Data Processing Addendum

Last Updated: August 18, 2026 Effective Date: August 18, 2026

This Data Processing Addendum ("DPA") is entered into by and between RAMP.AI LLC, a New Jersey limited liability company ("Ramp AI," "we," "us"), and the customer identified in the Agreement ("Customer," "you"), and is incorporated into and forms part of the Terms of Use between the parties (the "Agreement"). Capitalized terms not defined here have the meaning given in the Agreement.

Roles. With respect to personal data that Customer and its end customers submit to the Services, Customer is the "controller" (GDPR) / "business" (CCPA), and Ramp AI is the "processor" / "service provider" — Ramp AI processes that data only on Customer's behalf and instructions. Individuals whose data Customer stores in the Services (Customer's leads, clients, and booking contacts) are "Data Subjects"; Ramp AI generally has no direct relationship with them (see Section 8).

1. Definitions

• "Data Protection Laws" means all applicable US state privacy laws (including the CCPA/CPRA and Virginia-model laws listed in Section 2), and, where applicable to Customer's use of the Services, the GDPR and UK GDPR.
• "Personal Data" means any information relating to an identified or identifiable natural person that Ramp AI processes on Customer's behalf in connection with the Services, including end-customer names, email addresses, phone numbers, and appointment/booking history.
• "Processing" has the meaning given in Data Protection Laws (broadly: any operation performed on Personal Data).
• "Services" means Ramp AI's multi-tenant CRM SaaS product, as described in the Agreement.
• "Subprocessor" means any third party Ramp AI engages to process Personal Data in connection with providing the Services, as listed in Annex A.
• "Data Subject" means the individual to whom Personal Data relates.

2. Scope — Which Laws This DPA Addresses

This DPA is drafted primarily for US state privacy law compliance:

• California: Cal. Civ. Code § 1798.100 et seq. (CCPA, as amended by CPRA) and its implementing regulations, particularly 11 CCR § 7051.
• Virginia-model states: Virginia (Va. Code § 59.1-575 et seq.) and materially similar laws in Colorado, Connecticut, Texas, New Jersey, and other states with substantially similar processor-contract requirements.
• GDPR / UK GDPR: Most Ramp AI customers are US businesses with US end customers. If Customer has EU, UK, or Swiss Data Subjects, contact privacy@rampwithai.today and the parties will execute transfer terms based on the EU Standard Contractual Clauses (Module Two, Controller-to-Processor), the UK International Data Transfer Addendum, and/or the Swiss FADP adaptations, as applicable (see Section 13).

3. Subject Matter, Duration, Nature, and Purpose of Processing

• Subject matter: Ramp AI's provision of multi-tenant CRM SaaS functionality to Customer, including customer relationship management, appointment scheduling, messaging (SMS/web chat), and AI-agent-assisted customer interactions.
• Duration: the term of the Agreement, and thereafter only as needed to perform post-termination obligations under Section 10 (Deletion/Return) or as required by law.
• Nature of processing: collection, storage, organization, retrieval, use, transmission (including via SMS/Twilio and AI processing via Gemini/Vertex AI), and deletion of Personal Data as necessary to operate the Services.
• Purpose: solely to provide, maintain, secure, support, and improve the Services for Customer, as instructed by Customer's use of the product — not for any independent purpose of Ramp AI's own.
• Categories of Personal Data: names, email addresses, phone numbers, appointment/booking history, and message content (SMS/web chat transcripts). Raw payment card data is handled by Stripe directly and is not stored by Ramp AI.
• Categories of Data Subjects: Customer's end customers (leads, clients, booking contacts) and, incidentally, Customer's own authorized users (staff) who use the Services.

4. Processing on Documented Instructions

Ramp AI will process Personal Data only: (a) to provide the Services, as instructed by Customer's ordinary use of the product (account configuration, data entry, integrations Customer enables); (b) pursuant to the Agreement and this DPA; and (c) in accordance with any other written instructions from Customer that Ramp AI has acknowledged as constituting instructions under this DPA.

