Version 2026-10-19. This Data Processing Agreement (“DPA”) is part of the Terms and Conditions (the “Terms”) between DYNAMIC RESOURCES SRL (“dynares”, the “Processor”) and the customer that accepted the Terms (the “Customer”, the “Controller”). It applies whenever dynares processes personal data on the Customer’s behalf in providing the Services, and meets the requirements of Article 28 of Regulation (EU) 2016/679 (“GDPR”). Words defined in the GDPR or the Terms have the same meaning here.

1. Roles and Scope

1.1. The Customer is the controller, and dynares is the processor, of the personal data described in Annex 1 (“Customer Personal Data”). Where the Customer is itself a processor for its own client, dynares is its sub-processor and the Customer confirms that its client has authorised this DPA.

1.2. dynares is an independent controller, not a processor, of data about the Customer’s own account users, billing and support, and of the data described in our Privacy Policy. This DPA does not apply to that data.

1.3. This DPA lasts as long as dynares processes Customer Personal Data, including after the Terms end until deletion under Section 10.

2. Customer Instructions

2.1. dynares processes Customer Personal Data only on the Customer’s documented instructions, including for transfers outside the EEA, unless EU or Member State law requires otherwise (in which case dynares informs the Customer first, unless the law forbids it). The Terms, this DPA, the Customer’s configuration of the Services and the Customer’s written requests are the Customer’s complete instructions.

2.2. dynares will tell the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law. dynares may then suspend that instruction until it is confirmed or changed.

2.3. dynares does not use Customer Personal Data for its own purposes, does not sell it, and does not use it to train general-purpose AI models.

3. Customer Responsibilities

3.1. The Customer is responsible for the lawfulness of the processing it instructs: having a legal basis, giving the information required by Articles 13 and 14 GDPR to its visitors and leads, obtaining any consent needed (including for cookies, local storage, device fingerprinting and similar technologies on its landing pages, and for recording calls), and honouring their rights.

3.2. The Customer will not instruct dynares to process special categories of data (Article 9 GDPR) or data about criminal convictions, unless agreed in writing.

4. Confidentiality

dynares ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, by contract or by law, and accesses it only as needed to provide the Services, give support or meet legal obligations.

5. Security

5.1. dynares implements the technical and organisational measures described in Annex 2, which take into account the state of the art, costs, and the nature, scope, context and purposes of the processing and its risks, as required by Article 32 GDPR.

5.2. dynares may update these measures, provided that the overall level of protection is not reduced.

6. Sub-processors

6.1. The Customer gives dynares general authorisation to engage sub-processors. The current list is at dynares.ai/subprocessors.

6.2. dynares will give at least thirty (30) days’ notice before adding or replacing a sub-processor, by updating that page and by email to the Customer’s account owner. The Customer may object on reasonable data protection grounds within that period. The parties will then discuss it in good faith. If they cannot resolve the objection, the Customer may terminate the affected Services before the change takes effect and receive a pro-rata refund of prepaid fees for the remaining period. In an emergency (for example, to keep the Services secure or available), dynares may replace a sub-processor sooner and will give notice as soon as possible.

6.3. dynares imposes on each sub-processor data protection obligations that are no less protective than this DPA, and remains liable to the Customer for its sub-processors’ performance, as Article 28(4) GDPR requires.

6.4. Integrations the Customer chooses to connect (for example Google Ads, Meta, HubSpot, Pipedrive or Slack) are not sub-processors of dynares. Their processing is governed by the Customer’s own agreement with those providers.

7. International Transfers

7.1. dynares stores Customer Personal Data mainly in the European Union. Some sub-processors process data outside the EEA, as shown on the sub-processors page.

7.2. dynares ensures that any transfer outside the EEA is covered by an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 3, processor to processor), with additional measures where needed.

8. Assistance

8.1. Data subject requests. Taking into account the nature of the processing, dynares helps the Customer respond to requests from data subjects, mainly through features of the Services (such as viewing, exporting and deleting leads). If dynares receives a request directly, it forwards it to the Customer without undue delay and does not respond itself, except to confirm that it has passed the request on.

