement by the receiving party; (ii) is rightfully known by the receiving party at the time of disclosure without an obligation of confidentiality; (iii) is independently developed by the receiving party without use of or reference to the disclosing party's Confidential Information; or (iv) the receiving party rightfully obtains from a third party without restriction on use or disclosure.
• 2Use and Disclosure Restrictions. Each party will not use the other party's Confidential Information except as necessary to exercise its rights or perform its obligations under this Agreement. Except as otherwise permitted expressly by this Agreement, each party will not disclose the other party's Confidential Information to any third party except to those of its employees, and contractors that need to know such Confidential Information for the purposes of this Agreement, provided that each such employee and contractor is subject to a written agreement that includes binding use and disclosure restrictions that are at least as protective of Confidential Information as those set forth herein. Each party will use all reasonable efforts to maintain the confidentiality of all Confidential Information of the other party in its possession or control, but in no event less than the efforts that party ordinarily uses with respect to its own proprietary information of similar nature and importance. The foregoing obligations will not restrict either party from disclosing Confidential Information of the other party: (i) pursuant to the order or requirement of a court, administrative agency, or other governmental body, provided that the party required to make such a disclosure gives reasonable notice to the other party to contest such order or requirement or (ii) on an as-needed, confidential basis to its legal or financial advisors.

77. TERM AND TERMINATION

• 1Term. Unless otherwise terminated as set forth herein, the initial term of this Agreement is one year ("Initial Term") and the Agreement will renew for consecutive one-year terms (each a "Renewal Term" and together with the "Initial Term" each a "Term") on the anniversary date of the Effective Date, unless either party provides notice of termination (in writing) at least ninety (90) days prior to the end of the applicable Initial Term or Renewal Term.
• 2Termination. Either party has the right to terminate this Agreement upon written notice to the other party if the other party: (i) is in default of any obligation hereunder which default is incapable of being cured, or which, being capable of being cured, has not been cured within 10 days after receipt of written notice of such default or (ii) becomes insolvent, makes a general assignment for the benefit of creditors, suffers or permits the appointment of a receiver for its business or assets, becomes subject to any proceeding under any bankruptcy or insolvency law whether domestic or foreign, or has been liquidated, voluntarily or otherwise.
• 3Effect of Termination. Upon termination of this Agreement, each party's rights to use the other party's Marks under this Agreement will immediately cease and, within ten (10) days of such termination or expiration, each party will return to the other party or destroy any Confidential Information of the other party which is then in its possession. The termination of this Agreement will not relieve a party of its outstanding obligations in connection with this Agreement, and all terms that should be expected to survive termination of this Agreement will survive.
• 4Data Retention for Integration Testing. Partners conducting Integration Testing may retain PGI and test results only for the duration necessary to complete their integration development and testing activities, not to exceed ninety (90) days unless otherwise specified in an Order Form. Upon completion of testing or termination of these Partner Terms, Partners must delete all retained PGI except as required by law.
• 5Termination of Customer Agreements. Either Party may terminate its respective agreement(s) with a Customer in its sole discretion and without reference to this Agreement or any Integration.
• 6Suspension. Apollo reserves the right to monitor Customer's use of the Services to ensure quality, improve Apollo's products and services, and verify Customer's compliance with this Agreement. Customer agrees to cooperate with Apollo in such efforts, including by providing information about its use of the Services upon reasonable request. Apollo may also employ technological measures to enforce reasonable use limits and prohibit excessive use, including but not limited to, rate limiting and blocking IPs that indicate a violation of this Agreement.

88. INDEMNIFICATION/LIMITATION OF LIABILITY

• 1Partner will indemnify, defend, and hold harmless Apollo, and its affiliates, directors, officers, employees, contractors, and agents, and our suppliers, licensors, and service providers from and against any actual or threatened loss, liability, claim, demand, damages, costs, or expenses, including reasonable attorneys' fees and expenses (collectively, "Claims"), arising out of or in connection with: (i) Partner's use of the Apollo Services; (ii) Partner's breach of this Agreement; and/or (iii) Partner's violation of any applicable law or rights held by any third party.
• 2Apollo will have the right, but not the obligation, to participate through counsel of its choice in any defense by Partner of any Claims as to which Partner is required to defend, indemnify, or hold Apollo harmless. Partner may not settle any Claims in a manner that may impose any obligation upon Apollo without Apollo's prior written consent.
• 3APART FROM PARTNER'S INDEMNIFICATION OBLIGATIONS HEREIN OR PARTNER'S VIOLATION OF THE LICENSE RESTRICTIONS OR A PARTY'S VIOLATION OF APPLICABLE LAW, NEITHER PARTY (NOR ITS RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES, REPRESENTATIVES, AFFILIATES, PARENTS, SUBSIDIARIES, SUBLICENSEES, SUCCESSORS AND ASSIGNS, INDEPENDENT CONTRACTORS, AND RELATED PARTIES) SHALL BE LIABLE TO THE OTHER PARTY FOR ANY LOSS OF PROFITS, LOSS OF USE, LOSS OF DATA, INTERRUPTION OF BUSINESS, OR ANY INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN ANY WAY CONNECTED WITH THE USE OF THE SERVICE OR WITH THE DELAY OR INABILITY TO USE SAME, OR FOR ANY BREACH OF SECURITY, OR FOR ANY CONTENT, PRODUCTS, AND SERVICES OBTAINED THROUGH OR VIEWED ON THE SERVICE, OR OTHERWISE ARISING OUT OF THE USE OF SAME, WHETHER BASED ON CONTRACT, TORT, STRICT LIABILITY, REGULATION, COMMON LAW PRECEDENT OR OTHERWISE, EVEN IF THE RESPECTIVE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES AND EVEN IF SUCH DAMAGES RESULT FROM A PARTY'S ENTITY'S NEGLIGENCE OR GROSS NEGLIGENCE. IN NO EVENT SHALL APOLLO'S AGGREGATE LIABILITY FOR ANY CLAIM UNDER OR RELATING TO THIS AGREEMENT EXCEED $5,000. Some jurisdictions restrict or do not allow some of the foregoing limitations of liability in contracts, and as a result the contents of this section may not apply to you. In cases where such laws apply, our liability shall be limited to the fullest extent permitted by law.

