LEGAL
Data Processing Agreement
PARTIES
1. The Client entity that is a party to the Master Agreement (further "Controller") and
2. Schedlr LLC, a U.S. based limited liability company registered in the State of Missouri
(further "Processor").
BACKGROUND
1. The Master Agreement governs Controller's use of the Schedlr platform provided by
Processor.
2. Due to the scope and subject matter of the Master Agreement, it is necessary for the
Processor to process Personal Data on behalf of the Controller.
3. This Personal Data Processing Agreement (the “Agreement”) sets out the additional terms,
requirements, and conditions on which the Processor will process Personal Data under the
Master Agreement.
1. Definitions and Interpretation
1.1 Definitions:
Authorized Persons: The persons or categories of persons that Controller authorizes to give
Processor personal data processing instructions.
Data Subject: An individual who is the subject of Personal Data.
Personal Data: Any information relating to an identified or identifiable natural person processed
by Processor as specified in Annex A.
Processing: Any activity that involves the use of Personal Data, including collection, storage,
retrieval, use, disclosure, or destruction.
Data Protection Legislation: All applicable U.S. federal and state privacy and data protection
laws, as amended from time to time.
Personal Data Breach: A breach of security leading to accidental or unlawful destruction, loss,
alteration, or unauthorized disclosure of Personal Data.
1.2. Any reference to “writing” or “written includes email, electronic messaging, and any future
messaging service hereinafter devised.
1.3. In case of conflict between provisions in the body of this Agreement and those in any Annex,
the body of this Agreement shall prevail.
2. Personal Data Types and Processing Purposes
2.1 Controller and Processor acknowledge that Controller is the Controller and Processor is the
Processor as defined under applicable Data Protection Legislation.
2.2 Controller retains control of the Personal Data and remains responsible for its compliance
obligations under applicable Data Protection legislation or regulations, including providing
any required notices and obtaining any required consents.
2.3 Annex A describes the subject matter, duration, nature, and purpose of processing,
Personal Data categories, and Data Subject categories.
2.4 Annex B provides the list of Subprocessors engaged by Processor.
3. Processor's Obligations
3.1 Processor will only process Personal Data in accordance with Controller's written
instructions as specified in Annex A.
3.2 Processor must promptly comply with any of Controller's requests requiring Processor to
amend, transfer, delete, or otherwise process the Personal Data, or to stop, mitigate, or
remedy any unauthorized processing done by Processor.
3.3 Processor will maintain the confidentiality of all Personal Data and will not disclose Personal
Data to third parties unless this Agreement specifically authorizes the disclosure or as required
by law.
3.4 Processor will reasonably assist Controller with meeting Controller's compliance obligations
under applicable Data Protection Legislation related to the nature of Processor’s processing of
data and the information available to Processor.
3.5 Processor must promptly notify Controller of any material changes to applicable Data
Protection Legislation that may adversely affect performance of the Master Agreement.
3.6 No Advisory or Solicitation Role: Processor provides technology and operational outreach support under Controller's authorization and direction. Processor may assist with drafting, executing, calling, reply management, follow-up, and appointment setting based on campaigns approved by Controller. Processor does not act as a broker-dealer, registered investment advisor, insurance agent, or compliance supervisor. Controller retains responsibility for reviewing and approving campaign content and for compliance with applicable laws, regulations, and firm-specific requirements.
3.7 Archiving Compatibility: The platform operates through the Controller's native LinkedIn
account. All messages sent through the platform originate from and are retained within the
Controller's LinkedIn account, ensuring compatibility with firm-approved archiving and
supervision platforms including Smarsh, Global Relay, and similar tools. Processor does not
provide independent archiving or recordkeeping services.
3.8 Processor will ensure that all of its employees:
(a) Are informed of the confidential nature of the Personal Data and are bound
through confidentiality arrangements;
(b) Have undertaken training associated with applicable data protection laws and
regulations related to handling Personal Data; and
(c) Are aware of both the Processor’s duties and his own personal obligations under
this Agreement.
4. Security
4.1 Processor must at all times implement appropriate technical and organizational measures
against unauthorized or unlawful processing, access, disclosure, copying, modification, storage,
reproduction, or distribution of Personal Data.
4.2 Controller confirms that the organizational and technical measures specified in Annex A are
sufficient and appropriate.
5. Personal Data Breach
5.1 Processor will promptly notify Controller if any Personal Data is lost, destroyed, damaged,
corrupted, or becomes unusable.
5.2 Processor will immediately notify Controller if it becomes aware of any accidental,
unauthorized, or unlawful processing of Personal Data, or any Personal Data Breach.
5.3 Processor will provide Controller with a description of the nature and causes of any breach,
the likely consequences, and the measures taken to address the event.
5.4 Processor will not inform any third party of any Personal Data Breach without first obtaining
Controller's prior written consent, except as required by law.
6. Data Transfers and Storage
6.1 All Personal Data is processed and stored within the United States using secure, U.S.-
based cloud infrastructure. Processor implements commercially reasonable safeguards to
protect data in accordance with applicable U.S. data protection standards.
6.2 Processor shall not transfer Personal Data outside the United States without prior written
authorization from Controller.
7. Subprocessors
7.1 Processor may not authorize a Subprocessor to process Personal Data unless Controller
has given authorization and Processor enters into a written contract with each Subprocessor
containing substantially the same terms as this Agreement.
7.2 Controller gives general authorization to involve the Subprocessors listed in Annex B.
7.3 Where a Subprocessor fails to fulfill its obligations, Processor remains fully liable to
Controller.
