CreamSoda Privacy Policy

1. Information We Collect

When you interact with our Services, we may collect personal information and other information as described below.

1.1 Personal Information You Provide

We may collect information that you voluntarily provide when you:

• Register for or administer a CreamSoda account.
• Use the Services.
• Contact us for support or other inquiries.
• Submit information through our websites.
• Participate in surveys or provide feedback.
• Subscribe to communications or request information about our products.

This information may include your name, email address, telephone number, business information, account credentials, profile information and other information necessary to provide the requested Services.

We collect and use this information for the purposes described in this Privacy Policy and in accordance with applicable legal requirements.

Providing information voluntarily does not automatically constitute consent to every possible use of that information. Where specific consent is legally required, we obtain it through an appropriate process.

1.2 Customer-Controlled Information

Customers and their authorized users may enter, upload, import, create, receive or otherwise process information through CreamSoda.

This information may include:

• Names and contact details.
• Customer and prospect records.
• Business relationships and transaction information.
• Emails, messages and communications.
• Documents, attachments and other files.
• Appointments and booking information.
• Forms and submitted responses.
• Notes, activities and interaction histories.
• Sales, invoice and payment-related records.
• Custom fields and other customer-configured information.

Depending on how a customer configures and uses the Services, these records may contain information about individuals who do not have CreamSoda accounts.

Certain records may include information considered sensitive under applicable privacy laws.

Customers determine what information they collect and maintain through CreamSoda and are responsible for ensuring that they have the necessary legal authority to collect, use, store, disclose and otherwise process that information.

The availability of a field, feature or integration does not mean that CreamSoda has determined that it is appropriate for every category of personal information, industry or regulated activity.

Customers are responsible for evaluating whether the Services and available safeguards are suitable for their intended purposes.

1.3 Device, Usage and Technical Information

When you access or use the Services, we may collect technical and usage information, including:

• Internet Protocol (IP) addresses.
• Browser types and versions.
• Device identifiers and attributes.
• Operating systems.
• Referring websites and URLs.
• Pages and features accessed.
• Dates, times and duration of activity.
• Navigation and interaction information.
• Error logs and diagnostic information.
• Other technical information associated with the operation and security of the Services.

We may use this information to operate, maintain, secure, troubleshoot and improve the Services.

1.4 Non-Identifiable and Aggregated Information

We may create or use aggregated or non-identifiable information to understand usage patterns, evaluate service performance, improve functionality and analyze general business trends.

Such information may include aggregate visitor statistics, feature usage, general demographic patterns and other statistical information.

We may share aggregated or non-identifiable information with affiliates, service providers, business partners or other third parties for lawful business purposes.

Information is not considered non-identifiable merely because names or other obvious identifiers have been removed. Where information remains reasonably capable of identifying an individual, we treat it as personal information.

This provision does not authorize unrelated use or disclosure of identifiable customer-controlled information.

1.5 Cookies and Similar Technologies

Our websites and applications may use cookies and similar technologies to:

• Maintain authenticated sessions.
• Provide requested functionality.
• Remember certain preferences.
• Support security features.
• Analyze service performance and usage.
• Improve the user experience.

Some cookies are necessary for the operation of requested Services. Other technologies, including optional analytics, may require additional consent depending on applicable law.

Most browsers allow users to manage or disable cookies through their settings. Disabling certain cookies may affect the availability or functionality of the Services.

1.6 Application Analytics

We may use analytics technologies, including third-party tools, to understand how the Website and Services are used, identify technical or usability issues and improve functionality. Depending on the technology and features in use, information collected may include device and browser details, pages or features visited, interactions such as clicks and scrolling, and session-level information. Certain tools may provide heatmaps or session replays.

We seek consent for analytics where required by applicable law. To request withdrawal of consent for analytics, please contact us at legal@crmsoda.com. We will handle the request in accordance with applicable law. Information previously collected may remain subject to applicable retention requirements and the relevant provider's practices.

Some content may be masked or excluded from analytics collection; masking does not necessarily render all remaining information anonymous. Analytics providers may process information under their own applicable privacy practices and contractual arrangements. Our use of analytics tools and providers may change over time, subject to applicable notice and consent requirements.

1.7 Email and Link Tracking

Certain CreamSoda features allow customers to enable email engagement tracking.

Where enabled, tracking technologies may record information such as:

• Email opens and link clicks.
• Dates and times of interactions.
• IP addresses.
• Browser or device information.
• Approximate IP-derived geographic location or time zone.
• Associations between interactions, messages and customer records.

