US Privacy Addendum

1 Scope & Applicability

This US Privacy Addendum applies where K.I.N.D processes personal information of individuals located in the United States on behalf of a Client. It sets out K.I.N.D's obligations under:

• The California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA)
• The CAN-SPAM Act of 2003 (commercial email)
• Other applicable US state privacy laws as they come into effect

This addendum does not modify K.I.N.D's obligations under POPIA or GDPR, which are covered in the main DPA.

2 Definitions

Business

K.I.N.D — acting as a "service provider" under CCPA when processing personal information on behalf of a Client.

Consumer

A natural person who is a California resident — as defined in Section 17014 of Title 18 of the California Code of Regulations.

Personal Information

Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household — as defined in CCPA §1798.140(v).

Service Provider

K.I.N.D's role under CCPA — processing personal information on behalf of the Client (the Business) pursuant to a written contract, for a specific business purpose, and not retaining, using, or disclosing it for any other commercial purpose.

Sale / Sharing

K.I.N.D does not sell or share personal information within the meaning of CCPA §1798.140. No data is sold, rented, released, disclosed, or otherwise communicated to a third party for monetary or other valuable consideration.

3 No Sale or Sharing of Personal Information

K.I.N.D does not sell personal information. K.I.N.D does not share personal information for cross-context behavioural advertising. This applies to all personal information processed on behalf of Clients, including lead records, email engagement data, and contact information.

K.I.N.D certifies that it understands these restrictions and will comply with them. K.I.N.D will not sell or share personal information received from a Client for any purpose other than performing the services set out in the service agreement.

K.I.N.D does not have actual knowledge that it sells or shares personal information of consumers under 16 years of age.

4 California Consumer Rights

K.I.N.D supports Clients in responding to verifiable California consumer requests. The following rights apply to California residents whose personal information K.I.N.D processes:

• Right to know (§1798.100): Consumers may request disclosure of the categories and specific pieces of personal information collected, the sources, the business or commercial purpose, and categories of third parties with whom it is shared. K.I.N.D will respond within 45 days, with a single 45-day extension where reasonably necessary.
• Right to delete (§1798.105): Consumers may request deletion of personal information K.I.N.D has collected. Requests are subject to exceptions (e.g., completing transactions, detecting security incidents, legal compliance). K.I.N.D will action deletion requests within 45 days.
• Right to correct (§1798.106): Consumers may request correction of inaccurate personal information. K.I.N.D will use commercially reasonable efforts to correct or complete inaccurate information.
• Right to opt out of sale/sharing (§1798.120): Not applicable — K.I.N.D does not sell or share personal information. There is nothing to opt out of.
• Right to limit use of sensitive personal information (§1798.121): K.I.N.D does not process sensitive personal information as defined under CPRA. This right is not triggered.
• Right to non-discrimination (§1798.125): K.I.N.D will not discriminate against any consumer for exercising CCPA rights — including by denying service, charging different prices, or providing a different level or quality of service.

To submit a California privacy request, email privacy@get-kind.com with subject line "California Privacy Request". Include your name, the type of request, and sufficient information to verify your identity. K.I.N.D will respond within 45 calendar days.

5 Authorised Agent Requests

A California consumer may designate an authorised agent to make a CCPA request on their behalf. K.I.N.D will require the authorised agent to provide written proof of authority to act on behalf of the consumer, and may verify the consumer's identity directly before processing the request.

Requests from authorised agents should be submitted to privacy@get-kind.com with documentation of the agent's authorisation.

6 CAN-SPAM Compliance

All commercial email sent by K.I.N.D on behalf of Clients to US-based recipients complies with the CAN-SPAM Act of 2003. The following requirements are met for every email:

• No deceptive headers: The "From", "To", "Reply-To" and routing information accurately identify the person or business initiating the email.
• No misleading subject lines: Subject lines accurately reflect the content of the message. No bait-and-switch subject lines are used.
• Physical address: Every commercial email includes a valid physical postal address for the sending organisation as required by CAN-SPAM Section 5(a)(5).
• Clear opt-out mechanism: Every email includes a clear and conspicuous explanation of how recipients can opt out of receiving future emails from the sender.
• Opt-outs honoured within 10 business days: Opt-out requests are processed within 10 business days as required by CAN-SPAM. Once an opt-out is processed, the sender may not send further commercial emails to that address.
• Monitoring of third-party activity: Even where K.I.N.D uses third-party services to send emails on behalf of Clients, K.I.N.D monitors compliance and takes responsibility for CAN-SPAM compliance in its role as the initiating sender.

7 Data Retention — US Contacts

Personal information of US-based contacts is subject to the same retention periods as set out in Section 6 of the main DPA:

• Lead and prospect data: retained for 24 months from the date of last campaign activity, or until deletion is requested — whichever is earlier
• Email engagement logs: retained for 24 months
• Opt-out / suppression records: retained indefinitely to honour the consumer's right not to be contacted (deletion of these records would undermine the opt-out)

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised in a manner that renders re-identification impossible.

8 Sub-processors Processing US Personal Information

The following sub-processors may process personal information of US-based contacts in the course of K.I.N.D's services. Each is a "service provider" or "contractor" under CCPA:

• Resend — email delivery infrastructure (US). Processes email addresses and delivery metadata. Bound by service provider DPA.
• PeopleDataLabs — B2B contact database (US). Primary lead sourcing; contact data from public and licensed databases. Bound by DPA with data use restrictions.
• Hunter — work-email verification (EU). Confirms a business email for a contact already identified. Bound by DPA with data use restrictions.
• Apollo.io — B2B contact database (US). Used for K.I.N.D’s own prospecting; applied to a Client’s data only where that Client supplies their own Apollo key. Contact data sourced from public and licensed databases. Bound by DPA with data use restrictions.
• Anthropic — AI language model for email generation (US). Processes email content and lead context. No data retained per Anthropic API terms.
• Supabase — database infrastructure (Cape Town, South Africa). Primary data store — not a US processor. SOC 2 Type II certified.

K.I.N.D will notify Clients of any changes to this list with reasonable prior notice.

9 Governing Law — US Addendum

This US Privacy Addendum supplements the main DPA and is governed by the laws applicable to the main DPA (the laws of England and Wales, as K.I.N.D is a UK-incorporated company) except where US federal law or California state law mandatorily applies to specific US privacy rights.

K.I.N.D acknowledges the jurisdiction of California courts in relation to CCPA enforcement and the authority of the California Privacy Protection Agency (CPPA) in relation to CPRA compliance.

For all US privacy matters, contact: privacy@get-kind.com