This Data Processing Agreement (“DPA”) sets out how Gary Das Ltd, trading as ACTIVECRM, processes personal data on behalf of its customers. It meets the requirements of Article 28 of the UK GDPR and forms part of the ACTIVE CRM Terms and Conditions (the”Terms”).
Last updated: 11 October 2026
1.1 This DPA is between you, the customer named in your Account (the “Controller”), andGary Das Ltd, company number 11072529, of 4 The Capricorn Centre, Cranes Farm Road,Basildon SS14 3JJ, trading as ACTIVE CRM and Systemise & Scale Consulting (the”Processor”, “we” or “us”). Our ICO registration number is ZA776121.
1.2 This DPA applies to all personal data in Client Data that we process on your behalf inproviding the Services (“Client Personal Data”). It does not apply to personal data weprocess as a controller, such as your billing details and your account contacts, which ourPrivacy Policy covers.
1.3 Capitalised words not defined in this DPA have the meaning given in the Terms.”Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal databreach” have the meanings given in the UK GDPR.
1.4 If this DPA conflicts with the Terms on any data protection matter, this DPA takespriority.
2.1 You are the controller of Client Personal Data. You decide why and how it is processed.
2.2 We are your processor. HighLevel LLC, a subsidiary of GoHighLevel Inc., is our sub-processor, providing and hosting the Platform.
2.3 Annex 1 describes the subject matter, duration, nature and purpose of the processing,the types of personal data and the categories of data subjects.
3.1 Instructions.
We will process Client Personal Data only on your documentedinstructions, including in relation to international transfers, unless the law requiresotherwise. If so, we will tell you before processing unless the law prohibits it. Yourinstructions are set out in the Terms, this DPA, your configuration and use of the Platform,and any further written instructions you give us. If we believe an instruction breachesData Protection Laws, we will tell you promptly.
3.2 No other use.
We will not sell Client Personal Data, use it for our own purposes, orcombine it with other data except as needed to provide the Services.
3.3 Confidentiality.
We will make sure everyone we authorise to process Client PersonalData is bound by a duty of confidentiality and has access only to the data they need fortheir role.
3.4 Security.
We will take the technical and organisational measures required by Article 32of the UK GDPR to protect Client Personal Data, including the measures in Annex 2. Youconfirm that you have reviewed Annex 2 and consider these measures appropriate for thedata you intend to process, taking into account the Prohibited Data restrictions in clause5 of the Terms.
3.5 Data subject requests.
Taking into account the nature of the processing, we will helpyou respond to requests from individuals exercising their rights under Data ProtectionLaws. Most requests can be handled using the Platform’s own tools, such as search,export, edit and delete. If we receive a request directly, we will pass it to you promptlyand will not respond except to tell the requester we have passed it on.
3.6 Other assistance.
Taking into account the nature of the processing and theinformation available to us, we will give you reasonable help with your obligations onsecurity, personal data breach notification, data protection impact assessments and priorconsultation with the ICO.
3.7 Records.
We will keep a record of our processing activities as required by Article 30(2)of the UK GDPR.
4.1 General authorisation.
You give us general authorisation to use the sub-processorslisted in Annex 3, and HighLevel’s own sub-processors as listed in HighLevel’s dataprocessing agreement, which is updated from time to time.
4.2 Contractors.
You also authorise us to engage individual contractors, such as virtualassistants or freelance builders, to help provide the Services. Before a contractoraccesses Client Personal Data, we will carry out appropriate checks, put a writtencontract in place under clause 4.4 and add them to the list in Annex 3.
4.3 Changes.
We will give you at least 30 days’ notice by email before adding or replacing asub-processor we engage directly, including a contractor. We will pass on any noticeHighLevel gives us of changes to its sub-processors. If you have reasonable dataprotection grounds to object, you must tell us within that notice period. We will discussyour concerns in good faith. If we cannot resolve them, you may end the agreement bynotice without paying the notice period in clause 9.2 of the Terms.
4.4 Flow-down and responsibility.
We will put a written contract in place with each sub-processor we engage directly that contains data protection obligations equivalent tothose in this DPA. We remain responsible to you for the performance of the sub-processors we engage, subject to the Terms.
5.1 United States hosting.
The Platform is hosted by HighLevel in the United States. Youauthorise this transfer of Client Personal Data. The transfer relies on the UK Extension tothe EU-U.S. Data Privacy Framework, under which HighLevel LLC and LeadConnector LLCare certified. HighLevel may give its affiliates and service providers in other countries,including India, access to data. Those onward transfers are covered by HighLevel’s owntransfer safeguards.
5.2 Other transfers.
We will not transfer Client Personal Data outside the UK in any otherway, including by allowing access by a contractor located outside the UK, unless:
1. the destination is covered by UK adequacy regulations; or
2. we have put in place the UK International Data Transfer Agreement or anothersafeguard permitted by Data Protection Laws, and carried out any assessment thoselaws require.
