ULTIM LEADS · VERSION 2026-10-19.2
Data processing agreement
Customer instructions, confidentiality and safeguards for personal data processed within a workspace.
Effective October 19, 2026 · Contact ULTIM
“ULTIM”, “we” and “us” mean the operator identified in the company identification. These documents apply together where expressly incorporated.
1. Scope and roles
This agreement forms part of the service terms when ULTIM processes personal data for the customer. ULTIM is the contracting entity identified in the Legal & privacy center, not a separate company for each product or workspace. The customer acts as controller or a processor authorized by its controller; ULTIM acts as processor or subprocessor. ULTIM’s independent account, billing, security and legal administration is described in Privacy notice. Mandatory law and a specifically signed data-protection agreement prevail for their subject matter. This agreement is not a HIPAA BAA or international-transfer instrument by itself.
2. Processing details
The subject matter is the contracted lead intake, communication, follow-up, AI assistance and record-management service during the service term and authorized retention period. Operations include collection, hosting, retrieval, organization, transmission, transcription, extraction, generation, support, export and deletion. Data subjects include users, prospects, leads, clients and people identified in records. Data may include identifiers, contact details, communications, recordings, documents, instructions, intake information and metadata. Regulated data requires additional authorization and safeguards for that use.
3. Instructions and customer duties
Lawful configuration, use, enabled integrations, support requests and agreed orders constitute documented instructions. The customer provides lawful notices and permissions, assesses suitability, minimizes data and ensures authority to instruct ULTIM. ULTIM processes customer personal data only on those instructions unless law requires otherwise; where permitted, ULTIM informs the customer of that requirement. ULTIM will inform the customer if an instruction appears unlawful and may suspend the affected processing pending resolution.
4. Confidentiality and safeguards
ULTIM will restrict personnel processing to legitimate service, support, security or legal needs and require confidentiality. Customer content will not be sold or used for independent advertising. Support requests do not authorize unrestricted access. ULTIM will maintain safeguards appropriate to the processing risks, including access restrictions, tenant separation, protected authentication and transport, and operational recovery measures as applicable. Particular configurations, backup commitments or certifications require agreement and verification.
5. Personal-data incidents
ULTIM will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provide available information reasonably needed for response, with updates as facts become known. Notification is not an admission of fault. The parties cooperate on containment and legal obligations; customer contacts must be kept current.
6. Subprocessors
The customer authorizes providers listed in Service providers as needed for enabled features. ULTIM will impose applicable data-protection obligations on subprocessors and remains responsible to the customer for their processing obligations under this agreement. Customer-selected integrations may act independently. For material new or replacement subprocessors, ULTIM will notify affected customers through the account contact or service before use where required, ordinarily at least 15 days in advance. Customers may raise reasonable data-protection objections; the parties seek an alternative or discontinue the affected feature if unresolved. Urgent security substitutions may require shorter notice with prompt explanation.
7. Assistance and verification
Taking account of the service and available information, ULTIM will reasonably assist verified rights requests, incidents and legally required impact assessments. Requests concerning customer data are referred to the customer unless law requires otherwise. ULTIM will make necessary compliance information available and cooperate with proportionate, confidentiality-protected audits where law requires. Audits must avoid exposing other customers’ data and unnecessary security risk; scope, timing and reasonable costs may be agreed without preventing required audits.
8. Transfers, return and deletion
Processing may occur in provider locations described in Privacy notice. Required transfer mechanisms or regional addenda must be put in place before affected transfers; contact us before enabling such a use. On termination or verified instruction, ULTIM will return or delete customer personal data as instructed, subject to law and coordinated backup or retention constraints. Retained copies remain protected and are not used for unrelated purposes. Data requests & deletion describes the assisted process. Statutory rights are not waived.
9. Customer instructions and authorizations in practice
Only a person with appropriate workspace or verified organizational authority may instruct ULTIM to disclose, export, alter or delete Customer Data. A support request may authorize access necessary to resolve that issue, not unrestricted access to unrelated records. If instructions conflict, are ambiguous or could disclose another person’s information, ULTIM may request clarification and proportionate identity verification before proceeding. A Customer acting for another controller must obtain that controller’s authority and pass through any binding limits. The Customer remains responsible for the accuracy of those instructions and for deciding what personal data is necessary.
10. Categories and feature-specific processing
Account and workspace identifiers support access and segregation. Lead and client identifiers, preferences and intake answers support the authorized follow-up purpose. Message content, recordings, transcripts and attachments support communications and collection of requested information. Extracted facts, summaries and suggested assessments support assistance rather than a final professional determination. Delivery metadata, action history and technical records support reconciliation, troubleshooting and security. Not every feature processes every category. Special-category information, children’s data and protected health information must be separately assessed and cannot be authorized merely by describing them in this processing schedule.
11. Personnel, support and confidentiality controls
ULTIM will limit access to personnel and service providers whose functions require it and apply appropriate access controls and confidentiality obligations. Customer-initiated recovery or investigation may require searching records that remain available; it does not justify repurposing them. Access rights should be withdrawn when no longer needed. The parties must avoid sharing credentials or bulk sensitive material through ordinary support correspondence. A public policy does not itself establish an audit trail, background-check program or certification that has not been implemented; any specific additional control must be included in the agreed scope.
12. Incident information and coordinated response
When an applicable Customer Data breach is known, ULTIM’s notice will describe information reasonably available concerning the nature of the event, affected processing, likely consequences and measures taken or proposed, with a contact for follow-up. Information may be supplied in stages as investigation proceeds. The Customer determines and performs its required notices to individuals or regulators unless law or a separate agreement assigns that responsibility otherwise. The parties must not delay a mandatory notice merely to agree on public messaging. Security events that do not affect personal data are assessed separately and are not automatically a reportable breach.
13. Subprocessor changes and objections
A provider acting on ULTIM’s behalf must be subject to applicable processing and confidentiality obligations. An integration the Customer independently authorizes can instead be governed by the Customer’s own agreement with that service. The Customer’s authorization to use a category of feature is not permission to sell its content to an unrelated third party. If a new subprocessor raises a substantiated data-protection concern, the parties will discuss a proportionate mitigation or alternative. If no reasonable alternative is available, the affected service may need to stop under the applicable termination and commercial terms. Objection handling does not allow a prohibited transfer to continue merely for convenience.
14. Assistance, audits and allocation of cost
ULTIM will provide information reasonably necessary to demonstrate its processing obligations, taking account of confidentiality, security and the rights of other customers. Existing suitable reports may be used before a broader audit when appropriate, without claiming that a report exists if it does not. Required audits must be proportionate, coordinated and limited to relevant processing; auditors must be independent and appropriately bound to confidentiality. Reasonable extraordinary assistance costs may be agreed in advance where law permits, but no fee may be used to defeat a mandatory individual right or legal obligation. Each party remains responsible for its own acts and any mandatory liability allocation.
15. End of processing and preserved copies
The Customer should request an available export before irreversible deletion. Following a valid return or deletion instruction, ULTIM will coordinate active records, operational copies and applicable provider requests within the agreed or legally required period. Copies retained for law, dispute preservation or backup continuity remain protected, restricted to that need and removed when the applicable basis ends. Independently controlled recipient or Customer integration copies may require a separate request to their controller. A request to delete Customer content does not automatically erase ULTIM’s lawful account billing or security records.
Contact ULTIM
For privacy, support, cancellation or billing questions, identify your account and request. Do not send passwords, payment credentials or sensitive client files in an initial email. Company identification & postal correspondence.
Version 2026-10-19.2 · Print or save a copy for your records. Previous versions are available on request.