GDPR Alignment

1. Our Role Under GDPR

In the context of our Lead Revival Services:

Scale Amplify processes personal data solely on documented instructions from the Client and only for the purpose of delivering contracted services.

2. Lawful Basis for Processing

Scale Amplify relies on the Client's confirmation that all personal data shared has been lawfully collected and may be processed under one or more of the following legal bases, as applicable:

• • Legitimate interest in B2B communication
• • Performance of a contract
• • Consent, where required

Scale Amplify does not independently determine the lawful basis and processes data strictly as instructed by the Client.

3. GDPR Principles We Follow

Our data handling practices are aligned with the core GDPR principles:

4. Data Subject Rights

Where applicable, Scale Amplify assists Clients in fulfilling data subject rights under GDPR, including:

• • Right of access
• • Right to rectification
• • Right to erasure
• • Right to restriction
• • Right to objection
• • Right to data portability

Requests are handled in coordination with the Client, who remains the primary point of contact for data subjects.

5. International Data Transfers

Where personal data is processed across jurisdictions, Scale Amplify ensures that appropriate contractual and organisational safeguards are applied in accordance with applicable data protection regulations.

6. Security & Governance

Scale Amplify maintains organisational and procedural safeguards designed to:

• • Prevent unauthorised access or disclosure
• • Ensure confidentiality of personal data
• • Protect against accidental loss or misuse

Details of our data protection practices are described in our Data Security & Privacy documentation.

7. Data Processing Agreement (DPA)

Scale Amplify maintains a standard Data Processing Agreement that defines confidentiality, security, data handling, sub-processing, breach notification, and data deletion obligations in line with GDPR requirements. This DPA is incorporated into client engagements where applicable and is executed alongside the Lead Revival Services Agreement to formalise controller–processor responsibilities.