CreamSoda may use third-party IP-based geolocation services to support relevant functionality.

Certain tracked interactions may update contact-related location or time-zone information.

Customers decide whether to use available tracking functionality and are responsible for providing any legally required notices and obtaining any necessary consents or other lawful authority.

Email tracking information may be affected by security scanners, proxies, automated systems and forwarded messages. Recorded events do not necessarily establish that a particular individual opened or read a message.

1.8 Externally Hosted Resources

Certain pages, emails, applications or embedded tools may load resources hosted by third parties, including fonts, images, videos, product tours and support materials.

Loading these resources may disclose technical request information, such as IP addresses and browser information, to the relevant service providers.

2. Our Use of Personal Information

Inka Inc. uses personal information for purposes related to operating, maintaining, supporting and improving CreamSoda.

These purposes may include:

• Creating and managing accounts.
• Authenticating users and managing access.
• Providing requested functionality.
• Maintaining customer-controlled records and files.
• Operating forms, bookings, messaging and communications.
• Performing customer-authorized workflows.
• Supporting integrations with third-party services.
• Administering subscriptions, invoices and payments.
• Providing technical support.
• Diagnosing errors and resolving service problems.
• Protecting the security and integrity of the Services.
• Preventing fraud, unauthorized access and misuse.
• Developing and improving the Services.
• Complying with applicable legal obligations.

Where enabled and requested, certain features may generate automated results, reports, business insights or AI-assisted content.

These outputs may contain inaccuracies or omissions. Customers are responsible for reviewing outputs before relying on them for important decisions.

We may also use account and business contact information to communicate with users regarding updates, functionality, administrative matters, billing, support and other matters related to the Services.

Where permitted by applicable law, we may send information about our products and services.

Marketing communications will include applicable unsubscribe mechanisms. Users may withdraw marketing consent or opt out where permitted.

Certain essential administrative communications, including billing, security and service notifications, may continue while an account or other relevant relationship exists.

Where particular privacy laws require a specified legal basis for processing, that basis depends on the nature and purpose of the activity.

Nothing in this section establishes or substitutes for a customer's legal authority to collect or process information about its own contacts, clients or other individuals.

3. Disclosure of Personal Information

Inka Inc. is not in the business of selling personal information.

We may disclose personal information where reasonably necessary to provide the Services or for other purposes described in this Privacy Policy, subject to applicable legal requirements.

3.1 Related Companies

We may share information with subsidiaries, affiliates or related companies for purposes consistent with this Privacy Policy.

3.2 Service Providers

We may engage third-party service providers to perform functions relating to the Services, including:

• Hosting and infrastructure.
• File storage and backup.
• Email delivery.
• Payment processing.
• Technical support.
• Analytics.
• Security and diagnostics.
• AI functionality.
• Other operational services.

Depending on the features used, relevant providers and integrations may include providers of email, calendar and contact connectivity; message delivery and marketing services; payment processing; accounting services; IP-based geolocation; analytics; AI functionality; and customer-selected integrations.

Not all providers or integrations are used for every customer. The providers, available integrations and technical arrangements may change over time, subject to any notice or consent requirements under applicable law.

Different providers may have different responsibilities, processing locations, practices and contractual terms.

3.3 Customer-Directed Sharing

Customers may authorize the Services to share information with:

• Their administrators and authorized users.
• Email or message recipients.
• Meeting participants.
• Recipients of shared links.
• Connected applications.
• Other third parties selected or authorized by the customer.

Customers are responsible for managing access permissions and determining whether their disclosures are lawful.

CreamSoda is not responsible for independently determining whether a customer's intended recipients are legally entitled to receive information, except to the extent required by applicable law.

3.4 Business Transfers

If Inka Inc. undergoes a merger, acquisition, restructuring, financing transaction, sale of assets or similar business transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable legal requirements.

3.5 Legal Requirements

We may disclose information where required by law or where reasonably necessary to:

• Comply with legal obligations or lawful process.
• Protect our legal rights or property.
• Investigate fraud or misuse.
• Protect the security of the Services.
• Respond to urgent threats to safety.
• Establish, exercise or defend legal claims.

Disclosures will be subject to applicable legal requirements.

4. Your Choices

Users may have choices concerning the collection, use and disclosure of their personal information, depending on the nature of the information and applicable law.

