·Privacy Policy

·Attio takes data privacy very seriously. We are committed to handling data privacy transparently and in line with data protection principles and relevant regulations. Find out more in our Privacy Policy below. Last updated: June 2026

11. Introduction

·This Privacy Policy sets out how Attio Limited and its affiliates collect and process personal data. It also explains your rights in relation to your personal data. If you have any questions about this Privacy Policy or wish to exercise any of your rights in relation to your personal data, you can contact us using the details below.

·Attio Limited will usually act as the controller of data processed in connection with the provision of services including CRM tools and API services. In other cases, for example if you apply for a job with Attio Inc. or where you enter into a contract with that entity, Attio Inc. may act as a controller. If you have any questions about this, you can contact us using the details set out in Section 15 below.

·This Privacy Policy affects your legal rights and obligations so please read it carefully. If you do not wish for us to process your personal data as set out in this Privacy Policy, please do not provide your personal data to us, and ask your employer to ensure that they do not do so. By using our services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our platform is also subject to our Services Agreement.

·We may update this Privacy Policy from time to time at our discretion and in particular to reflect any changes in applicable laws. If we do so, and the changes substantially affect your rights or obligations, we shall take commercially reasonable measures to notify you. Otherwise, you are responsible for regularly reviewing this Privacy Policy so that you are aware of any changes to it.

22. Our role in relation to personal data

·This Privacy Policy explains how we collect and use personal data that we handle as a controller. We act as a controller of personal data about you if you:

·• Provide personal data to us directly, for example when contacting us about our services, or signing up to receive mailings (see section 3.1).

·• Visit our websites or use our services, in which case we will automatically collect certain information about your usage of such websites and services (see section 3.2).

·• Connect third party services to Attio (see section 3.3).

·• Sign up for an Attio account to allow you to access a trial, or an account that your employer or colleague has set up (see section 3.4).

·We may also receive personal data from third party sources, such as data enrichment providers, as described below.

·Alternatively, we may receive your personal data through our platform because one of our clients has uploaded your details within their account on our platform. In these circumstances, we act as a processor of your personal data, and we shall only process your personal data in accordance with the client's instructions and our Data Processing Addendum. If you have any questions about personal data that we handle as a processor, you should refer directly to the relevant client using our services, since these operations are not covered by this Privacy Policy.

·We may allow certain developers or users access to the Attio API or Attio SDK in order to develop certain applications enabling interoperation between a third-party platform and the Attio services (each an "Integration App"). Each Integration App is developed independently and at the developer's own risk. Accordingly, each developer of an Integration App shall be deemed to be a separate and independent controller of any personal data you may share by using such Integration App, and you will be subject to the Integration App's separate terms and privacy policy. We encourage you to read the terms and privacy policy of every Integration App you may use in connection with our services.

33. What personal data do we collect and from whom?

·By personal data we mean any identifiable information about you, such as your name, email address, gender, date of birth, mobile and home telephone number, your IP address or a photo of you which you upload to our platform.

·We may obtain special categories of personal data about you if you choose to provide such data to us. Special categories of personal data are data about your race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or sex life or sexual orientation.

3.13.1. Data you provide to us

·We will collect personal data from you if you:

·• Use our website.

·• Use our mobile app.

·• Use our platform.

·• Apply for a job with us.

·• Provide services to us.

·• Purchase services from us.

·• Contact us through an account we hold on a social media platform such as LinkedIn.

·• Subscribe to receive product update e-mails from us.

·• Otherwise contact us, for example with queries, comments, or complaints.

·Personal data you provide to us may include your name, email address, phone number, location or region and, if you are applying for a job with us, information you choose to provide on your CV/resume (such as your education and employment history).

·We shall process all such personal data in accordance with this Privacy Policy. Certain personal data is mandatory to be provided to us in order that we can fulfil your request, for example to provide services to you. We make this clear to you at the point of collection of the personal data.

·Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

·All personal data that you provide to us must be true, complete, and accurate. At our request, you shall promptly provide evidence of your identity. If you provide us with inaccurate or false data, and we suspect or identify fraud, we will record this, and we may be unable to provide our services to you. We may also report this information. When you contact us by email or post, we may keep a record of the correspondence, and we may also record any telephone call we have with you.

3.23.2. Data we automatically collect about you

·When you use our services, we automatically collect and store information about your device and your activities. This information could include:

·• Technical information about your device such as type of device, web browser or operating system.

·• Your preferences and settings such as time zone and language.

·• How long you used the website/app and which services and features you used.

·• Your location information, which we infer by using your IP address.

·• Information about your interactions with our website and services, such as the pages or other content you view, referrer information (the website you visited before coming to our services), and the dates and times of your visits.

·If you want to find out more about the types of cookies we use, why, and how you can control them, please see our Cookie Policy.

·We will also collect information about our communications with you, including whether our emails were successfully delivered, whether they were opened, and whether you interacted with their content.

