This DPA governs the processing of personal data that lemonreach AB, Swedish company registration number 559583-3822 ("lemonreach", "we", "us", "Processor") carries out on behalf of a customer ("you", "Customer", "Controller") in the course of providing the Service described in the Terms & Conditions.

It reflects the requirements of Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applies to the extent that the personal data you process through lemonreach is subject to the GDPR or equivalent data protection law, such as the UK GDPR or the Swiss Federal Act on Data Protection.

Where this DPA conflicts with the Terms & Conditions or any other agreement between the parties in relation to the processing of personal data on your behalf, this DPA prevails, unless a data processing agreement signed by both parties expressly states that it replaces or amends this DPA.

Terms such as "personal data", "processing", "data controller", "data processor", "sub-processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given to them in the GDPR.

• "Customer Personal Data" means personal data that lemonreach processes on your behalf under the Terms & Conditions, including prospect and contact data, the content of your outreach and the replies to it, personal data processed through a LinkedIn account or other integration you connect (including the connection record of a Connected LinkedIn Account), and any personal data contained in documents you upload.
• "Connected LinkedIn Account" means a LinkedIn account that you or one of your authorised users connects to the Service through the lemonreach browser extension.
• "Applicable Data Protection Law" means the GDPR and any other data protection or privacy law applicable to the processing of Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914.

In respect of Customer Personal Data, you act as the data controller and lemonreach acts as the data processor. Where you are yourself a processor acting on behalf of a third party, lemonreach acts as a sub-processor, and references to "Controller" in this DPA apply accordingly.

This allocation applies to every feature of the Service, including prospecting, enrichment, monitors, email, calling, and LinkedIn outreach. lemonreach does not determine the purposes of processing Customer Personal Data, and does not use it for its own purposes. lemonreach acts as a data controller only for the limited personal data it needs to run its own business, as described in Annex 2 and our Privacy Policy.

You are responsible for establishing and maintaining a lawful basis (such as legitimate interest) for the processing of Customer Personal Data, for the accuracy of your processing instructions, and for ensuring that your use of the Service complies with Applicable Data Protection Law. lemonreach is responsible for processing Customer Personal Data only as set out in this DPA and your documented instructions.

lemonreach processes Customer Personal Data only on your documented instructions, including with regard to transfers of Customer Personal Data to a third country, unless required to do otherwise by Union or Member State law to which lemonreach is subject. In that case, lemonreach will inform you of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

Your documented instructions are set out in the Terms & Conditions, this DPA, your configuration and use of the Service, and any further written instructions you provide. The subject matter, duration, nature, and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

lemonreach will immediately inform you if, in its opinion, an instruction infringes Applicable Data Protection Law. lemonreach is not obliged to carry out a legal assessment of your instructions.

LinkedIn activity

When you connect a LinkedIn account and agree on the extension's consent screen, the extension acts through that account on your behalf from your own browser, and lemonreach stores only a connection record (a one-way hash of the session cookie, not the cookie itself), as described in Section 11.4 of the Terms & Conditions. By doing so you instruct lemonreach to carry out the following through the account: viewing the profiles, recent posts, skills, and work history of prospects you research or enrich, and the pages, posts, and job listings of companies you research, enrich, or monitor; sending the connection invitations and messages in your campaigns; reading replies from your prospects; and checking whether your invitations have been accepted. Your campaign, enrichment, and monitor settings form part of your documented instructions, and lemonreach keeps a record of each consent given in the extension as a record of those instructions.

Every action taken through a Connected LinkedIn Account is taken on your instruction. You remain responsible for that activity, including the recipients and content of invitations and messages, having a lawful basis for contacting each recipient, and ensuring that your use of the account complies with LinkedIn's User Agreement and applicable law. lemonreach applies sending limits but does not control how LinkedIn treats your account.

lemonreach ensures that persons authorised to process Customer Personal Data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that access is limited to those who need it to provide the Service.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects, lemonreach implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. A description of these measures is set out in Annex 3.

lemonreach may update its security measures from time to time, provided that the updates do not materially reduce the overall level of protection.

You provide a general authorisation for lemonreach to engage sub-processors to process Customer Personal Data. The sub-processors engaged at the effective date of this DPA are listed in Annex 2, together with their location and the safeguard relied on for any transfer outside the EEA.

lemonreach imposes on each sub-processor, by written contract, data protection obligations that are no less protective than those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. lemonreach remains fully liable to you for the performance of each sub-processor's obligations.

Where lemonreach intends to add or replace a sub-processor, it will give you prior notice (for example by email or through the Service). You may object on reasonable data protection grounds within 30 days of the notice. If you object and the parties cannot agree on a resolution, you may terminate the affected part of the Service by written notice, as your sole remedy.