These may include:

• Updating account information.
• Changing available privacy preferences.
• Managing marketing communications.
• Disconnecting integrations.
• Requesting account closure.
• Requesting access to or correction of personal information.
• Requesting deletion where legally applicable.

Requests concerning information controlled by a CreamSoda customer may need to be directed to that customer.

Cancellation of a subscription, removal of a user, disconnection of an integration and closure of a customer workspace are different actions and may have different consequences for stored information.

Deletion requests may be subject to applicable retention requirements, technical processes, backups and information previously disclosed to third parties.

Further information about deletion and retention is provided in Section 14.

5. Links to Other Websites

The Services may include links to websites or resources operated by third parties.

This Privacy Policy does not govern websites or services that are not operated or controlled by Inka Inc.

The inclusion of a link does not constitute an endorsement of a third party or its privacy practices.

Users should review the applicable privacy policies and terms of third-party websites and services before providing personal information.

6. Integration of Third-Party Services and AI Functionality

CreamSoda may allow customers to connect external applications, platforms and services.

These integrations are generally enabled by the customer or an authorized administrator.

Customers are responsible for determining which integrations to activate, what information to exchange and whether they have the authority required for the intended processing.

6.1 Authorization and Access

Depending on the integration, authorization may use OAuth, access tokens, API keys, SMTP credentials or other authentication mechanisms.

Some integrations may use delegated authorization methods, such as OAuth, that do not require users to provide their external account passwords directly to CreamSoda. The authorization method depends on the provider, integration and configuration.

Other integrations may require credentials or configuration information to establish a connection.

The permissions requested by an integration determine what information or functionality may be accessible.

Customers should review those permissions before authorizing a connection.

6.2 Email, Calendar and Contact Integrations

Where authorized, supported email, calendar and contact integrations may support activities such as:

• Accessing or synchronizing emails.
• Creating drafts or sending messages.
• Processing relevant message attachments.
• Synchronizing contacts.
• Accessing calendar information.
• Creating, modifying or deleting calendar events.
• Managing meeting information, participants, locations and related details.

The availability of these functions depends on the integration, permissions and features enabled.

Information obtained through third-party APIs may be subject to additional restrictions imposed by the applicable provider, including requirements concerning permitted uses, disclosure, transfer and retention, and restricted-use conditions where relevant.

6.3 Email Delivery and Marketing Integrations

CreamSoda may integrate with third-party email delivery, marketing and communications services, including services selected by the customer.

Depending on the integration, these services may process:

• Sender and recipient information.
• Message content.
• Attachments.
• Delivery events.
• Contact lists.
• Subscription preferences.
• Marketing engagement information.

Customers are responsible for ensuring that they have the necessary authority to transfer contact information and send communications.

Connecting an email or marketing service does not, by itself, establish that recipients have consented to receive marketing communications.

6.4 Payment Services

CreamSoda may use third-party payment service providers for subscription billing or customer-configured payment functionality.

Depending on the provider and payment flow, full payment-card numbers and security codes may be processed directly by the payment service provider, with tokenization or similar mechanisms used to limit the payment information received or stored by CreamSoda. Not every payment flow necessarily uses the same method.

CreamSoda may receive payment tokens, card-related metadata, transaction references, dates, amounts, currencies and other information necessary to administer transactions.

Payment transactions are subject to the applicable payment provider's services, terms and technical arrangements.

Payment providers may collect and process additional information under their own privacy policies and contractual terms.

6.5 Accounting Integrations

Customers may connect supported third-party accounting services.

Depending on the integration, CreamSoda may exchange customer references, invoice information, billing details, transaction amounts, currency settings and related accounting information.

Customers are responsible for reviewing information before sending it to connected accounting services, including any free-text descriptions that may contain personal or sensitive information.

Changes to invoices or transactions do not necessarily remove information previously recorded by an external accounting provider.

6.6 Artificial Intelligence Features

CreamSoda may offer AI-assisted features, including content generation, writing assistance, business tools or other automated functionality.

Current AI features are intended for use without personal information that identifies an individual directly or indirectly.

Do not submit personal information that identifies an individual directly or indirectly to current AI features, including identifiable customer records, emails or session notes. Remove personal information before submitting content.

Customers and users are responsible for reviewing and preparing information before submitting it to AI functionality.

Depending on the feature, submitted information may be transmitted to external AI service providers for processing and generation of requested results.