3.33.3. Type of data we automatically collect from connected third-party services, such as Google Services, Dropbox, Microsoft Outlook, and Microsoft OneDrive

·You may choose the option to log in with or access third-party services in order to access this information from within the Attio application and in such cases, we will automatically collect and store your user data from that third party. This may include: • Profile with third party • Name • Email address

3.43.4. Data we receive from others

·Your employer or a colleague may from time to time provide personal data to us that relates to you (for example, your email address) so that you can create an account on our platform. If a third party such as your employer or a colleague provides us with your email address, and that address is your personal, non-work email address, you must contact us to let us know and we will remove this data.

·We may also receive personal data about you from an Integration App, our payment providers and/or our website security service partners, particularly if there is any misuse of the platform including the introduction of viruses or other malicious software.

·If you sign up or log in to your Attio account using a third-party account (such as your Google account), we may receive personal data from those services, such as your name, email address, and profile information.

·If you access our services through third-party tools such via an MCP, we may receive information relating to your connection between Attio and such third-party services.

·If you express an interest in Attio's platform and services (for example, by requesting to talk to sales on our website), or if we think you may be interested in our services, we may collect information about you from third parties and use this information to contact you. You can ask to unsubscribe from being contacted at any time.

·If you apply for a job with us, we may receive information about you and references from your previous employer. We may also collect your information from third-party platforms such as LinkedIn if we think that you may be suitable for a vacancy that we are promoting at Attio. If you accept a role with us, we will work with third-party partners to verify your identity and carry out background checks, including right to work checks and, for certain job roles, criminal background checks.

44. Using data from connected Google Services

·If we have received your personal data because you have chosen to Sign in with Google, we will process your personal data to perform any contract we have entered into with your employer or in relation to any steps we take at the request of your employer prior to entering into a contract. In particular, this includes providing you with access to the Attio application.

·Attio is providing a customer relationship management (CRM) and task management application aimed at business customers. If we have received personal data because you have chosen to connect your Google Drive, Google Calendar and/or your Gmail account we will collect your data from this service in order to enhance the email, file and contact management experience and improve your productivity when using the Attio application. In particular, this includes access to your Google user data from within the Attio application where you can view your data in the relevant context of a CRM software application and manage your professional relationships.

·Additional Limits on Use of Your Google User Data:

·Notwithstanding anything else in this Privacy Policy, if you provide us with access to data from connected Google services, our use of that data will be subject to the additional restrictions set out below. For the avoidance of doubt, we process data received from connected Google services solely in the capacity of a processor on your behalf, and not as a controller:

·• We will only use access to data from a connected Google Service to provide our Attio web and mobile CRM and task management application that allows users to read, process, write and delete emails, track recipient opens, clicks and replies to emails, access their Google Drive files and calendar. Furthermore, our use of data is limited to providing or improving user-facing features that are prominent in the requesting application's user interface.

·• We will not transfer this data to others unless doing so is necessary to provide and improve features that are prominent in the user interface, comply with applicable law, or as part of a merger, acquisition, or sale of assets.

·• We will never use Google User data for serving advertisements, including retargeting, personalized, or interest-based advertising.

·• We will not allow humans to read this data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for our internal operations and even then, only when the data have been aggregated and anonymized.

·• Attio's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

55. Lawful bases for which we use your personal data

·If you are located in the European Economic Area, Switzerland or the United Kingdom, we only process your personal data as a controller where we have a legal basis to do so. The legal bases we rely on include:

·• Necessary for a legitimate interest that we pursue. Where we or a third party have a legitimate interest in processing your personal data, we may do so provided that our interest is not overridden by your rights and interests. We may rely on this legal basis to, for example, keep business records, respond to unsolicited communications from you, assert our legal rights and obtain professional advice.

·• Necessary for compliance with a legal obligation to which we are subject. We may process your personal data where we are required to do so to comply with our legal obligations, for example to comply with tax and accounting obligations or to respond to lawful requests from public authorities.

·• Necessary to perform a contract. We will process your personal data where it is necessary to give effect to a contract between you and us, for example if you purchase our services or we buy services from you.

·• Consent. We may process your personal data on the basis of consent in some circumstances. For example, we may ask you to consent to our use of cookies and similar technologies, or to certain forms of marketing. You may withdraw your consent at any time by contacting us or using the unsubscribe link in marketing emails.

66. How do we use the personal data we collect?

·We use the information we collect:

·• To provide, maintain, improve, and enhance our services.

·• To personalize your experience on our services such as by providing tailored content and recommendations.

·• To understand and analyze how you use our services and develop new products, services, features, and functionality.

·• To communicate with you, provide you with updates and other information relating to our services, provide information that you request, respond to comments and questions, and otherwise provide customer support.

·• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you.

·• To generate anonymized or aggregate data containing only de-identified, non-personal information that we may use for any lawful purposes.

·• To send you text messages and push notifications.

·• To process and respond to job applications.

·• To facilitate transactions and payments.

·• To find and prevent fraud and abuse and respond to trust and safety issues that may arise.

·• For compliance purposes, including enforcing our Terms and Conditions or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.