99. GENERAL PROVISIONS

• 1Independent Contractors. The relationship between Partner and Apollo is that of independent contractors, and nothing in this Agreement will be construed to create or imply any other relationship. Neither party has the right to bind the other in any manner whatsoever and nothing in this Agreement will be interpreted to make either party the agent or legal representative of the other or to make the parties joint venturers.
• 2Conduct of Business. Partner agrees: (i) to refrain from making any statements with respect to the specifications, features, capabilities, or other characteristics of the Apollo Services that are derogatory or inconsistent with the technical documentation published by Apollo; and (ii) to make no representations, warranties, or guarantees regarding the Apollo Services that are inconsistent with or expand the scope of any warranties, or that limit the scope of, or conflict with, the warranty disclaimers contained in Apollo's standard contract documentation. Apollo agrees: (i) to refrain from making any statements with respect to the specifications, features, capabilities or other characteristics of the Partner's Products that are inconsistent with the technical documentation published by Partner and (ii) to make no representations, warranties, or guarantees regarding the Partner's Products that are inconsistent with or expand the scope of any warranties, or that limit the scope of, or conflict with, the warranty disclaimers contained in Partner's standard contract documentation.
• 3U.S. Foreign Corrupt Practices Act and U.K. Bribery Act. Apollo and Partner each represent and warrant to the other: (i) that it is aware of all anti-corruption legislation that applies to this Agreement and in particular the US Foreign Corrupt Practices Act 1977 and the U.K. Bribery Act 2010; (ii) it has implemented rules and procedures that enable it to comply with this legislation and adapt to any future amendments thereto; (iii) it has implemented appropriate rules, systems, procedures, and controls for preventing the commission of corrupt acts, either by itself or its staff, and for ensuring that any evidence or suspicion of the commission of a corrupt act will be thoroughly investigated, and unless prohibited by confidentiality or law, reported to the other party; (iv) its records relating to its business, including accounting documents, are maintained and kept to ensure their accuracy and integrity; and (v) it has not made, offered, received, or been offered any illegal or improper bribe, kickback, payment, gift, or thing of value from any of the other party's employees or agents in connection with this Agreement (reasonable gifts and entertainment provided in the ordinary course of business do not violate this restriction).
• 4Assignment. Neither party may assign this Agreement without the other party's prior written consent which will not be unreasonably withheld, provided that either party may, upon written notice to the other party, assign this Agreement in connection with the sale of substantially all of its business assets.
• 5Governing Law. This Agreement will be governed by, and construed in accordance with, the laws of the State of California, without reference to conflicts of laws principles. The parties agree that the federal and state courts in San Francisco, California will have exclusive jurisdiction and venue under this Agreement, and the parties hereby agree to submit to such jurisdiction exclusively.
• 6Severability; Counterparts. If any provision, or portion thereof, of this Agreement is determined by a court of competent jurisdiction to be invalid, illegal, or unenforceable, such determination will not impair or affect the validity, legality, or enforceability of the remaining provisions of this Agreement, and each provision, or portion thereof, is hereby declared to be separate, severable, and distinct.
• 7Entire Agreement. This Agreement constitutes the complete, final, and exclusive agreement between the parties with respect to the subject matter herein and supersedes any and all prior or contemporaneous oral or written representations, understandings, agreements, or communications between them concerning the subject matter, including any online or other click-through terms. Any addendum or amendment to this Agreement will only be valid if in writing and signed by each party. Nothing contained in any purchase order, order acceptance form, or other similar document will in any way modify this Agreement or add any additional provisions to this Agreement.
• 8Waiver. A waiver of any provision of this Agreement will only be valid if provided in writing and will only be applicable to the specific incident and occurrence so waived. The failure by either party to insist upon the strict performance of this Agreement, or to exercise any term hereof, will not act as a waiver of any right, promise, or term, which will continue in full force and effect.
• 9Force Majeure. A party is not liable for non-performance of this Agreement if the non-performance is caused by events or conditions beyond that party's control and the party gives prompt notice and makes all reasonable efforts to perform.
• 10Notices. All notices must be in writing (email to the primary contact is sufficient) and delivered to the address set forth in this Agreement or to such other address which may later be designated in writing. Notices will be effective upon receipt.
• 11Non-Exclusive. This Agreement is non-exclusive and nothing in this Agreement may be deemed to prohibit either party from entering into any alliance, partner, referral, resale, customer, or other agreement with any party anywhere in the world either during or after the Term.
• 12Export Compliance. Partner represents that it is not named on any U.S. government denied-parties list. Partner will not access or use the Apollo APIs, Apollo Product Documentation, or Apollo Confidential Information in a U.S.-embargoed country or region or in violation of any U.S. export law or government regulation.
• 13Expenses. Unless otherwise agreed to in writing by the parties, each party will be responsible for its own costs associated with the performance of this Agreement.
• 14Data Processing Agreement. The Apollo Data Processing Agreement is hereby incorporated by reference into these Terms. The parties shall comply with the terms of the Apollo Data Processing Agreement as it relates to all processing of Personal Information in connection with these Terms.
• 15Privacy Policy. Partner acknowledges the collection, use, disclosure, and other handling of information, including Personal Information, described in the Apollo Privacy Policy, which Apollo may update from time to time.
• 16AI Policy. Partner acknowledges and agrees to the Apollo AI Policy, which Apollo may update from time to time.