Customer-connected integrations

The Service lets you connect third-party tools and accounts that you control, such as your email mailbox (for example Google Workspace or Microsoft 365), your LinkedIn account (through the lemonreach browser extension), your CRM (for example HubSpot, Attio, or Salesforce), your telephony provider (for example Aircall), your website visitor identification provider (for example Snitcher), a contact data provider account of your own (for example Cognism), and AI agents or tools you connect through MCP. This includes leads that your CRM sends to lemonreach through a webhook you set up. When you connect such an integration, you instruct lemonreach to send Customer Personal Data to, and where relevant receive it from, that tool on your behalf. Those providers, including LinkedIn, act as your own processors or independent controllers under your separate agreement with them, not as sub-processors of lemonreach, and any transfer of data outside the EEA arising from an integration you connect is governed by your relationship with that provider. lemonreach stores the access credentials for these connections in encrypted form and uses them only to provide the connected functionality you enable. LinkedIn session cookies are not stored by lemonreach; they stay in your browser.

Taking into account the nature of the processing, lemonreach assists you by appropriate technical and organisational measures, insofar as this is possible, to respond to requests from data subjects exercising their rights under Chapter III of the GDPR (such as access, rectification, erasure, restriction, portability, and objection).

If lemonreach receives a request directly from a data subject relating to Customer Personal Data, it will not respond to the request itself, except on your documented instructions or as required by law, and will promptly inform you of the request.

lemonreach notifies you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Notifications are sent to the email address associated with your account, and you can reach our incident contact at [email protected]. The notification will, to the extent available, describe the nature of the breach, the likely consequences, the measures taken or proposed to address it, and a point of contact for further information.

As data controller, you are responsible for notifying the relevant supervisory authority and, where required, affected data subjects. lemonreach assists you in meeting these obligations, taking into account the nature of the processing and the information available to it.

Taking into account the nature of the processing and the information available to lemonreach, lemonreach provides reasonable assistance to you with any data protection impact assessment and any prior consultation with a supervisory authority that you are required to carry out under Articles 35 and 36 GDPR in relation to the Service.

On termination or expiry of the Service, lemonreach will, at your choice, delete or return all Customer Personal Data, and delete existing copies, unless Union or Member State law requires continued storage.

During the term of the Service, campaigns are deleted automatically once they are older than the campaign storage period of your plan, counted from the date the campaign was created. The storage period is currently 6 months on the Starter plan and the free plan, and 12 months on the Growth and Scale plans, as shown on our pricing page. A campaign is deleted together with its prospects, the outreach content generated for it, and its activity, including replies. Campaigns that continuously receive new prospects from a monitor are not deleted on this basis, and contacts saved in your contact list are not affected. You can export campaign data before it is deleted.

Unless you request return or deletion sooner, lemonreach will delete Customer Personal Data within 90 days of termination, subject to any data retained in routine encrypted backups, which is deleted in line with our backup cycle and remains protected by this DPA until then.

Independently of termination, the connection record of a Connected LinkedIn Account, together with its name, headline, and profile picture, is deleted when you disconnect LinkedIn, sign out of or uninstall the browser extension, or when the extension has not checked in with lemonreach for 14 days, as described in Section 3.5 of our Privacy Policy. The account's LinkedIn member identifier and connection details are kept with your account and deleted with it.

lemonreach makes available to you all information reasonably necessary to demonstrate compliance with the obligations in Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate.

To minimise disruption, you agree that lemonreach may satisfy this obligation by providing relevant documentation, security summaries, and responses to a reasonable security questionnaire. On-site audits will be limited to no more than once per year (unless required following a personal data breach or by a supervisory authority), on reasonable prior written notice, during business hours, and subject to confidentiality.

lemonreach hosts Customer Personal Data within the European Union. Its primary infrastructure is in the AWS Frankfurt region, and AI inference runs in AWS regions within the European Union. lemonreach transfers Customer Personal Data outside the EEA only to the sub-processors listed in Annex 2, or to new sub-processors engaged under Section 7, and only where an appropriate safeguard under Chapter V of the GDPR applies:

• where the European Commission has issued an adequacy decision for the destination country (for example Canada, in respect of recipients subject to PIPEDA, or the United Kingdom), or for a recipient in the United States that is certified under the EU-US Data Privacy Framework, the transfer relies on that decision; and
• where no adequacy decision applies, the transfer is made under the Standard Contractual Clauses (Module 3, processor to processor) entered into between lemonreach and the sub-processor, together with any supplementary measures needed to ensure an essentially equivalent level of protection.

To the extent the UK GDPR or the Swiss Federal Act on Data Protection applies to a transfer, the Standard Contractual Clauses apply as amended by the UK International Data Transfer Addendum issued by the UK Information Commissioner, or with the adaptations required under Swiss law, as applicable.

Where you are located in a country outside the EEA that is not covered by an adequacy decision, Module 4 (processor to controller) of the SCCs applies to Customer Personal Data that lemonreach transfers to you and is incorporated into this DPA by reference. For that purpose, Annexes 1 to 3 of this DPA complete the annexes to the SCCs, and the SCCs are governed by the laws of Sweden with disputes resolved by the courts of Sweden.