·• For other purposes for which we provide specific notice at the time the information is collected.

77. Using data to provide marketing emails

·We strive to provide you with choices regarding certain personal data uses, particularly around email marketing.

·We may use your identity, contact, technical, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

·You will receive marketing communications from us if you have requested information from us or purchased our services from us or where you have not opted out of receiving that marketing.

·You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you, accessing our website settings or by contacting us at any time. Please note that where you do opt-out of marketing emails, it may take us a few days to update our records to reflect your request.

·Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a purchase, warranty registration, product/service experience or other transactions. You may therefore receive emails relating to your use, account and/or users use or account even if you have opted out of our marketing emails. This is because these emails are transactional and/or informational in nature and do not require your consent to receive.

·If you ask us to remove you from our mailing lists, we shall keep a record of your name and email address to ensure that we do not send to you anymore information you have opted out of receiving. We shall also continue to send you necessary information relating to your use of our services if you, your employer or colleague has an account with us.

88. Who do we share your data with?

·We may share your personal data with third parties in the following circumstances:

·• Service providers working on our behalf. We may share your personal data with any service providers, sub-contractors, and agents that we may appoint to perform functions on our behalf and in accordance with our instructions, including payment providers and IT hosting and maintenance services.

·• Service providers you use. If you use third-party services, for example using an Integration App or via our MCP, we will send certain information in order to make the connection. This includes, for example, member ID, email address and name.

·• Independent service providers. We may share your personal data with, or receive your personal data from, third parties that we partner with to support various aspects of our business and our services. This includes, for example, third party payment providers who collect payments on our behalf, and recruiters that we work with to identify employment candidates.

·• Professional advisors. We may share your personal data with our professional advisors, such as lawyers, accountants, auditors or consultants, where required in order to obtain advice or services.

·• Legal. We may disclose your personal data to third parties if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We also reserve the right to disclose your personal data that we believe, in good faith, is appropriate or necessary to: (i) take precautions against liability; (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity; (iii) investigate and defend ourselves against any third-party claims or allegations; (iv) protect the security or integrity of our services and any facilities or equipment used to make our services available; (v) respond to your requests; or (vi) protect our property or other legal rights, including to enforce our agreements, or the rights, property, or safety of others.

·• Merger or corporate event. We may disclose or otherwise transfer personal data to an acquirer, investor, successor or assignee as part of any merger, acquisition, debt financing, investment, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.

·• Affiliates. We may share your personal data with Attio Inc., for purposes consistent with this Privacy Policy, such as the administration and provision of our services and internal business operations.

·• AI Service Providers. We may disclose information we receive to providers of artificial intelligence services, for example to support our backend services or general business operations.

·• Analytics Partners. We use analytics services, such as Google Analytics, to collect and process certain analytics data. You can learn more about Google's practices by visiting https://www.google.com/policies/privacy/partners/.

·• Advertising Partners. We work with third-party advertising partners to collect and process your information in order to show you ads that we think may interest you. Some of our advertising partners are members of the Digital Advertising Alliance (https://optout.aboutads.info) and serve ads through cookie-based technologies. Please visit their opt-out pages to learn about how you may opt out of receiving certain web-based personalized ads from member companies. These opt-outs will apply only to our third-party advertising partners that are members of these organizations. These opt-outs will not apply when our partners serve ads through non-cookie based technologies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps.

·• Consent. We may also disclose your personal data with your permission.

99. Where we hold and process your personal data

·Some or all of your personal data may be stored or transferred outside of the United Kingdom (UK) or European Economic Area (the EEA), including for example, if our email server is located in a country outside the UK or EEA or if any of our service providers are based outside of the UK or EEA.

·Where your personal data is transferred outside the UK or EEA, it will only be transferred to countries that have been identified as providing adequate protection for your data or to a third party where we have approved transfer mechanisms in place to protect your personal data - i.e., by entering into the UK's International Data Transfer Agreement (IDTA) or Addendum, or the European Commission's Standard Contract Clauses.

·Please contact us on the email address set out in section 15 if you require further information on the specific mechanism that we use when transferring your personal data outside of the UK or EEA under this paragraph.

1010. Security

·We make reasonable efforts to protect your personal data by using appropriate technical or organizational measures designed to improve the security of the information we maintain.

·Notwithstanding the above, you acknowledge that no system can be completely secure. Therefore, although we take these steps to secure your personal data, we do not promise that your personal data will always remain completely secure.

1111. Your rights

·If you are based in the UK, the European Economic Area or Switzerland, you may have the following legal rights:

·• Access and Portability. You may ask us to provide you with a copy of the personal data we maintain about you, including a machine-readable copy of the personal data that you have provided to us, and request information about its processing.

·• Rectification and Deletion. You may ask us to update and correct inaccuracies in your personal data, or to have the information anonymized or deleted, as appropriate.

·• Restriction and Objection. You may ask us to restrict the processing of your personal data, or object to such processing.

·• Consent Withdrawal. You may withdraw any consent you previously provided to us regarding the processing of your personal data, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

·• Complaint. You may lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place. We would, however, appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us in the first instance.