·Updated August 10, 2026

• 1BACKGROUND.
• 1.1ZenLeads Inc. (d/b/a Apollo.io) ("Apollo", "we", "our" or "us") entered into an Order Form and an agreement (the "Agreement") with the entity or organization named in the Agreement ("Customer", "you", "your", or "yours") for the provision of our Services to you.
• 1.2This Data Processing Addendum (the "DPA") between you and Apollo (each a "Party" and collectively the "Parties") is incorporated into and will form part of the Agreement. Signatures of assent of the Parties to the Agreement will be deemed signature to, and acceptance and agreement of, this DPA and the Standard Contractual Clauses incorporated into this DPA.
• 1.3In the event of a conflict between any of the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA will prevail. Notwithstanding the foregoing, the limitations and exclusions of liability set out in the Agreement will continue to apply to this DPA and to the Standard Contractual Clauses, and each Party's aggregate liability arising out of or relating to this DPA and the Standard Contractual Clauses will be subject to those limitations and exclusions.
• 1.4Sections 4 through 6 of this DPA apply solely where and to the extent Apollo is a Processor of Customer Personal Data. These Sections do not apply to the extent Apollo is a Controller of Personal Data, as described in Section 3(b) of this DPA.
• 2DEFINITIONS. Unless otherwise set out in this DPA, each capitalized term in this DPA will have the meaning set out in the Agreement, and the following capitalized terms used in this DPA will be defined as follows:
• 2.1"Controller" has the meaning given under the applicable Data Protection Laws that employ that term in designating between "processors" and "controllers" of personal data. Where applicable, "Controller" will also have the same meaning as "Business" for the purposes of the CCPA.
• 2.2"Customer Personal Data" means Personal Information included in the Customer Data that we Process on your behalf in connection with our provision of the Services. (For the avoidance of doubt, Customer Personal Data does not include any Personal Data as to which we act as a Controller.)
• 2.3"Data Privacy Framework" means the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce; as may be amended, superseded or replaced.
• 2.4"Data Privacy Framework Principles" means the Principles and Supplemental Principles contained in the relevant Data Privacy Framework; as may be amended, superseded, or replaced.
• 2.5"Data Protection Laws" means, solely where and to the extent applicable to the Processing of Customer Personal Data under the Agreement, any applicable national or state implementing legislation regarding privacy, data protection, or data security (including, where applicable and without limitation: the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK Data Protection Act of 2018 and the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act of 2018 (the "UK GDPR"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA")), inclusive of any U.S. state law or other privacy, data protection, or data broker law, however it designates the parties to the Processing, and, in each case as amended, replaced or superseded from time to time and together with implementing regulations.
• 2.6"Data Subject" has the meaning given under the applicable Data Protection Law(s), and will also mean a "consumer" for purposes of Data Protection Laws using that term.
• 2.7"European Economic Area" or "EEA" means the Member States of the European Union together with Iceland, Norway, and Liechtenstein.
• 2.8"Instructions" means your instructions to us to process the Customer Personal Data as provided under the Agreement, this DPA, through your use of the features and functionality of the Services or as otherwise mutually agreed by authorized signatories of both parties in writing.
• 2.9"Processing" has the meaning given under the applicable Data Protection Laws, and "Process" and its cognates will be interpreted accordingly.
• 2.10"Processor" has the meaning given under the applicable Data Protection Laws that employ that term in designating between "processors" and "controllers" of Personal Information. Where applicable, "Processor" will also have the same meaning as "Service Provider" for the purposes of the CCPA.
• 2.11"Standard Contractual Clauses" means either or both of the following, as the context requires, along with any successor clauses thereto:
• 2.11.1The "EU SCCs", meaning the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (located at http://data.europa.eu/eli/dec_impl/2021/914/oj) and completed as set forth herein.
• 2.11.2The "UK SCCs", meaning the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (located at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-DPA.pdf) and completed as set forth herein.
• 2.12"Subprocessor" means any Processor engaged by us who agrees to receive from us Customer Personal Data.
• 2.13"Supervisory Authority" will mean the data protection supervisory authority (including any cognate terms) as defined under the applicable Data Protection Laws.
• 2.14"Third Party" has the meaning given in the CCPA.
• 3DATA PROCESSING.
• 3.1When We Act as a Processor. To the extent that we Process Customer Personal Data solely to provide you with Services, such as to Process your Customer Personal Data in order to (i) match it to and provide you with Business Contact Information and other outputs of the Services, (ii) provide emailing, prospecting, recording, meeting, calendar or other similar Services to you, or (iii) provide enhanced Services with artificial intelligence capabilities, we are acting as a Processor and you are acting as a Controller. When we act as a Processor, we will only Process Customer Personal Data in accordance with your Instructions, and we will notify you in the unlikely event that Data Protection Law requires us to process Customer Personal Data other than pursuant to your Instructions (unless prohibited from doing so by applicable law). As a Processor, to the extent required by Data Protection Laws, we:
• 3.1.1acknowledge that Customer Personal Data is disclosed only for the limited and specified business purposes set forth under the Agreement ("Business Purposes") and will not retain, use, or disclose Customer Personal Data outside of the direct business relationship between you and us, or for any purpose (including any commercial purpose) other than the Business Purposes or as otherwise permitted by Data Protection Law;
• 3.1.2will not "sell" any Customer Personal Data "share" Customer Personal Data or Process any Customer Personal Data for purposes of targeted advertising, as such terms are defined in Data Protection Laws;
• 3.1.3will comply with any applicable restrictions under the CCPA on combining Customer Personal Data with other data; and
• 3.1.4will provide the same level of protection for the Customer Personal Data subject to the CCPA as is required of Customer under the CCPA and comply with all applicable provisions of the CCPA. We will notify you in the event we determine that we can no longer comply with our obligations under the CCPA.
• 3.2When We Each Act as Controllers. We are each independent Controllers, and (for CCPA purposes), each a Business as to Personal Information included in Business Contact Information and Account Information when such Business Contact Information or Account Information, as the case may be, is in our respective possession. For the avoidance of doubt, this means that Apollo is an independent Controller of all Personal Information in its Contributor Database, including Personal Information that has been enriched and/or verified by Customer Data or otherwise contributed by you as set forth in the Agreement. You are an independent Controller when you provide such Personal Information to us.
• 3.3Required Notices and Consents. You will have sole responsibility and liability for the means by which you acquire Customer Personal Data and provide such data to us. In particular, where required by Data Protection Laws, you will ensure that you have provided/will provide all necessary notices and have obtained/will obtain all necessary consents for the Processing of Customer Personal Data as contemplated in the Agreement.
• 3.4Artificial Intelligence and Automated Decision-Making. To the extent the Services include artificial intelligence or automated decision-making technology features, you are solely responsible, as Controller and (where applicable) as deployer, for determining the lawfulness of your use of such features, including providing all required notices, obtaining all required consents, conducting any required assessments (including data protection impact assessments and any assessments required in connection with automated decision-making technology), responding to data subject rights relating to automated decision-making or profiling, and otherwise complying with Data Protection Laws and any applicable laws governing artificial intelligence. We will provide reasonable assistance solely to the extent and in the manner required of a Processor under Data Protection Laws. Nothing in this DPA causes us to act as a Controller or deployer with respect to your use of such features.