Ramp AI will promptly inform Customer if, in Ramp AI's reasonable opinion, an instruction violates applicable Data Protection Law.

5. Confidentiality of Personnel

Ramp AI will ensure that any personnel authorized to process Personal Data (i) are subject to a duty of confidentiality (by employment agreement, contractor agreement, or equivalent), and (ii) access Personal Data only on a need-to-know basis necessary to perform their role.

6. Security Measures

Ramp AI will implement and maintain the technical and organizational security measures described in Annex B, appropriate to the risk of the processing. Ramp AI may update these measures over time, provided any change does not materially reduce the overall level of security.

7. Subprocessors

• General authorization. Customer grants Ramp AI general written authorization to engage the Subprocessors listed in Annex A (also published at /subprocessors) as of the effective date of this DPA, and to engage additional Subprocessors in accordance with this Section.
• Prior notice. Ramp AI will give Customer at least thirty (30) days' prior notice (by email and/or by updating the /subprocessors page) before engaging a new Subprocessor to process Personal Data.
• Right to object. Customer may object to a new Subprocessor, on reasonable grounds relating to data protection, by written notice to Ramp AI within thirty (30) days of the notice above. If the parties cannot resolve the objection, Customer's exclusive remedy is to terminate the affected Services without penalty.
• Flow-down. Ramp AI will enter into a written agreement with each Subprocessor imposing data protection obligations materially equivalent to those Ramp AI accepts under this DPA.
• Liability. Ramp AI remains fully liable to Customer for each Subprocessor's acts and omissions to the same extent Ramp AI would be liable if performing the Subprocessor's services directly.

8. Assistance with Data Subject / Consumer Rights Requests

If Ramp AI receives a request directly from a Data Subject relating to their Personal Data (e.g., an end customer of Customer's business asking to access, correct, or delete their data), Ramp AI will: (i) not respond directly to the Data Subject without Customer's authorization, except to direct them to contact Customer; (ii) promptly notify Customer of the request; and (iii) provide Customer with reasonable technical and organizational assistance (including, where feasible, self-service functionality in the product) to enable Customer to respond to the request itself.

9. Assistance with Breach Notification

• Ramp AI will notify Customer without undue delay, and in no case later than 72 hours, after becoming aware of a confirmed security incident involving unauthorized access to, or disclosure or loss of, Personal Data (a "Security Incident").
• Ramp AI's notice will include, to the extent known at the time (with rolling updates as more information becomes available): the nature of the incident, categories and approximate volume of Personal Data and Data Subjects affected, measures taken or planned to address it, and a contact point for further information.
• Ramp AI will provide reasonable cooperation and information to help Customer meet its own breach-notification obligations to regulators and affected individuals.

10. Deletion / Return of Data at End of Service

• Export window. For 30 days following termination or expiration of the Agreement, Ramp AI will make Customer's Personal Data available for export by Customer in a commonly used format, upon request.
• Deletion. Following the export window, Ramp AI will delete or de-identify all remaining copies of Personal Data (including from active systems and backups) within 90 days, except to the extent continued storage is required by applicable law, in which case Ramp AI will restrict further processing of that data to only what the law requires.
• Certification. Upon Customer's written request, Ramp AI will certify in writing that deletion has occurred.

11. Audit / Compliance Verification

• Documentation first. On reasonable written request, no more than once per 12-month period, Ramp AI will provide Customer with a written summary of its security practices (or, once available, a copy of any relevant third-party certification or audit report) to demonstrate compliance with this DPA.
• Audit fallback. If that documentation is insufficient to satisfy Customer's own legal obligations, Customer may conduct (or appoint a reputable, non-competitor third-party auditor to conduct) an audit of Ramp AI's relevant policies and procedures, subject to: at least 30 days' advance notice, no more than once per 12-month period absent a confirmed Security Incident, execution of a confidentiality agreement, and performance during normal business hours without unreasonable disruption to Ramp AI's operations. Ramp AI may charge a reasonable fee for audits beyond the documentation review, and may reasonably object to a proposed auditor that is a competitor of Ramp AI or not suitably qualified.