·You may exercise these rights by contacting us using the contact details at the end of this Privacy Policy. Please note that there are exceptions and limitations to each of these rights.

·If we are a processor of your data (and our client is the controller) we shall only process your personal data as instructed by our client. You will need to contact our client directly if you wish to exercise your rights in relation to the data processed on our platform. If you do contact us directly, we will notify our client as soon as reasonably practical and assist our client as the controller by taking appropriate measures to enable the fulfilment of our obligations to you.

·If you have any complaints in relation to this Privacy Policy or otherwise in relation to our processing of your personal data, please tell us. We shall review and investigate your complaint and try to get back to you within a reasonable time. You can also contact the Information Commissioner, see www.ico.org.uk or if you are based outside of the United Kingdom, please contact your local data protection authority.

1212. Retention of personal data

·We will retain personal data in accordance with applicable laws.

·If we have received your personal data because you are an employee of a client, we shall retain your personal data until we no longer work with your employer, except where we are required to retain personal data for a particular period of time to comply with legal, auditory, or statutory requirements, including requirements of HMRC in respect of financial documents.

·If we have your personal data because a client has uploaded it to our platform, we shall retain it in accordance with our client's instructions.

·In some circumstances you can ask us to delete your data: see 'Your rights' above for further information.

·In some circumstances we will anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

1313. Children's privacy

·We do not knowingly collect, maintain, or use personal data from children under 18 years of age, and no part of our services is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then you may alert us by emailing support@attio.com.

1414. Third party platforms

·Our services may include links to third-party websites, plug-ins, and applications (including Integration Apps). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website or online service you visit.

1515. How to contact us

·You can contact us with any questions or comments about your personal data, this Privacy Policy, or any other privacy-related enquiries by emailing support@attio.com.

·If you are in the European Union, you may address privacy-related inquiries to our EU representative pursuant to Article 27 GDPR: EU-REP.Global GmbH, Attn: Attio Hopfenstr. 1d, 24114 Kiel, Germany attio@eu-rep.global www.eu-rep.global

·Data Processing Addendum

·This Data Processing Addendum (DPA) forms part of our Attio Customer Agreement and sets out how we process personal data on behalf of our Customers. By accepting our Attio Customer Agreement, you agree to the terms of this DPA. Last updated: September 2026

·This Data Processing Addendum (DPA) forms part of the Attio Customer Agreement and sets out the terms on which Attio may Process (as a Processor) Customer Personal Data on behalf of the Customer (as a Controller).

11. Definitions

1.11.1. Capitalised terms used but not defined have the meaning set out in the Attio Customer Agreement. The following additional definitions shall apply in this DPA:

·(a) Account Data: Personal Data collected by Attio to provide and control access to the Attio Services, including email address, name, IP address, and profile photo.

·(b) Appropriate Safeguards: such legally enforceable mechanism(s) for transfers of Personal Data as may be recognised under Data Protection Laws from time to time, including the UK IDTA, the UK Addendum and the EU SCCs.

·(c) Business Purposes: the Attio Services to be provided by Attio to the Customer as described in the Attio Customer Agreement and any other purpose identified in ANNEX A.

·(d) Customer Personal Data: Personal Data comprised in the Customer Data. Account Data is not Customer Personal Data.

·(e) Controller, Processor, Data Subject or Consumer, Personal Data, Personal Data Breach, Processing, Process or Processed, Sale, Share, and Supervisory Authority: have the meanings given to them or to similar terms in the Data Protection Laws.

·(f) Data Protection Laws: the General Data Protection Regulation 2016/679; European Directive 2002/58/EC; the UK GDPR; the UK Privacy and Electronic Communications Regulations 2003; the UK Data Protection Act 2018 (the DPA 2018); the U.S. Privacy Laws; the Swiss Federal Act on Data Protection; and any other legislation and/or regulation implementing or made pursuant to them, or which amends, replaces, re-enacts or consolidates any of them, and all other applicable laws relating to processing of Personal Data and privacy that may exist in any relevant jurisdiction.

·(g) EEA: the European Economic Area.

·(h) EU AI Act: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence.

·(i) EU Standard Contractual Clauses or EU SCCs: the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021 (as amended and updated from time to time).

·(j) Sub-processor: a Processor engaged by Attio to Process Customer Personal Data.

·(k) Third Country: a country or territory that is not part of the United Kingdom, the EEA, or Switzerland.

·(l) UK Addendum: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, Version B1.0, in force as of 21 March 2022.

·(m) UK GDPR: has the meaning set out in Section 3(10), as amended by Section 205(4), of the DPA 2018.

·(n) UK IDTA: the International Data Transfer Agreement issued by the Information Commissioner for Parties making Restricted Transfers, Version A1.0, in force as of 21 March 2022.