• 4SUBPROCESSORS.
• 4.1Authorized Subprocessors. You agree that we may use the Subprocessors listed at https://trust.apollo.io/ to Process Customer Personal Data.
• 4.2Adding New Subprocessors. We will notify you of any changes concerning the addition of a new Subprocessor at least thirty (30) days before the new Subprocessor commences its Processing of Customer Personal Data (the "Notice"). We will provide Notice by either:
• 4.2.1posting such Subprocessors at the following webpage: https://www.apollo.io/company/privacy-center or https://trust.apollo.io/, or
• 4.2.2sending an email to the last known email address we have on file.
• 4.3Objections to Subprocessors. If you object to a new Subprocessor on reasonable grounds related to the protection of Customer Personal Data, then without prejudice to any right to terminate the Agreement, the Parties will attempt to negotiate a resolution in good faith. If the Parties cannot agree on a resolution within 30 days of your objection to a new Subprocessor, then you may terminate the Agreement immediately upon written notice to us and you will be entitled to a refund of any prepaid fees for services unused as of the effective date of termination. This termination right and refund is your sole and exclusive remedy if you object to any new Subprocessor. If you do not object within thirty (30) days of receipt of the Notice, you are deemed to have accepted the new Subprocessor.
• 4.4Subprocessor Agreements. We will enter into a written agreement with each Subprocessor that imposes substantially similar data protection obligations on the Subprocessor with regard to their Processing of Customer Personal Data, as are imposed on us where we are acting as a Processor under this DPA.
• 4.5Liability of Subprocessors. We will be liable to you for the acts and omissions of any Subprocessor as if they were our acts and omissions, subject to the limitations and exclusions of liability set out in the Agreement.
• 5DATA SECURITY, AUDITS, AND SECURITY NOTIFICATIONS; DELETION AND RETENTION.
• 5.1Apollo Security Obligations. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the measures set out in Exhibit 2.
• 5.2Demonstrating Compliance. Upon your reasonable request, we will make available all information reasonably necessary to demonstrate our compliance with our obligations under Data Protection Law(s).
• 5.3Security Incident Notification. If we become aware of a confirmed Security Incident we will (i) notify you of the Security Incident without undue delay (and in any event within 72 hours of confirmation), (ii) investigate the Security Incident and provide you (and any law enforcement or regulatory official, as required by Data Protection Law) with reasonable assistance as required to investigate the Security Incident, and (iii) take steps to remedy any non-compliance with this DPA. Our notification of, or response to, a Security Incident under this Section will not be construed as an acknowledgment by us of any fault or liability with respect to the Security Incident.
• 5.4Apollo Employees and Personnel. We will treat the Customer Personal Data as confidential and will ensure that any employees or other personnel authorized to Process Customer Personal Data are subject to a binding duty of confidentiality with respect to the Customer Personal Data both during the term of their employment or engagement and thereafter.
• 5.5Audits. We will, upon your reasonable request and where and to the extent so required by Data Protection Law, allow for, cooperate with, and contribute to assessments and audits (including inspections, of our compliance with the applicable Data Protection Law, conducted by you (or a third party on your behalf and mandated by you) provided (i) such audits or inspections are not conducted more than once per year (unless requested by a Supervisory Authority); (ii) are conducted only during business hours; and (iii) are conducted in a manner that causes minimal disruption to Apollo's operations and business.
• 5.6Remediation Right. Where and to the extent such a right is explicitly provided under the CCPA, you retain the right, upon reasonable notice to us, to take reasonable and appropriate steps to (i) ensure that we are using Customer Personal Data we collected pursuant to the Agreement in a manner consistent with your obligations under CCPA, and (ii) stop and remediate unauthorized use of Customer Personal Data.
• 5.7Deletion of Data. Subject to Section 5(h) below, we will, at your election within 90 (ninety) days of the date of termination of the Agreement:
• 5.7.1delete all Customer Personal Data Processed by us or any Subprocessors; or
• 5.7.2return a complete copy of all Customer Personal Data by secure file transfer in such a format as notified to us by you.
• 5.8Retention. We and our Subprocessors may retain Customer Personal Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws; provided that we ensure the confidentiality of all such Customer Personal Data and will ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.
• 6ACCESS REQUESTS AND ASSISTANCE WITH COMPLIANCE.
• 6.1Government Disclosure. We will notify you of any request for the disclosure of Customer Personal Data by a governmental or regulatory body or law enforcement authority (including any data protection supervisory authority) unless otherwise prohibited by law or a legally binding order of such body or agency.
• 6.2Assistance Generally. Solely to the extent and in the manner required under Data Protection Laws, we will provide reasonable assistance to you for your compliance with such laws, including, without limitation, as set forth in Section 6.
• 6.3Data Subject Rights. To the extent required under Data Protection Laws, and taking into account the nature of the Processing, we will use reasonable endeavors to assist you by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising Data Subject rights laid down in Data Protection Laws.
• 6.4Data Protection Impact Assessments; Prior Consultations. To the extent required under Data Protection Laws: (i) we will provide you with reasonably requested information regarding our Services to enable you to carry out data protection impact assessments (including any similar assessments under Data Protection Laws) or prior consultations with any Supervisory Authority, in each case solely in relation to Processing of Customer Personal Data and taking into account the nature of the Processing and information available to us; and (ii) we will provide reasonable assistance to you in the cooperation or consultation with a Supervisory Authority as it relates to the Processing of Customer Personal Data hereunder.
• 7ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISION-MAKING.
• 7.1Roles. Where the Services include features that use artificial intelligence or machine learning ("AI Features"), the Party that develops and makes the AI Feature available acts as the "provider" and the Party that uses the AI Feature under its own authority acts as the "deployer," each as those or analogous terms are used under applicable Data Protection Laws and AI-specific laws (including Regulation (EU) 2024/1689 (the "EU AI Act")). Nothing in this Section alters the controller/processor allocations set out in Section 3.
• 7.2Cooperation. Taking into account the nature of the AI Features and the information available to us, we will provide you with information reasonably necessary to enable you to (i) provide any pre-use notices, (ii) respond to access or opt-out requests, and (iii) conduct any risk assessment or data protection impact assessment, in each case to the extent required of you under applicable Data Protection Laws governing automated decision-making technology, including the CCPA regulations on automated decision making technology. You remain responsible for determining whether your use of the AI Features results in any "significant decision" and for your own compliance obligations as a deployer or controller.
• 7.3Transparency. Each Party will comply with applicable AI transparency obligations, including any obligation to disclose interaction with an AI system or to mark AI-generated content under Article 50 of the EU AI Act, in relation to the AI Features it makes available or deploys.
• 8CONTROLLER OBLIGATIONS.
• 8.1In the course of acting as a Controller (and/or Third Party), such Party will:
• 8.1.1Limit its use of Personal Information received from the other Party to the limited and specific purposes set forth in the Agreement or any applicable Order Form, and (without limitation of the foregoing) to purposes that it reasonably believes an average consumer would reasonably expect.
• 8.1.2Comply with its own obligations under Data Protection Laws applicable to it as a Controller, including (without limitation) as to any Data Subject rights to deletion, access, and "opt-out" of "sale" or "sharing" of Personal Information (as such terms are defined in Data Protection Laws).
• 8.1.3Notify the other Party about all valid opt-out, deletion, or other data subject requests, as and to the extent required by Data Protection Laws. You will cooperate and comply with any such notification made by Apollo to you with respect to Business Contact Information in a timely manner. Apollo will make removal and opt-out requests available through the Removal Requests list (Settings > Removal Requests) or such other mechanism as Apollo may designate in writing. Customer agrees to review this list no less than once every thirty (30) days. Within thirty (30) days of Apollo making a request available Customer will either: (a) permanently delete the affected individual's data from all systems within Customer's control, including CRM systems, enrichment workflows, API outputs, AI integrations, and other downstream repositories where data obtained through the Services may reside; or (b) document and retain a separate, independent legal basis for continued processing. Suppression or cessation of active use does not satisfy the deletion obligation under (a).
• 8.1.4To the extent Apollo qualifies as a "data broker" under applicable Data Protection Laws, Apollo will maintain all required registrations and process consumer deletion and opt-out requests received through any state-administered accessible deletion mechanism (including California's DELETE Request and Opt-Out Platform) within the timeframes required by law, and will direct its Subprocessors to give effect to such requests in accordance with Section 4 (Subprocessors). Apollo will make such requests available to Customer in accordance with Section 8(iii).
• 8.1.5As to any Personal Information received from the other Party, implement and maintain reasonable security procedures, as appropriate to the level of sensitivity and confidentiality applicable to such Personal Information.
• 8.1.6Upon request, provide the other Party with reasonable assurances, in writing, as may be necessary to permit the other Party to ensure that it has employed Personal Information subject to the Agreement as contemplated by the Agreement.
• 8.1.7For Personal Information subject to the CCPA, provide the same level of protection to the Personal Information as the Party providing the Personal Information is required to provide under the CCPA, and notify the other Party if it determines that it is no longer able to comply with its CCPA obligations.
• 8.2Solely where and to the extent the CCPA applies to such Processing, the Party providing the Personal Information retains the right, upon reasonable notice, to (i) take reasonable and appropriate steps to ensure that the other Party uses Personal Information consistent with the CCPA, and (ii) stop and remediate any unauthorized Processing of Personal Information made available to the other Party.
• 9DATA TRANSFERS.
• 9.1Transfers Mechanism. To the extent that the Processing of Personal Information involves the transmission of such Personal Information to a country or territory outside the country from which such Personal Information was provided to the Party receiving the data (the "data importer"), the Parties will comply with any requirements under Data Protection Laws regarding such transfers. To the extent required by Data Protection Laws, the data importer will ensure that a lawful data transfer mechanism is in place prior to engaging in any onward transfers of Personal Information from one country to another.
• 9.2Data Privacy Framework. At the time of the execution of the Agreement, Apollo participates in and certifies compliance with the Data Privacy Framework. As required by the Data Privacy Framework, Apollo will: (i) provide at least the same level of privacy protection as is required by the Data Privacy Framework Principles; (ii) notify Customer if Apollo makes a determination it can no longer meet its obligation to provide the same level of protection as is required by the Data Privacy Framework Principles (in which event Apollo will cease such processing or take other reasonable and appropriate steps to remediate. Where and to the extent that the Data Privacy Framework applies, Apollo will use the Data Privacy Framework to lawfully receive Customer Personal Data and/or Personal Information in the United States.
• 9.3EU SCCs. To the extent legally required (for example, if the Data Privacy Framework does not cover the transfer to Apollo and/or the Data Privacy Framework is invalidated), the Parties are deemed to have entered into and signed the EU SCCs and its Annexes, which form part of this DPA and take precedence over the rest of this DPA to the extent of any conflict. Except as described in Sections 9(d) and 9(e) below, the EU SCCs are deemed completed as follows:
• 9.3.1Module 1 applies to transfers of Personal Information where both Parties are independent Controllers (as described in Section 3(b) of this DPA). Module 2 of the EU SCCs applies to transfers of Customer Personal Information from Customer (the Controller) to us (the Processor).
• 9.3.2Clause 7 (the optional docking clause) is included.
• 9.3.3Clause 9 of Module 2 (Use of sub-processors): The Parties select Option 2 (General written authorization). The initial list of Subprocessors and the procedures for updating such list are set forth in Sections 4.1 and 4.2 of this DPA.
• 9.3.4Clause 11 (Redress): The optional language requiring that data subjects be permitted to lodge a complaint with an independent dispute resolution body is not included.
• 9.3.5Clause 17 (Governing law): The Parties choose Option 1 (the law of an EU Member State that allows for third-party beneficiary rights) and select the law of Ireland.
• 9.3.6Clause 18 (Choice of forum and jurisdiction): The Parties select the courts of Ireland.
• Annex IAnnex I is completed as set forth in Exhibits 1A, 1B and 1C of this DPA. For Annex I(C), the Parties select the Irish Data Protection Commission. Annex II is completed as set forth in Exhibit 2 of this DPA. Annex III is not applicable because the Parties have chosen General Authorization under Clause 9.
• 9.4UK SCCs. To the extent legally required, by entering into this DPA, the Parties are deemed to have entered into and signed the UK SCCs, which form part of this DPA and take precedence over the rest of this DPA as set forth in the UK SCCs. The Tables within the UK SCCs are deemed completed as follows:
• 9.4.1Table 1: The Parties' details will be the Parties and their affiliates to the extent any of them is involved in such transfer, and the Key Contact will be the contacts set forth in Exhibits 1A, 1B and 1C of this DPA, as applicable.
• 9.4.2Table 2: The Approved EU SCCs referenced in Table 2 will be the EU SCCs as executed by the Parties and completed above, except that: (1) Clause 17 (Governing law): The Parties choose the law of England and Wales; (2) Clause 18 (Choice of forum and jurisdiction): The Parties select the courts of England and Wales and (3) Annex 1C and Clause 13 the Parties select the UK Information Commissioner.
• 9.4.3Table 3: Annex I is set forth in Exhibits 1A, 1B and 1C of this DPA. Annex II is set forth in Exhibit 2 of this DPA. Annex III is inapplicable.
• 9.4.4Table 4: We may end this DPA as set out in Section 19 of the UK SCCs.
• 9.5Swiss Data. For transfers of Personal Information that are subject to the Swiss Federal Act on Data Protection ("FADP"), the EU SCCs form part of this DPA as set forth above, but with the following differences to the extent required by the FADP:
• 9.5.1References to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR. The revised FADP, effective September 1, 2023, applies only to the Personal Information of natural persons.
• 9.5.2The term "member state" in the EU SCCs will not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs.
• 9.5.3The relevant supervisory authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the supervisory authority identified in the EU SCCs (where the FADP and GDPR apply, respectively).
• 9.5.4The EU SCCs will be modified as follows: (1) Clause 17 (Governing law): The Parties choose the law of Switzerland; (2) Clause 18 (Choice of forum and jurisdiction): The Parties select the courts of Switzerland and (3) Annex 1C and Clause 13 the Parties select the Swiss Federal Data Protection and Information Commissioner.