7.4 Future Subprocessors: As the platform expands, Processor may engage additional U.S.-
based Subprocessors (including CRM platforms, communication tools, and analytics providers)
in accordance with the notice procedures in clause 7.2. Processor will update Annex B
accordingly. Processor will provide at least 30 days' prior written notice of any intended
addition or replacement of Subprocessors. All Subprocessors are U.S.-based or meet
equivalent data protection standards.
8. Complaints, Data Subject Requests, and Third-Party Rights
8.1 Processor must promptly provide information to Controller to enable Controller to comply
with the rights of Data Subjects under applicable Data Protection Legislation.
8.2 Processor must notify Controller immediately if it receives any complaint, notice, or
communication relating to the processing of Personal Data. Processor will give
Controller its full cooperation and assistance in responding to any complaint, notice, or
Data Subject request.
8.3 Processor shall not disclose Personal Data to any Data Subject or third party except at
Controller's request, as provided in this Agreement, or as required by law.
9. Term and Termination
9.1 This Agreement will remain in full force and effect so long as the Master Agreement remains
in effect or Processor retains any Personal Data related to the Master Agreement.
9.2 Any provision of this Agreement that should continue in force after termination to protect
Personal Data will remain in full force and effect.
9.3 If a change in applicable Data Protection Legislation prevents either party from fulfilling
its obligations, the parties will suspend the processing of Personal Data until compliance is
reached. If the parties are unable to reach compliance within two (2) months, either party
may terminate the Master Agreement through written notice to the other party.
9.4 On termination of the Master Agreement, Processor will securely delete or destroy, or if
directed by Controller, return and not retain, all Personal Data related to this Agreement. At
Controller’s request, Processor will provide Controller with a copy of, or access to, all of
Controller’s Personal Data in its possession.
9.5 If any law requires Processor to retain documents it would otherwise return or destroy,
Processor will notify controller in writing, providing detail on what must be retained and the
legal basis for retention.
9.6 For any data deemed necessary to destroy, Processor will certify in writing that it has
destroyed the Personal Data within 30 days after completing the destruction.
10. Audit
10.1 If Controller is required to demonstrate compliance with applicable Data Protection
legislation, or if Processor is in breach of any of its obligations under this Agreement,
Processor will permit an assigned third-party representative of the Controller to audit
Processor's compliance, on at least 30 days' notice.
10.2 If a Personal Data Breach occurs, Processor will promptly conduct its own audit,
produce a written report, provide Controller with a copy of the audit report, and promptly
remedy any identified deficiencies related to the breach.
10.3 Processor will promptly address any exceptions noted in audit reports through a corrective
action plan.
10.4 Controller will cover all reasonable expenses incurred by Processor in connection with
performing its obligations under Section 10.1.
ANNEX A : Personal Data Processing Purposes and Details
Subject-matter and nature of processing: The provision of LinkedIn outreach and workflow
management services. The nature of the processing activities involves the search, collection,
and structuring of information from LinkedIn user profiles, as well as the creation, scheduling,
and management of user-directed outreach messages. All messages are transmitted through
and retained within the Controller's native LinkedIn account.
Processor may assist with creating, scheduling, executing, and managing outreach under the Controller's authorization and direction. Controller reviews and approves campaign content and retains responsibility for outreach communications and compliance with applicable FINRA, SEC, and firm-specific recordkeeping and supervision requirements.
Duration of Processing: Duration of the Master Agreement.
Categories of data subjects: Registered users of LinkedIn.
Purposes Personal Data Categories
To allow Controller to prepare and conduct Profile photo, name, occupation, company, URL, inbox
LinkedIn outreach activities messages, date and time of the message
To allow Controller to find people from its Profile link, profile picture, full name, status, type of
LinkedIn connections connection, occupation, tags, connected since,
campaign assigned
To allow Controller to manage interactions Inbox messages, connection status, message status,
with LinkedIn contacts name of message recipient, date and time when the
message was sent
To allow Controller to find people on LinkedIn Profile picture, name, occupation, company, URL, post
engagement, post author
To allow Controller to track the status of Profile picture, name, occupation, tags, actions
connection requests
To allow Controller to sort its LinkedIn Name, marketing campaign affiliation, tags, actions to
connections be done
To allow Controller to integrate third-party tools LinkedIn Controller data: name, event, campaign, tags,
target URL, history, time delta
To allow Controller to import LinkedIn Contact id, first name, last name, profile link, job title,
contacts and blacklists company name, email, phone, address, image link,
tags
To allow Controller to export LinkedIn Contact id, first name, last name, profile link, job title,
contacts company name, email, phone, address, image link,
tags
To allow Controller to analyze the efficiency Day-by-day statistics, total statistics, communication
of outreach activities statistics, campaign statistics, task statistics
To allow Controller to manage phone and Phone number, call log data, call duration, call outcome
calling outreach (where applicable) notes, date and time of call
Security Measures:
• Monitoring of API endpoints
• Limitation and management of access rights to personal data
• SSH protocol for accessing system data
• 2FA for employee and user accounts
• Database encryption at-rest (AES-256)
• VPN for accessing servers
• Secure (HTTPS) connection (TLS 1.2 or higher)
• Compliance with password protection and access control policies
• Usage of antivirus software and firewalls
• Regular automated backups of all processed data
ANNEX B : Subprocessors Involved
The following Subprocessors are currently engaged by Processor. Processor will provide at
least 30 days' prior written notice of any additions or changes.
Name Services Provided Location
Amazon Web Services Cloud hosting provider : all data stored on U.S.- United
Inc. based AWS infrastructure States
Zapier, Inc. App-to-app integration to allow Controller to United
connect third-party tools to Processor's platform States
Additional Processor may engage additional U.S.-based United
Subprocessors (future) Subprocessors (e.g., CRM platforms, analytics States
providers) with 30 days' advance notice per
Section 7.2.