12. CCPA-Specific Terms

To the extent Ramp AI processes "personal information" as defined by the CCPA on Customer's behalf, Ramp AI acknowledges and agrees that it is a "service provider" (Cal. Civ. Code § 1798.140(ag)) with respect to that processing, and that Ramp AI will:

• Not sell or share (as those terms are defined under the CCPA) any personal information it processes under this DPA;
• Not retain, use, or disclose the personal information for any purpose other than the specific business purpose of providing the Services under the Agreement, or as otherwise permitted by the CCPA — including not for any commercial purpose of Ramp AI's own or outside the direct business relationship with Customer;
• Not combine personal information received from, or on behalf of, Customer with personal information received from, or on behalf of, any other Ramp AI customer, or that Ramp AI collects from its own interactions with the Data Subject, except as permitted by the CCPA (e.g., for security or fraud prevention, or at Customer's direction);
• Certify that it understands the restrictions in this Section and will comply with them; and
• Cooperate with Customer's reasonable steps to ensure Ramp AI's compliance with this Section, consistent with Section 11.

13. HIPAA / Protected Health Information

Customer represents and warrants that it will not submit, upload, or otherwise process any "Protected Health Information" (as defined under HIPAA, 45 CFR § 160.103) through the Services. Ramp AI has not implemented HIPAA-specific administrative, physical, and technical safeguards, does not offer a Business Associate Agreement, and does not act as a Business Associate under this DPA.

14. International Data Transfers

The Services are hosted and operated in the United States. To the extent Ramp AI processes Personal Data protected by the GDPR, UK GDPR, or Swiss FADP on Customer's behalf, the parties will execute the applicable transfer mechanism described in Section 2 (EU SCCs Module Two, UK Addendum, and/or Swiss adaptations) before such processing begins. If Ramp AI receives a legally binding request from a public authority for access to Personal Data, Ramp AI will, unless legally prohibited, notify Customer promptly and assess the request's validity before complying.

15. Contact / Notices

All notices under this DPA should be sent to:

RAMP.AI LLC — Attn: Privacy / Data Protection 186 Columbia Turnpike #5-177, Florham Park, NJ 07932 privacy@rampwithai.today

16. General

• This DPA is incorporated into, and subject to, the Agreement. In the event of a conflict between this DPA and the Agreement, this DPA governs solely with respect to the parties' data protection obligations.
• Except for the annexes and any Standard Contractual Clauses executed under Section 14, this DPA may only be modified by a written amendment agreed (including electronically) by both parties.
• This DPA is governed by the same law and venue as the Agreement (State of New Jersey; Morris County), except where executed Standard Contractual Clauses require otherwise.

Annex A — Subprocessor List

Ramp AI engages the following Subprocessors to provide the Services. The authoritative, maintained version of this list is published at /subprocessors; Ramp AI will update it and notify Customer per Section 7 before adding a new Subprocessor.

AI training note: Ramp AI uses the paid tier of Google's Gemini API / Vertex AI for agent processing. Under Google's terms for those paid services, prompts and outputs are not used by Google to train its models.

Annex B — Security Measures

Ramp AI maintains the following technical and organizational measures (this annex will be expanded as Ramp AI's security program matures):

• Encryption in transit: TLS for all data in transit between the client, Ramp AI's application layer, and its Subprocessors.
• Encryption at rest: provided by Ramp AI's hosting Subprocessors for stored data and backups.
• Tenant isolation: multi-tenant data isolation enforced at the database layer — each Customer tenant's data is stored in a separate, dedicated database.
• Access control: role-based access to production systems limited to authorized personnel on a need-to-know basis (see Section 5); separate administrative and application-level database credentials limit the blast radius of a compromised application credential.
• Backups & recovery: automated, per-tenant database backups supporting single-tenant recovery, with retention aligned to the deletion timelines in Section 10.
• Incident response: documented internal process to detect, triage, and respond to Security Incidents, feeding the notification obligations in Section 9.
• Personnel: confidentiality obligations per Section 5.