Transfers to tools and accounts that you connect yourself are made on your instruction and are addressed in Section 7.

lemonreach's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in Section 18 of the Terms & Conditions. This DPA does not limit any liability that cannot be limited under Applicable Data Protection Law.

This DPA takes effect when you accept the Terms & Conditions and remains in force for as long as lemonreach processes Customer Personal Data on your behalf. lemonreach may update this DPA in the same way, and with the same notice, as the Terms & Conditions (Section 22 of the Terms & Conditions), provided that an update does not materially reduce the protection of Customer Personal Data, except where required by Applicable Data Protection Law or a supervisory authority. The obligations that by their nature should survive (including those relating to return, deletion, confidentiality, and liability) continue after termination.

This DPA is governed by the laws of Sweden, consistent with the Terms & Conditions, without prejudice to any mandatory provision of Applicable Data Protection Law. Where the Standard Contractual Clauses apply, the governing law and forum provisions of the SCCs prevail to the extent of any conflict.

For any question relating to this DPA or to data processing by lemonreach, please contact us:

Subject matter. The provision of the lemonreach Service, including prospect discovery, contact data enrichment, signal monitors (such as hiring, LinkedIn company posts, news, web technology changes, and website visitors), AI-generated personalised outreach by email, LinkedIn, and phone, and campaign management.

Duration. For the term of your subscription and until Customer Personal Data is returned or deleted in accordance with Section 11, including the deletion of campaigns at the end of your plan's campaign storage period.

Nature and purpose. Collection, storage, organisation, retrieval, enrichment, and use of Customer Personal Data to generate and manage outreach on your documented instructions, including acting through a Connected LinkedIn Account as described in Section 4; exchanging data with integrations you connect; checking company websites for the web technologies they use; analysing replies with AI to classify them and to identify people the reply refers you to, so they can be enriched and contacted on your instructions; recording when outreach emails are opened and links in them are clicked; and any other processing necessary to provide the Service.

Types of personal data. Names, business email addresses, business phone numbers, job titles, employer and company names, professional profile information, including LinkedIn and LinkedIn Sales Navigator profile data viewed or saved through a Connected LinkedIn Account (for example skills, work history, and a work-related summary of recent posts; the text of posts read during enrichment is not stored), website visit data from a visitor identification tool you connect (the companies identified, the pages visited and when, the approximate location and device of the visit, and contact details submitted in forms on your website where the tool provides them), leads sent to lemonreach by your CRM, the web technologies detected on company websites, the content of outreach emails, LinkedIn invitations and messages, and the replies to them, email open and link click events (including the IP address, approximate country, browser, and referring page of the recipient), LinkedIn connection status for people invited through your campaigns, a one-way hash of the LinkedIn session cookie and the name, headline, profile picture, and LinkedIn member identifier of a Connected LinkedIn Account, records of consents given in the browser extension, and any personal data contained in documents or data you upload.

Categories of data subjects. Your prospects and business contacts, and your own personnel and authorised users of the Service, including the holders of Connected LinkedIn Accounts.

Special categories of data. None. The Service is not designed to process special categories of personal data or personal data relating to criminal convictions and offences, and you must not use it to do so (Section 10 of the Terms & Conditions).

Frequency of processing and transfers. Continuous, for as long as you use the Service.

The following sub-processors process Customer Personal Data to help provide the Service:

lemonreach also engages service providers in respect of the data it needs to run its own business, namely account registration and sign-in, billing, customer support, and its own website and marketing (for example Stripe and Attio), for which lemonreach acts as data controller. These are described in our Privacy Policy and are not sub-processors of Customer Personal Data under this DPA. Third-party tools and accounts that you connect yourself, such as your email mailbox, LinkedIn account, CRM, or telephony provider, are addressed in Section 7 and are likewise not sub-processors of lemonreach.

lemonreach maintains technical and organisational measures appropriate to the risk, including:

• Encryption: Customer Personal Data is encrypted in transit (TLS/HTTPS) and at rest.
• Integration credentials: mailbox credentials are stored encrypted, LinkedIn session cookies are not stored on our servers (only a one-way hash), and connection data is scoped to the individual account that connected it, never accessible to other customers or users, and used only for the functionality you enable.
• Hosting: primary infrastructure is hosted within the European Union (AWS Frankfurt region).
• Access control: role-based access on a least-privilege, need-to-know basis, with access reviewed periodically.
• Authentication: user authentication is managed with industry-standard practices through a managed identity provider.
• Network and monitoring: network controls, logging, and monitoring to detect and respond to security events.
• Confidentiality: personnel with access are bound by confidentiality obligations.
• Sub-processor management: due diligence and written data protection terms with sub-processors.
• Resilience and backups: encrypted backups and measures to restore availability after an incident.