·(o) U.S. Privacy Laws: all U.S. federal and state privacy laws and their implementing regulations, as amended or superseded from time to time, that apply generally to the processing of individuals' Personal Data and that do not apply solely to specific industry sectors (e.g., financial institutions), specific demographics (e.g., children), or specific classes of information (e.g., health information). U.S. Privacy Laws include, but are not limited to, the following: California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (CCPA); Colorado Privacy Act; Connecticut Personal Data Privacy and Online Monitoring Act; Delaware Personal Data Privacy Act; Indiana Consumer Data Protection Act; Iowa Consumer Data Protection Act; Kentucky Consumer Data Protection Act; Maryland Online Data Privacy Act; Minnesota Consumer Data Privacy Act; Montana Consumer Data Privacy Act; Nebraska Data Privacy Act; New Hampshire Act Relative to the Expectation of Privacy; New Jersey Act Concerning Online Services, Consumers, and Personal Data; Oregon Consumer Privacy Act; Rhode Island Data Transparency and Privacy Protection Act; Tennessee Information Privacy Act; Texas Data Privacy and Security Act; Utah Consumer Privacy Act; and Virginia Consumer Data Protection Act. In the event of a conflict in the meanings of defined terms in the U.S. Privacy Laws, the meaning from the law applicable to the state of residence of the relevant Consumer applies.

22. Personal Data types and Processing purposes

2.12.1. This DPA applies to the Processing of Customer Personal Data by Attio for the purposes of providing the Attio Services where such Processing is subject to Data Protection Laws.

2.22.2. Excluding Section 2.3, this DPA applies to the Processing of Customer Personal Data for the Business Purposes by Attio as a Processor on behalf of Customer as the Controller. For the avoidance of doubt, where the CCPA applies, Attio acts as a service provider to the Customer's business for the limited and specific purposes set out in ANNEX A.

2.32.3. Notwithstanding this DPA, Customer acknowledges that Attio is a Controller when Attio (i) Processes Account Data, and (ii) Processes or aggregates Personal Data relating to the operation, support of, or use of the Attio Services (as distinct from Customer Data stored within Customer's Workspace) for its own legitimate business purposes, such as billing, account management, technical support, feedback, product development, and compliance with laws.

2.42.4. Customer remains responsible for its compliance obligations under the Data Protection Laws, including providing any required notices and obtaining any required consents for Attio's processing of Customer Personal Data, and for the written Processing instructions it gives to Attio.

2.52.5. ANNEX A describes the subject matter, duration, nature and purpose of the Processing, the Personal Data categories and Data Subject types in respect of which Attio may Process the Personal Data to fulfil the Business Purposes.

33. Right to disclose data

·Customer warrants and represents that it has the right to disclose Customer Personal Data to Attio for the purpose of receiving the Attio Services.

44. Attio's obligations

4.14.1. To the extent that Attio Processes Customer Personal Data, Attio will:

4.1.14.1.1. Process the Customer Personal Data only for the purpose of providing the Attio Services or otherwise based on the Customer's written instructions;

4.1.24.1.2. not, except as expressly permitted by U.S. Privacy Laws (i) Sell or Share Customer Personal Data; (ii) retain, use, or disclose Customer Personal Data for any purpose other than for the specific purpose of performing the services specified in ANNEX A; (iii) retain, use, or disclose Customer Personal Data outside of the direct business relationship between the Parties; or (iv) combine Customer Personal Data with Personal Data obtained from, or on behalf of, sources other than Customer, except as expressly permitted under applicable Data Protection Laws;

4.1.34.1.3. comply with the obligations of the U.S. Privacy Laws, provide the level of privacy protection required by the U.S. Privacy Laws, and provide Customer with all reasonably-requested assistance to enable Customer to fulfil its own obligations under the U.S. Privacy Laws, understand and comply with this DPA, and, upon Customer's reasonable request, make available information in Attio's possession necessary to demonstrate Attio's compliance with this subsection;

4.1.44.1.4. implement and maintain appropriate technical and organizational measures, as set out in ANNEX B, to protect Customer Personal Data against unauthorized or unlawful Processing and accidental loss, destruction, damage, theft or disclosure, having regard to the harm which might result from the same and the nature of the Customer Personal Data;

4.1.54.1.5. during the Term of the Attio Customer Agreement and for a period of thirty (30) days following its termination, allow Customer to export Customer Personal Data in a manner consistent with the functionality of the Attio Services;

4.1.64.1.6. during the Term of the Attio Customer Agreement and any time after its termination, comply with any request by Customer to delete Customer Personal Data within thirty (30) days of such request, provided that Attio still possesses such data;

4.1.74.1.7. take reasonable steps to ensure that personnel Processing the Customer Personal Data are subject to a duty of confidence in relation to the Customer Personal Data and understand the obligations under this DPA;

4.1.84.1.8. provide commercially reasonable assistance to Customer in meeting its legal obligations in relation to the security of Processing of Personal Data and in undertaking data protection impact assessments and prior consultations with Supervisory Authorities;

4.1.94.1.9. notify the Customer without undue delay and in any event no later than seventy-two (72) hours after becoming aware of any Personal Data Breach and provide information when known as to its source and nature, the type of data subject to the breach, and the identity of the affected Data Subjects;