ExhibitEXHIBIT 1A Controller/Exporter (Customer) to Processor/Importer (Apollo)

• 1LIST OF PARTIES.
• 1.1Data Exporter(s).
• 1.1.1Name: The Customer identified in the Agreement or Order Form.
• 1.1.2Address: As set forth in the Agreement or Order Form.
• 1.1.3Contact person's name, position and contact details: As set forth in the Agreement and Order Form, or as otherwise agreed to by the parties.
• 1.1.4Activities relevant to the data transferred under these Clauses: Processing in connection with the receipt of the Services provided by the data importer in accordance with the Agreement and the DPA.
• 1.1.5Signature and date: See signature and/or electronic acceptance date to the Agreement.
• 1.1.6Role (controller/processor): Controller
• 1.2Data Importer.
• 1.2.1Name: ZenLeads Inc. (d/b/a Apollo.io)
• 1.2.2Address: 440 N Barranca Ave #4750, Covina, CA 91723
• 1.2.3Contact person's name, position, and contact details: Legal Department; privacy@apollo.io or such other person designated by Apollo.
• 1.2.4Activities relevant to the data transferred under these Clauses: Processing in connection with providing, maintaining and improving the Services in accordance with the Agreement and the DPA.
• 1.2.5Signature and date: See signature and/or electronic acceptance date to the Agreement.
• 1.2.6Role (controller/processor): Processor
• 2DESCRIPTION OF TRANSFER.
• 2.1Categories of data subjects whose personal data is transferred. Data subjects may include data exporter's employees (or other end-users of the Services), prospects, customers, business partners and vendors.
• 2.2Categories of personal data transferred. Customer Personal Data which may include, but is not limited to the following categories:
• 2.2.1First and last name
• 2.2.2Title
• 2.2.3Employer
• 2.2.4Contact information (company, email, phone, physical business address)
• 2.2.5IP address
• 2.2.6Video and audio recordings
• 2.3The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). Continuously for the duration of the Agreement.
• 2.4Nature of the processing. Data importer Processes Customer Personal Data to provide the Services pursuant to the Agreement, which includes, without limitation, receiving, storing, analyzing, and deleting Customer Personal Data.
• 2.5Purpose(s) of the data transfer and further processing. Data importer's provision of Services to the data exporter pursuant to the Agreement between data exporter and data importer.
• 2.6The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period. As further set forth under the Agreement and the DPA.
• 2.7For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing. Same as above.

