The data-processing terms between you and Autonomous Head Office Inc..
Last updated: October 28, 2026
This Data Processing Agreement (“DPA”) forms part of the Operator Agreement between you (“Customer”) and Autonomous Head Office Inc.(“Extend”) and applies to Extend’s processing of personal data on your behalf in providing the Service.
For personal data you submit to the Service (such as contact or lead lists), you are the controller and Extend is the processor. Where the law uses different terms (for example “business” and “service provider” under California law), the equivalent roles apply.
“Data protection laws” means all laws applicable to the processing of personal data under this DPA, including the EU and UK GDPR and applicable U.S. state privacy laws. “Personal data”, “processing”, “controller”, “processor”, and “data subject” have the meanings given in those laws. “Customer Personal Data” means personal data Extend processes on your behalf under the Operator Agreement.
Extend will process Customer Personal Data only to provide the Service and on your documented instructions (including as set out in the Operator Agreement, the Privacy Policy, and your use of the Service), unless required to do otherwise by law, in which case Extend will inform you first unless the law prohibits it. Consistent with our data commitment, Extend does not sell Customer Personal Data and does not use it to train AI models.
Extend ensures that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and process it only as needed to perform their duties.
Extend implements appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex II and on our Security page.
You give Extend general authorization to engage the sub-processors listed in Annex III to process Customer Personal Data. Extend imposes data-protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.
Extend will give you reasonable notice of any intended addition or replacement of a sub-processor [via the Annex III page / by email to your account]. If you reasonably object on data-protection grounds, you may notify us and, if we cannot resolve the objection, you may terminate the affected Service.
Taking into account the nature of the processing, Extend will provide reasonable assistance to help you respond to requests from data subjects to exercise their rights. If Extend receives such a request directly, it will, where permitted, direct the data subject to you.
Extend will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to it to help you meet your own notification obligations.
Taking into account the nature of processing and the information available to it, Extend will provide reasonable assistance with your data protection impact assessments and prior consultations with supervisory authorities.
On termination of the Service, and at your choice, Extend will delete or return Customer Personal Data within 30 days, and delete existing copies unless retention is required by law. Anonymized, aggregated data that no longer identifies any data subject is not subject to this section.
Extend will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable prior notice and subject to confidentiality. [Specify how audit rights are satisfied — e.g. via a questionnaire or third-party report.]
Where Extend transfers Customer Personal Data out of the EEA, UK, or Switzerland to a country without an adequacy decision, the transfer is governed by the applicable Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated into this DPA by reference.
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Operator Agreement. In the event of a conflict between this DPA and the Operator Agreement regarding the processing of personal data, this DPA prevails.
Encryption of data in transit; passwords stored only as salted one-way hashes; connected ad-platform credentials encrypted with AES-256-GCM using a key held separately from the data; access to production limited to personnel who need it; and data minimization. See the Security page for the current description.
This is the current, authoritative list of our sub-processors; the Privacy Policy and Security page refer here rather than naming them, and changes are notified under section 6.
To request a signed copy of this DPA or ask a question about it, contact info@extendmarketing.ai.