5.3 Information.
On request, we will tell you which transfer safeguard applies to each sub-processor.
6.1 Notification.
We will tell you without undue delay, and where possible within 48 hours,after becoming aware of a personal data breach affecting Client Personal Data, includingone notified to us by HighLevel.
6.2 Information we will give you.
As far as it is available, we will tell you the nature of thebreach, the categories and approximate number of data subjects and records affected,the likely consequences, and the measures taken or proposed to deal with it. Whereinformation is not yet available, we will provide it in stages as we get it.
6.3 Cooperation.
We will take reasonable steps to contain and investigate the breach andwill cooperate with you in meeting your obligations to notify the ICO and affectedindividuals. We will not notify the ICO or individuals about a breach of Client PersonalData on your behalf unless you ask us to or the law requires it.
6.4 Your account security.
A breach caused by your Authorised Users’ login details beingcompromised is your responsibility to investigate, but we will help you as described inclause 6.3.
7.1 Information.
On request, we will make available all information reasonably necessaryto show we are meeting our obligations under Article 28 of the UK GDPR. This includesHighLevel’s published security and compliance materials, to the extent HighLevel makesthem available to us.
7.2 Audits.
You, or an independent auditor you appoint who is bound by confidentiality,may audit our compliance with this DPA once in any 12-month period, on at least 30 days’written notice, during business hours. You may audit more often after a personal databreach affecting your data, or where the ICO or another regulator requires it. You will payyour own costs of any audit, and our reasonable costs beyond one business day of ourstaff time.
7.3 HighLevel.
We cannot give you direct audit rights over HighLevel. We will usereasonable efforts to obtain information from HighLevel that you reasonably request.
7.4 Regulated Firms.
If you are a Regulated Firm, the access and audit rights in Schedule 1of the Terms also apply.
8.1 You confirm that:
1. you have a lawful basis for all processing of Client Personal Data you instruct us tocarry out;
2. you have given data subjects the privacy information required by Data ProtectionLaws, including that their data will be processed by service providers in the UnitedStates;
3. your instructions to us comply with Data Protection Laws; and
4. you will not store Prohibited Data in the Platform, as set out in clause 5 of the Terms.
8.2 You are responsible for configuring the Platform securely, including user permissionsand two-factor authentication, and for deciding how long to keep Client Personal Data inyour Account.
9.1 When the agreement ends, you may export your Client Personal Data or transfer youraccount to HighLevel during the Exit Window, as set out in clause 10 of the Terms. This ishow we return Client Personal Data to you.
9.2 After the Exit Window, we will delete Client Personal Data within 60 days, exceptwhere the law requires us to keep it. Copies in HighLevel’s backups will be overwritten inline with HighLevel’s normal backup cycle. On request, we will confirm deletion in writing.
10.1 Each party’s liability under this DPA is subject to the limits and exclusions in clause 12of the Terms.
10.2 This DPA continues for as long as we process Client Personal Data on your behalf,including after the Terms end.
Subject matter: providing the ACTIVE CRM platform and related setup, build, supportand coaching services.
Duration:
the term of the agreement, plus the Exit Window and the deletion period in clause 9.
Nature of processing:
hosting, storing, organising, retrieving, sending, recording,transcribing, analysing and deleting data, through the Platform and when our teamaccesses your Account.
Purpose: to provide the Services to you under the Terms.
Data subjects: your customers, prospects, leads, website visitors, form respondents,appointment bookers, and your staff and Authorised Users.
Types of personal data: identity and contact details; company and job details; financial information such as income, pension values, loan amounts and property values; communications content (email, SMS, WhatsApp, chat); call recordings and transcripts; appointment and transaction history; marketing preferences and consent records; notes; website, form and tracking data.
Special category and criminal offence data: none. These are Prohibited Data underclause 5 of the Terms.
Measures we will apply
Measures provided by HighLevel, as described in HighLevel’s published security materials:
HighLevel LLC and LeadConnector LLC. Service: Platform software and hosting.Location: United States, with some access by HighLevel affiliates and service providersin India. Transfer safeguard: UK Extension to the EU-U.S. DPF (HighLevel is certified).
HighLevel’s sub-processors. Service: infrastructure, communications, AI and otherplatform services. Location and transfer safeguard: as listed in HighLevel’s dataprocessing agreement.
Microsoft Corporation (Microsoft 365, Teams). Service: email, file storage and videocalls when you share Client Personal Data with us. Location: UK and EEA, with someprocessing in the US. Transfer safeguard: UK adequacy, or Microsoft’s transfersafeguards.
Zoom Communications, Inc. Service: video calls for support and coaching, whereClient Personal Data is shown on screen. Location: United States. Transfer safeguard:UK Extension to the DPF, or IDTA / UK Addendum.
Contractors. Service: build and support assistance. Location: to be listed beforeaccess is given. Transfer safeguard: UK adequacy, or IDTA.
This list was last updated on 11 October 2026.