ExhibitEXHIBIT 1B Controller/Exporter (Customer) to Controller/Importer (Apollo)

• 1LIST OF PARTIES.
• 1.1Data Exporter(s).
• 1.1.1Name: The Customer identified in the Agreement or Order Form.
• 1.1.2Address: As set forth in the Agreement or Order Form.
• 1.1.3Contact person's name, position and contact details: As set forth in the Agreement and Order Form, or as otherwise agreed to by the parties.
• 1.1.4Activities relevant to the data transferred under these Clauses: Processing in connection with providing, maintaining, improving and enriching the Services in accordance with the Agreement and the DPA.
• 1.1.5Signature and date: See signature and/or electronic acceptance date to the Agreement.
• 1.1.6Role (controller/processor): Controller
• 1.2Data Importer.
• 1.2.1Name: ZenLeads Inc. (d/b/a Apollo.io)
• 1.2.2Address: 440 N Barranca Ave #4750, Covina, CA 91723
• 1.2.3Contact person's name, position, and contact details: Legal Department; privacy@apollo.io or such other person designated by Apollo.
• 1.2.4Activities relevant to the data transferred under these Clauses: Processing in connection with providing, supporting, maintaining, improving and enriching the Services in accordance with the Agreement and the DPA.
• 1.2.5Signature and date: See signature and/or electronic acceptance date to the Agreement.
• 1.2.6Role (controller/processor): Controller
• 2DESCRIPTION OF TRANSFER.
• 2.1Categories of data subjects whose personal data is transferred. Data subjects include data exporter's employees (and other end-users of the Services), prospects, customers, business partners and vendors.
• 2.2Categories of personal data transferred. In each case where and to the extent such Personal Information is included in the Account Information or Customer Data Processed by data importer in its role as a data controller.
• 2.2.1First and last name
• 2.2.2Title
• 2.2.3Employer
• 2.2.4Contact information (company, email, phone, physical business address)
• 2.2.5IP address
• 2.2.6Any other categories of Personal Information provided by Customer.
• 2.3The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). Continuously for the duration of the Agreement.
• 2.4Nature of the processing. Data importer Processes Personal Information as further set forth under the Agreement and in data importer's privacy policy, including Processing to verify, enrich and grow the Contributor Database and improve the Services, which includes, without limitation, receiving, storing, analyzing, and deleting Personal Information.
• 2.5Purpose(s) of the data transfer and further processing. Such purposes as further set forth under the Agreement and in data importer's privacy policy, including Processing by data importers to verify, enrich and grow the Contributor Database and improve the Services.
• 2.6The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period. Where data importer is a Controller: As further set forth under the data importer's privacy policy.
• 2.7For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing. Same as above.

ExhibitEXHIBIT 1C Controller/Exporter (Apollo) to Controller/Importer (Customer)

• 1LIST OF PARTIES.
• 1.1Data Exporter(s).
• 1.1.1Name: ZenLeads Inc. (d/b/a Apollo.io)
• 1.1.2Address: 440 N Barranca Ave #4750, Covina, CA 91723-1722
• 1.1.3Contact person's name, position and contact details: Legal Department; privacy@apollo.io or such other person designated by Apollo.
• 1.1.4Activities relevant to the data transferred under these Clauses: Providing the Services (including Business Contact Information) to the data importer in accordance with the Agreement and the DPA.
• 1.1.5Signature and date: See signature and/or electronic acceptance date to the Agreement.
• 1.1.6Role (controller/processor): Controller
• 1.2Data Importer.
• 1.2.1Name: The Customer identified in the Agreement.
• 1.2.2Address: As set forth in the Agreement.
• 1.2.3Contact person's name, position, and contact details: As set forth in the Agreement and Order Form or otherwise agreed to by the parties.
• 1.2.4Activities relevant to the data transferred under these Clauses: Receiving the Services (including Business Contact Information) provided by the data exporter in accordance with the Agreement and the DPA.
• 1.2.5Signature and date: See signature and/or electronic acceptance date to the Agreement.
• 1.2.6Role (controller/processor): Controller
• 2DESCRIPTION OF TRANSFER.
• 2.1Categories of data subjects whose personal data is transferred. Data subjects include individuals whose data has been contributed to the Contributor Database.
• 2.2Categories of personal data transferred. Business Contact Information which includes (without limitation) the following categories of Personal Information:
• 2.2.1First and last name
• 2.2.2Title
• 2.2.3Employer
• 2.2.4Contact information (company, email, phone, physical business address)
• 2.3The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). Continuously for the duration of the Agreement.
• 2.4Nature of the processing. For the data importer's use subject to the terms and license restrictions of the Agreement.
• 2.5Purpose(s) of the data transfer and further processing. Data importer's receipt of Services (including Business Contact Information) provided by data exporter under the Agreement.
• 2.6The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period. Data importer will retain the Business Contact Information in accordance with the Agreement.
• 2.7For transfers to (sub-) processors, also specify the subject matter, nature and duration of the processing. Same as above.

