Bossreach · Terms of Service · Privacy Policy · Data Processing Addendum · Subprocessors · Acceptable Use Policy

Data Processing Addendum (DPA)

Between: the customer organisation that accepted the Bossreach Terms of Service ("Customer") and Final Boss Games, operating Bossreach ("Bossreach", "we").
Effective: when Customer accepts the Bossreach Terms of Service, or signs this DPA, whichever is first.
Last updated: October 11, 2026

This DPA forms part of the Bossreach Terms of Service ("Agreement"). It applies when Bossreach processes Personal Data on Customer's behalf. If this DPA conflicts with the Agreement, this DPA wins on data protection matters.

1. Definitions

• Data Protection Law: all privacy and data protection laws that apply to the processing, including the California Consumer Privacy Act as amended by the CPRA ("CCPA"), other US state privacy laws, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection, each where applicable.
• Customer Personal Data: Personal Data that Customer (or its users) puts into Bossreach, or that Bossreach collects on Customer's behalf, including CRM contacts, outreach recipients, replies, website-form submissions and visitor data on Customer sites managed through Bossreach CMS.
• Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach have the meanings in the GDPR. "Business", "Service Provider", "Sell" and "Share" have the meanings in the CCPA.
• Subprocessor: a third party Bossreach engages to process Customer Personal Data.

2. Roles

• Customer is the Controller (CCPA "Business") of Customer Personal Data. Bossreach is the Processor (CCPA "Service Provider").
• Bossreach is a Controller only for account and billing data about Customer's own users that it needs to run and secure the service, which is covered by the Bossreach Privacy Policy.

3. Customer instructions and responsibilities

• Bossreach processes Customer Personal Data only on Customer's documented instructions: the Agreement, this DPA, and Customer's use and configuration of Bossreach. If Bossreach believes an instruction breaks Data Protection Law it will tell Customer.
• Customer is responsible for having a lawful basis and any required notices or consents for the Customer Personal Data it uploads or collects, including for cold or marketing email (for example CAN-SPAM, CASL, GDPR/ePrivacy and PECR rules) and for any contact data obtained from public or third-party sources.
• Customer must not upload special-category or sensitive data (health, biometric, precise geolocation, government IDs, financial account numbers, children's data) unless Bossreach agrees in writing.

4. Details of processing (Annex 1)

5. Confidentiality

Bossreach ensures that anyone authorised to process Customer Personal Data is bound by confidentiality. Today, access is limited to the operator's own administrators.

6. Security (Annex 2)

Bossreach maintains reasonable technical and organisational measures appropriate to the risk, including:

• encryption in transit (HTTPS/TLS) and encryption at rest provided by our hosting providers;
• separation of each Customer's data by organisation ID in the application;
• access controls with role-based permissions and least-privilege administrative access;
• secret keys stored in the hosting platform's secret store, not in source code;
• logging of administrative actions where available;
• backups and the ability to restore.

Bossreach does not claim any security certification (for example SOC 2 or ISO 27001).

7. Subprocessors

• Customer gives general authorisation for Bossreach to use the Subprocessors listed at bossreach.io/legal/subprocessors (see subprocessors.md).
• Bossreach will give at least 30 days' notice of a new or replacement Subprocessor by updating that page and emailing Customer's account owner. Customer may object on reasonable data protection grounds within that period; if we cannot resolve it, Customer may terminate the affected service and receive a pro-rata refund of any prepaid fees.
• Bossreach imposes data protection terms on each Subprocessor that are no less protective than this DPA and remains responsible for its Subprocessors.

8. Artificial intelligence features

• Where Bossreach offers AI features (for example drafting emails or summarising replies), Customer Personal Data sent to the AI provider is used only to produce the output Customer asked for.
• Bossreach does not use Customer Personal Data to train AI models, and only uses AI providers whose commercial API terms say they do not train on API inputs by default.
• Bossreach will not enable any training or data-sharing option with an AI provider without Customer's prior written consent.
• Where Customer adds its own AI provider key, Customer's own account terms with that provider apply, and Customer must use a paid tier that does not train on inputs (for example, Google's free Gemini API tier may use inputs to improve Google's products).
• Call recording analysis (transcribing and summarising recorded calls) is off unless Customer turns it on for its organisation. When on, call audio and transcripts are sent to the transcription provider Customer selects (RingCentral or Google Gemini) and to the AI provider that writes the summary.

9. Assisting Customer

Taking into account the nature of the processing, Bossreach will:

• help Customer respond to Data Subject requests (access, deletion, correction, portability, opt-out), including by providing in-product export, a per-person erase (which removes one person across Customer's outreach data and keeps only a suppression entry so they are not contacted again) and organisation deletion, and forward any request it receives directly to Customer without responding itself (except to say it has been forwarded);
• keep a global unsubscribe / suppression list per Customer organisation and honour opt-outs;
• provide reasonable information for Customer's data protection impact assessments and regulator consultations.

10. Return and deletion

On termination, Customer may export its data for 30 days. After that, Bossreach deletes Customer Personal Data from live systems within 30 days and from backups within 90 days, unless law requires keeping it. Suppression entries (the email address and the opt-out) are kept, including when an organisation is deleted, so that an opt-out keeps being honoured.

11. Personal Data Breach

Bossreach will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own obligations, and will take reasonable steps to contain it.

12. Audits

Bossreach will make available the information reasonably needed to show compliance with this DPA, by answering a written security questionnaire once a year. On-site audits are allowed only if required by a regulator or after a Personal Data Breach, with 30 days' notice, at Customer's cost, during business hours, and under confidentiality.

13. International transfers

• Bossreach is based in the United States and its Subprocessors may process data in the US and other countries.
• For transfers of Personal Data from the EEA, the parties agree to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated by reference, with: Clause 7 (docking) included; Clause 9 option 2 (general authorisation, 30 days' notice); Clause 11 optional language omitted; Clause 17 governed by the law of Ireland; Clause 18 courts of Ireland; Annex I as Section 4 of this DPA; Annex II as Section 6; Annex III as the Subprocessor list.
• For the UK, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies. For Switzerland, the SCCs apply with the FDPIC as competent authority and references to Swiss law where required.

14. CCPA service provider terms

Bossreach will not: (a) Sell or Share Customer Personal Data; (b) retain, use or disclose it for any purpose other than providing the services under the Agreement, or outside the direct business relationship with Customer; (c) combine it with personal information Bossreach receives from other sources or customers, except as the CCPA allows; (d) use it for cross-context behavioural advertising. Bossreach will comply with the CCPA, provide the same level of protection it requires, and tell Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and fix unauthorised use.

15. Liability

Each party's liability under this DPA is subject to the limits in the Agreement.

16. Contact

Data protection contact: privacy@bossreach.io · Final Boss Games · [mailing address]

Changes log

Bossreach is operated by Final Boss Games · [mailing address] · privacy@bossreach.io