RetentionSmith Free audit

Data Processing Addendum

Reviewed internally; not reviewed by outside counsel.

Version DPA-2026-10-16 · Part of the RetentionSmith Master Services Agreement

Reviewed internally; not reviewed by outside counsel.

This Addendum applies when RetentionSmith LLC ("Processor") processes personal information on behalf of the Client ("Controller") while providing the Services.

  1. Roles. The Client is the controller (or "business") of its customer and subscriber data. RetentionSmith is a processor (or "service provider") and processes that data only to provide the Services and only on the Client's documented instructions, which include the MSA and the Client's approvals in the portal.
  2. Data and purpose. The data covered includes subscriber and customer profiles held in the Client's Klaviyo account: names, email addresses, phone numbers, consent status, order and browsing events, and segment membership. We process it to build, test and run email and SMS marketing and to report results. Data stays inside the Client's Klaviyo account wherever possible. We pull only aggregate metrics, plus the minimum profile data a task needs.
  3. No selling. We will not sell or share the data, or use it for our own purposes. We will not combine it with other clients' data, or keep it after we no longer need it for the Services.
  4. Confidentiality. Anyone who processes the data for us is bound by confidentiality obligations.
  5. Security. We use reasonable technical and organizational measures:
  6. API keys are encrypted at rest.
  7. All traffic uses TLS.
  8. Access to production is least-privilege, and access is logged.
  9. We keep only the data we need.
  10. Subprocessors. The current list of subprocessors, with what each one does and where it processes data, is published at retentionsmith.com/subprocessors/. We impose data-protection terms on each subprocessor that are at least as protective as this Addendum, and we remain responsible for their work.

We will give 15 days' notice by email before adding a subprocessor that processes the Client's customer data. The Client may object on reasonable grounds, and if we cannot resolve the objection, it may terminate. 7. Assistance. We will help the Client answer data-subject requests and meet its legal obligations, including data protection impact assessments and consultations with regulators, to a reasonable extent and using the tools in Klaviyo. 8. Breach notice. We will notify the Client without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting the Client's data. The notice will describe the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. 9. Deletion. When the Agreement ends, we delete our copy of the Client's Klaviyo key and any client personal data in our systems within 30 days, except where the law requires us to keep it. The data in the Client's own Klaviyo account is never removed by us. 10. Audits. We will make available the information needed to demonstrate compliance with this Addendum. On reasonable written request, no more than once a year (or after a confirmed breach, or when a regulator requires it), we will answer security questionnaires and allow an audit by the Client or an independent auditor it appoints, on 30 days' notice, during business hours, under confidentiality, and at the Client's cost. 10a. CCPA service-provider terms. For personal information covered by the California Consumer Privacy Act, as amended by the CPRA, we act as a service provider. We will not sell or share the personal information; retain, use or disclose it for any purpose other than the business purposes in the MSA; retain, use or disclose it outside our direct business relationship with the Client; or combine it with personal information we receive from others, except as the CCPA permits. We will comply with the CCPA, provide the same level of privacy protection it requires, and tell the Client if we can no longer meet our obligations. The Client may take reasonable steps to stop and remediate unauthorized use. We certify that we understand these restrictions. 10b. International transfers. Our services and subprocessors are based in the United States. Where the Client's data is subject to the GDPR or the UK GDPR, the parties agree that the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, controller to processor) and, for UK data, the UK International Data Transfer Addendum, are incorporated into this Addendum by reference. Ireland's law and courts govern the EU clauses, and the UK Addendum tables are completed with the details in this Addendum. 10c. GDPR Article 28. We process personal data only on the Client's documented instructions, including for international transfers; ensure confidentiality as described in section 4; apply the measures in section 5; follow section 6 for subprocessors; assist under sections 7 and 8; delete or return data under section 9; and make information available under section 10. We will tell the Client if we believe an instruction breaks data-protection law. The processing lasts for the term of the Agreement. 11. Law and liability. The governing law and the limitation of liability in the MSA apply to this Addendum.

  1. Contact. RetentionSmith LLC, 30 E Broadway, Suite 203, Salt Lake City, UT 84111 · [email protected].