4.1.104.1.10. maintain adequate records of Processing activities;

4.1.114.1.11. on the Customer's written request, make available information reasonably requested by the Customer to demonstrate compliance with Data Protection Laws and this Section 4.1, and allow for reasonable audits and inspections, provided that (i) the audits and inspections are conducted by an independent auditor agreed upon by the Parties; (ii) the Customer provides a minimum of thirty (30) days' written notice of the audit or inspection; (iii) the audit or inspection is limited to documents and facilities relevant and material to the Processing of Customer Personal Data; and (iv) such audits or inspections are conducted at Customer's cost, during Attio's usual business hours, in a manner that causes minimal disruption, and are not carried out more frequently than once in any twelve (12) month period;

4.1.124.1.12. notify the Customer if, in Attio's reasonable opinion, the Customer's instructions in respect of any Processing of Customer Personal Data by Attio are unlawful;

4.1.134.1.13. allow the Customer to take reasonable and appropriate steps to ensure that Attio uses Customer Personal Data consistent with the Customer's obligations under applicable Data Protection Laws and this DPA; and

4.1.144.1.14. promptly notify Customer if it determines that it can no longer meet its obligations under Data Protection Laws and take reasonable and appropriate steps to stop and remediate any such unauthorized use of Customer Personal Data if instructed by Customer.

4.24.2. The assistance provided by Attio to Customer as set out in Section 4.1.8 or Section 6.1 will be subject to reasonable costs agreed in good faith between the Parties.

55. Sale of Data

·The Parties acknowledge and agree that the disclosure or making available of Personal Data between the Parties does not form part of any monetary or other valuable consideration exchanged between the Parties with respect to the Agreement.

66. Data Subject and Consumer Rights

6.16.1. The Parties shall use reasonable efforts to assist each other to meet their obligations to respond to Data Subjects or Consumers exercising their rights under Data Protection Laws.

6.26.2. Where Attio receives a request from a Consumer or Data Subject to exercise their rights in respect of Customer Personal Data, Attio shall notify Customer promptly of this request and not act upon such request without Customer's instruction.

6.36.3. Where Customer receives a request from a Consumer or Data Subject made pursuant to Data Protection Laws that Attio must comply with, Customer shall provide Attio with the information necessary for Attio to comply with the request.

6.46.4. Attio shall not be required to delete any Customer Personal Data to comply with a Consumer's request directed by Customer if retaining such information is specifically permitted by applicable U.S. Privacy Laws, provided, however, that in such case, Attio will promptly inform Customer of the exceptions relied upon under applicable U.S. Privacy Laws and Attio shall not use Customer Personal Data retained for any purpose other than provided for by that exception.

77. Transfers of data

7.17.1. Subject to Section 9 of this DPA, the Customer gives Attio its general written consent to transfer Customer Personal Data to a Third Country where the relevant Sub-processor:

7.1.17.1.1. is in a Third Country that has been recognised as providing an adequate level of protection for Personal Data for the purposes of the Data Protection Laws;

7.1.27.1.2. is an affiliate of Attio;

7.1.37.1.3. is a Sub-processor set out in ANNEX A at the date of the Attio Customer Agreement; or

7.1.47.1.4. has Appropriate Safeguards in place with Attio.

88. Location of Customer and Attio

8.18.1. Where the Customer is located in a Third Country that the United Kingdom, EU, or Switzerland has not recognised as providing adequate protection, any transfer of Personal Data from Attio to the Customer shall be subject to the terms set forth in ANNEX C of this DPA.

8.28.2. Where Attio is located in a Third Country that the United Kingdom, EU, or Switzerland has not recognised as providing adequate protection, and the Customer is not, any transfer of Personal Data from the Customer to Attio shall be subject to the terms set forth in ANNEX C of this DPA.

99. Sub-processors

9.19.1. Subject to the terms of this Section 9, Customer authorizes Attio to appoint Sub-processors for the purpose of Processing Customer Personal Data in connection with the Agreement. The Sub-processors approved by the Customer as at the date of the Agreement are Attio's affiliates and the third-party Sub-processors listed in ANNEX A.

9.29.2. Where required by the Data Protection Laws, Attio will notify Customer prior to appointing a new Sub-processor, provided always that Customer subscribes to receive such notifications by email by completing the form available here. If Customer subscribes, Customer will be sent an email notification thirty (30) days prior to the proposed appointment of the Sub-processor to provide Customer with the opportunity to object to the appointment. Such objection must be made in writing within fourteen (14) days following Attio's notification and must be based on reasonable grounds relating to a potential or actual violation of Data Protection Laws. If Customer objects to an appointment, Attio shall use reasonable efforts to make available to the Customer a change in the services to avoid the potential or actual violation of Data Protection Laws identified by Customer. If Attio is unable to make such change within a reasonable period of time, or the Customer does not reasonably approve any such changes proposed by Attio, Customer may terminate the relevant portion of the Attio Services provided that the Customer promptly pays all correctly due sums to the point of termination to Attio.