8.2. Other obligations. dynares provides reasonable help to the Customer with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the information available to it. dynares may charge reasonable costs for help that goes beyond the standard features of the Services, agreed in advance.

9. Personal Data Breaches

9.1. dynares notifies the Customer without undue delay, and in any case within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2. The notice describes, as far as is then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. dynares provides more information as it becomes available, and takes reasonable steps to contain the breach and limit its effects.

9.3. A notice is not an admission of fault or liability.

10. Return and Deletion

10.1. During the subscription and for thirty (30) days after it ends, the Customer can export its data as described in the Terms.

10.2. After that period, dynares deletes Customer Personal Data within sixty (60) days, unless EU or Member State law requires it to keep some of it. Data in backups is deleted as the backups are overwritten in the normal backup cycle, and is not restored in the meantime except to recover from an incident. On request, dynares confirms the deletion in writing.

11. Information and Audits

11.1. dynares makes available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including this DPA, the list of sub-processors, a description of its security measures and, where available, its sub-processors’ certifications or audit reports.

11.2. If this information is not sufficient, or a supervisory authority requests it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once every twelve (12) months, on at least thirty (30) days’ written notice, during Romanian business hours, and without disrupting dynares’ operations or accessing other customers’ data. The Customer bears its own costs and reimburses dynares’ reasonable costs for the time spent.

12. Liability and Precedence

12.1. Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where the law does not allow them to be limited.

12.2. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

12.3. This DPA is governed by the law, and subject to the courts, set out in the Terms.

Annex 1: Details of the Processing

Subject matter	Providing the dynares platform and services under the Terms
Duration	The term of the subscription, plus the export and deletion periods in Section 10
Nature and purpose	Hosting and publishing landing pages and forms; collecting and storing leads; measuring landing page visits and conversions; detecting bots and click fraud; call tracking, recording, transcription and analysis; lead enrichment; CRM and outreach features; syncing data with integrations the Customer connects; AI-assisted analysis and content generation; managing Google Ads campaigns on Business+
Data subjects	Visitors to the Customer’s landing pages; the Customer’s leads, prospects and customers; callers to tracking numbers; contacts in the Customer’s CRM
Categories of data	Contact details and form answers (such as name, email, phone, company, message); visit data (pages viewed, time on page, referrer, campaign parameters, approximate location from IP, device and browser characteristics, visitor identifiers and device fingerprints); fraud signals; call metadata, recordings and transcripts; enriched professional data (job title, company, company size and industry); CRM records and email messages
Special categories	None intended (see Section 3.2)
Frequency	Continuous

Annex 2: Technical and Organisational Measures

Hosting: production systems run on Amazon Web Services in the EU, in data centres covered by AWS’s ISO 27001 and SOC 2 certifications.
Encryption: all traffic to the platform and to published landing pages uses TLS. Sensitive secrets, such as two-factor keys, are encrypted in the database.
Access control: role-based access within each workspace; staff access to customer workspaces is limited to people who need it for support or operations, and staff cannot accept contracts or terms on a customer’s behalf.
Authentication: hashed passwords, optional two-factor authentication and passkeys for users, bot protection on sign-up, and rate limiting on authentication and other sensitive endpoints.
Separation: customer data is logically separated by workspace, and access checks are applied to every request.
Availability: regular backups, monitoring and alerting, and a process to restore service from backups.
Development: code review and automated tests before release; dependencies kept up to date; production credentials kept out of source code.
Data minimisation: AI providers receive only the content a task needs; integration tokens are deleted or invalidated when an integration is disconnected.
Incident response: a process to investigate, contain and notify personal data breaches, as described in Section 9.
People: confidentiality obligations for everyone with access, and access removed when no longer needed.

Annex 3: Sub-processors

See dynares.ai/subprocessors.

Contact

Data protection questions about this DPA: [email protected]. DYNAMIC RESOURCES SRL, J2025076565002, CUI 52645980, Șoseaua București-Ploiești 19-21, Băneasa Business Center, Office MR8, Floor 6, Sector 1, 077190 Bucharest, Romania.