Exhibit 2EXHIBIT 2 TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

·Data importer will implement and maintain the Technical and Organizational Measures described in Annex II. Notwithstanding any provision to the contrary otherwise agreed to by Data exporter, Data importer may modify or update these Technical and Organizational Measures at its discretion provided that such modifications and updates do not result in the degradation of the overall security of the Services. All capitalized terms not otherwise defined herein will have the meanings as set forth in the Agreement.

• 1ACCESS CONTROL.
• 1.1Preventing Unauthorized Product Access.
• 1.1.1Outsourced processing. Apollo hosts its Service with outsourced, US-based data center providers. Additionally, Apollo maintains contractual relationships with vendors in order to provide the Service. Apollo relies on contractual agreements, privacy policies, and vendor compliance programs in order to assure the protection of data processed or stored by these vendors.
• 1.1.2Physical and environmental security. Apollo hosts its product infrastructure with multi-tenant, outsourced data center providers. The physical and environmental security controls are audited for SOC 2 Type II compliance.
• 1.1.3Authentication. Apollo implemented a uniform password policy for its customer products. Customers who interact with the products via the user interface must authenticate before accessing non-public customer data.
• 1.1.4Authorization. Customer data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of Apollo's products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user's permissions against the attributes associated with each data set.
• 1.1.5Application Programming Interface (API) Access. Public product APIs may be accessed using an API key or through Oauth authorization.
• 1.2Preventing Unauthorized Product Use.
• 1.2.1Apollo implements industry-standard access controls and detection capabilities for the internal networks that support its products.
• 1.2.2Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the product infrastructure.
• 1.2.3Static code analysis: Security reviews of code stored in Apollo's source code repositories are performed, checking for coding best practices and identifiable software flaws.
• 1.3Limitations of Privilege & Authorization Requirements.
• 1.3.1Product access: A subset of Apollo's employees have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, troubleshoot potential problems, and detect and respond to security incidents. Access is enabled through "just in time" requests for access; all such requests are logged. Employees are granted access by role, and reviews of high-risk privilege grants are initiated daily. Employee roles are reviewed at least once every six months.
• 2TRANSMISSION CONTROL.
• 2.1In-transit. Apollo makes HTTPS encryption (also referred to as SSL or TLS) available on every one of its login interfaces and for free on every customer site hosted on the Apollo products. Apollo's HTTPS implementation uses industry-standard algorithms and certificates.
• 2.2At-rest. Apollo encrypts Customer Personal Data at rest using industry-standard encryption algorithms, and manages encryption keys in accordance with industry-standard key-management practices. User passwords are stored using salted one-way hashing consistent with at least industry-standard practices for security.
• 3INPUT CONTROL.
• 3.1Detection. Apollo designed its infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregate log data and alert appropriate employees of malicious, unintended, or anomalous activities. Apollo personnel, including security, operations, and support personnel, are responsive to known incidents.
• 3.2Response and Tracking. Apollo maintains a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, Apollo will take appropriate steps to minimize product and Customer damage or unauthorized disclosure.
• 3.3Communication. If Apollo becomes aware of unlawful access to Customer data stored within its products, Apollo will without undue delay: 1) notify the affected Customers of the incident; 2) provide a description of the steps Apollo is taking to resolve the incident; and 3) provide status updates to the Customer contact, as reasonably necessary. Notification(s) of incidents, if any, will be delivered to one or more of the Customer's contacts in a form Apollo selects, which may include via email or telephone.
• 4JOB CONTROL.**
• 4.1The Apollo Product provides a solution for Customers to conduct their marketing and sales activities. Customers control the data types collected by and stored within their portals. Apollo never sells personal data to any third party.
• 4.2Terminating Customers. Customer Data in active (i.e., primary) databases are purged upon a customer's written request, or for our web-based application available at https://www.apollo.io, 90 days after a customer terminates all agreements for such products with Apollo. Marketing information stored in backups, replicas, and snapshots is not automatically purged but instead ages out of the system as part of the data lifecycle; during that period such information remains subject to access controls, is not used for any active Processing, and is placed on a suppression list so that it is not re-collected, re-shared, or sold following a valid deletion or opt-out request, including any request received through DROP. Apollo reserves the right to alter the data purging period in order to address technical, compliance, or statutory requirements.
• 5AVAILABILITY CONTROL.
• 5.1Infrastructure availability. The data center providers use commercially reasonable efforts to ensure a minimum of 99.9% uptime. The providers maintain a minimum of N+1 redundancy to power, network, and HVAC services.
• 5.2Fault tolerance. Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Customer data is backed up to multiple durable data stores and replicated across multiple data centers and availability zones.
• 5.3Online replicas and backups. Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary database. All databases are backed up and maintained using at least industry-standard methods.
• 5.4Apollo's products are designed to ensure redundancy and seamless failover. The server instances that support the products are also architected with a goal of preventing single points of failure. This design assists Apollo operations in maintaining and updating the product applications and backend while limiting downtime.
• 6SEPARATION IN PROCESSING. Apollo's collection of personal data from its Customers is to provide and improve our products. Apollo does not use that data for other purposes that would require separate processing.