9.39.3. Attio must enter into a written contract with each Sub-processor that contains terms substantially similar to and no less protective than those set out in this DPA.

9.49.4. Where any Sub-processor fails to fulfil its obligations under the written agreement with Attio, Attio remains fully liable to the Customer for the Sub-processor's performance of its obligations.

1010. Artificial Intelligence

·To the extent Customer accesses or uses any component of the Attio Services that incorporates, relies upon, or enables artificial intelligence, Customer shall not engage in any activity that constitutes a prohibited practice under the EU AI Act as amended, supplemented, or replaced from time to time. Customer shall ensure that all such use is fully compliant with the EU AI Act and any related implementing or delegated acts.

1111. Term and termination

·This DPA will remain in full force and effect so long as the Attio Customer Agreement remains in effect.

1212. Liability

·Liability for breach of this DPA shall be subject to the relevant clauses of the Attio Customer Agreement.

1313. General

13.113.1. If a change in any Data Protection Laws prevents either party from fulfilling all or part of its obligations under the Attio Customer Agreement, the Parties may agree to suspend the Processing of the Personal Data until that Processing complies with the new requirements. If the Parties are unable to bring the Personal Data Processing into compliance with the Data Protection Laws within sixty (60) calendar days, either party may terminate the Attio Customer Agreement by providing at least thirty (30) calendar days' written notice to the other party. The Parties agree to cooperate in good faith to enter into additional terms to address any modifications, amendments, or updates to applicable statutes, regulations, or other laws pertaining to privacy and information security, including, where applicable, Data Protection Laws.

13.213.2. Any notice or other communication given to a party under or in connection with this DPA shall comply with the relevant terms of the Attio Customer Agreement.

Annex AAnnex A. Personal Data Processing purposes and details

·Subject matter of Processing: Personal Data of Users, being employees, contractors or prospective employees or contractors of the Customer and/or such persons with whom Customer uses the Attio Services in order to contact, understand, analyse, receive communications from or otherwise persons about whom information is uploaded to the Attio Applications.

·Duration of Processing: the period of time in which the Customer receives the Attio Services and/or until such time Customer requests deletion of the relevant Personal Data.

·Nature of Processing: collecting, displaying, using, analysing, publishing and/or presenting the Personal Data in the Attio Applications.

·Business Purposes: Attio Services and the provision of the Attio Applications to the Customer and its Users.

·Personal Data Categories: name, email address, contact information, image, IP addresses, information relating to work history, experiences, personal opinions, call recordings, and/or location data.

·Sensitive Data Transferred: Such data as Customer may cause to be uploaded to the Attio Services.

·Data Subject Types: employees, contractors, consultants, prospective employees, contractors and consultants, clients, customers and suppliers and prospective clients, customers, suppliers and contacts.

·The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period: Personal Data will be retained for as long as necessary taking into account the purpose of the Processing, and in compliance with applicable laws, including laws on the statute of limitations, and Data Protection Laws.

·Approved Sub-processors:

Annex BAnnex B. Security measures

11. Attio has developed the Attio Services with IT security and the Data Protection Laws in mind.

22. Attio has, and will maintain, appropriate technical and organizational measures to ensure the security, integrity, availability and confidentiality of the Personal Data and to protect against unauthorized or unlawful Processing of the Personal Data and the accidental loss or destruction of, or damage to, the Personal Data, such measures to be appropriate to the harm that might result from the unauthorized or unlawful Processing or accidental loss, destruction of, or damage to, the Personal Data and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures.

33. Attio has the following measures in place:

3.13.1. Access Controls

3.1.13.1.1. Physical Access Controls. The Attio platform is hosted on Google Cloud Platform. Data centres used by Google Cloud Platform include extensive physical security measures built around a layered security model. More information about the physical security of these data centres can be found on Google Cloud Platform's website.

3.1.23.1.2. Logical Access Controls. Attio maintains a documented information security policy that requires employees to comply with strict access control measures. All employee access to environments hosting customer data is restricted in accordance with the principle of least privilege. Access is granted on a time-bound basis and requires mandatory Multi-Factor Authentication.

3.23.2. Encryption. All data is encrypted at rest and in transit using well-known symmetric encryption algorithms.

3.33.3. Monitoring and Testing. Attio maintains automated monitoring and testing systems to ensure the performance and security of the platform. Attio ensures its security controls are independently verified by third-party penetration testers at least once a year.

3.43.4. Data Backup. Attio maintains automated backup systems that routinely backup customer data to a different geographical region.

3.53.5. Availability. Attio ensures the availability and resilience of its services by deploying systems across multiple physically independent Cloud Availability Zones, providing redundancy and fault tolerance.

44. Attio has and will maintain adequate data Processing, disaster recovery, business continuity and IT security policies and procedures in relation to the Processing of Personal Data that meet the requirements under the Data Protection Laws including in the event of any cyber security incidents.

55. Attio shall ensure that all Attio personnel involved in the Processing of Personal Data are appropriately trained to handle and Process the Personal Data in accordance with the technical and organizational security measures set out in this ANNEX B together with any applicable Data Protection Laws and guidance.

66. Attio personnel are subject to written confidentiality obligations which cover their Processing of any Personal Data.

Annex CAnnex C. Cross Border Data Transfer Mechanisms

11. Where either the Customer or Attio is located in a Third Country that the United Kingdom, EU, or Switzerland has not recognised as providing adequate protection, and the other is not, any transfer of Personal Data from Customer to Attio or from Attio to the Customer as the case may be shall be subject to the (i) EU SCCs, and (ii) UK Addendum, which the Parties will be deemed to have entered into, and which will be incorporated into the Attio Customer Agreement by this reference, and completed as follows:

1.11.1. EU Standard Contractual Clauses

·(a) Module Two (Controller to Processor) of the EU Standard Contractual Clauses will apply where Customer is the Controller and Attio is the Processor pursuant to the DPA;

·(b) Module Four (Processor to Controller) of the EU Standard Contractual Clauses will apply where Customer is the Controller and Attio is the Processor pursuant to the DPA; and

·(c) For each Module, where applicable:

·(i) in Clause 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply;

·(ii) in Clause 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of Sub-processor changes will be as set out in Section 9.2 of the DPA (Module Two only);

·(iii) in Clause 11 of the EU Standard Contractual Clauses, the optional language will not apply;

·(iv) in Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by Irish law;

·(v) in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before the courts of Ireland. For transfers from Switzerland, Data Subjects who have their habitual residence in Switzerland may bring claims under the EU SCCs before the courts of Switzerland;

·(vi) in Annex I, Part A of the EU Standard Contractual Clauses:

·Data Exporter: Customer as a Controller when Module Two applies; Attio as a Processor when Module Four applies, the details of which are set out in the Attio Customer Agreement.

·Contact details of Attio: privacy@attio.com

·Contact details of Customer: As provided in Customer's account details.

·Activities relevant to the data transferred under these Clauses: Customer receives the Attio Services as described in the Attio Customer Agreement and Customer provides Personal Data to Attio in that context. Attio Processes Personal Data on behalf of Customer in that context.

·Signature and Date: By entering into the Attio Customer Agreement, Data Exporter is deemed to have signed these EU Standard Contractual Clauses incorporated herein, including their Annexes, as of the effective date of the Attio Customer Agreement.

·Data Importer: Customer as a Controller when Module Four applies; Attio as a Processor when Module Two applies, the details of which are set out in the Attio Customer Agreement.

·Contact details: as set out above.

·Signature and Date: By entering into the Attio Customer Agreement, Data Importer is deemed to have signed these EU Standard Contractual Clauses, incorporated herein, including their Annexes, as of the effective date of the Attio Customer Agreement;

·(vii) in Annex I, Part B of the EU Standard Contractual Clauses:

·The categories of Data Subjects and any sensitive data transferred are set out in Attio's Privacy Policy and ANNEX A of the DPA (as applicable);

·The frequency of the transfer is on continuous basis for the duration of the Attio Customer Agreement;

·The nature and purpose of the Processing and the period for which the Personal Data will be retained are set out in Attio's Privacy Policy and ANNEX A of the DPA (as applicable); and

·(viii) in Annex I, Part C of the EU Standard Contractual Clauses: The Irish Data Protection Commission will be the competent supervisory authority. For the Processing of Personal Data relating to Data Subjects located in Switzerland, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

·(ix) ANNEX B of the DPA serves as Annex II of the EU Standard Contractual Clauses.

·(x) For transfers of Personal Data that are subject to the Swiss Federal Act on Data Protection, references in the EU SCCs to the GDPR shall be read as references to the Swiss Federal Act on Data Protection and its equivalent provisions, in each case insofar as, and to the extent that, the relevant transfer is subject to the Swiss Federal Act on Data Protection.

1.21.2. UK Addendum

·(a) In Table 1 of the UK Addendum, Customer's and Attio's details and key contact information are set out in ANNEX C clause 1.1(c)(vi) above;

·(b) In Table 2 of the UK Addendum, information about the version of the EU SCCs, modules, and selected clauses, which the UK Addendum is appended to, are set out in ANNEX C clause 1.1 above;

·(c) in Table 3 of the UK Addendum:

·(i) the list of Parties is set out in ANNEX C clause 1.1(c)(vi) above.

·(ii) the description of the transfer is set out in Section 2 of the DPA.

·(iii) Annex II is located in ANNEX B of the DPA.

·(iv) the list of Sub-processors is at ANNEX A of the DPA (Module Two only); and

·(v) in Table 4 of the UK Addendum, both the Data Importer and the Data Exporter may end the UK Addendum in accordance with the terms of the UK Addendum.

1.31.3. To the extent there is any conflict or inconsistency between (i) the EU SCCs or UK Addendum and (ii) any other terms in the Attio Customer Agreement or the DPA, the provisions of the EU SCCs or UK Addendum, as applicable, will prevail.