Certain tools may also use external web-search, image-generation or embedded AI services.

The handling and retention of information by these providers are governed by applicable arrangements and provider practices. Users should not assume that all AI services apply identical retention, training, storage or confidentiality rules.

AI-generated information may be incomplete, inaccurate or unsuitable for a particular purpose.

Customers and users are responsible for reviewing generated results and determining whether they are appropriate for their intended use.

CreamSoda does not guarantee the accuracy, completeness, legality or regulatory suitability of AI-generated content.

Automated removal or masking of identifying information, where available, may not identify every possible identifier.

The restrictions in this subsection apply to AI inputs and do not prohibit ordinary authorized processing through CreamSoda's CRM, payment or accounting features.

6.7 Disconnecting Integrations

Disconnecting an integration from CreamSoda does not necessarily:

• Revoke authorization previously granted to the external provider.
• Invalidate all previously issued API credentials.
• Delete information already transferred.
• Remove records held by a third party.
• Cancel external subscriptions or services.

Customers may need to revoke access, rotate credentials or request deletion directly through the relevant third-party provider.

Information already processed or stored by external services may remain subject to their respective policies, agreements and retention requirements.

7. Security

Inka Inc. takes reasonable measures designed to protect personal information against unauthorized access, disclosure, alteration, misuse, loss or destruction.

These measures are appropriate to the nature of the Services and the information processed, taking account of applicable legal requirements.

However, no method of Internet transmission, electronic storage or electronic communication is completely secure.

We cannot guarantee that unauthorized access, disclosure or other security incidents will never occur.

Customers and users are responsible for protecting their account credentials, managing authorized access and using the available security features appropriately.

Additional information about our security practices is provided in Section 13.

8. Other Terms and Conditions

Access to and use of CreamSoda are subject to the applicable Terms of Service and any additional agreements accepted by the customer.

CreamSoda provides configurable features that may help customers manage certain privacy, data protection and electronic-marketing requirements, including requirements associated with PIPEDA, GDPR, CASL and CAN-SPAM, where applicable.

The availability or use of these features does not guarantee compliance with any law or regulation.

Customers are responsible for determining their applicable obligations and configuring and using the Services accordingly.

CreamSoda does not provide legal advice, legal compliance certification or a guarantee of regulatory compliance.

Any allocation or limitation of contractual liability is governed by the applicable Terms of Service and other binding agreements, subject to applicable law.

Nothing in this Privacy Policy excludes legal obligations or responsibilities that cannot lawfully be excluded.

9. Changes to This Privacy Policy

Our Services, business practices and legal obligations may change from time to time.

We may update this Privacy Policy to reflect changes in functionality, technology, legal requirements or information-handling practices.

Updates will be made available through the Website or Services.

Where required by applicable law, we will provide additional notice of material changes or obtain any necessary consent.

The date of the latest revision will be indicated at the beginning of this Privacy Policy.

Continued use of the Services does not replace consent where applicable law requires a separate affirmative choice.

10. Access to Information

Individuals may have rights concerning personal information held or processed by Inka Inc., depending on applicable law and the circumstances.

These rights may include requesting:

• Access to personal information.
• Correction of inaccurate information.
• Information about how personal information is used or disclosed.
• Deletion of information where applicable.
• Withdrawal of consent where processing depends on consent.
• Other rights available under applicable law.

Requests may be submitted using the contact information in Section 18.

Inka Inc. will assist any individual who needs help preparing a request. Responses will be provided in an understandable manner with adequate explanation of abbreviations or codes. Upon request, we will provide access to personal information in an alternative format for individuals with sensory disabilities, where conversion is reasonable and necessary or required by applicable law.

We may require reasonable information to verify the identity and authority of the person making a request.

Where Inka Inc. is responsible for responding to a request, we will do so within the period required by applicable law. For requests governed by Canadian law, this will generally be within 30 days, subject to any legally permitted extension.

We may decline or limit a request where applicable law permits or requires us to do so, and will provide an explanation where required.

Requests Concerning Customer-Controlled Information

CreamSoda customers determine the purposes for which they collect and manage Client Data.

Accordingly, individuals seeking access to, correction of or deletion of information held by a CreamSoda customer should generally contact that customer directly.

Where Inka Inc. receives a request concerning Client Data, we may direct the requester to the relevant customer or provide appropriate assistance in accordance with applicable law and our contractual obligations.

CreamSoda does not independently determine whether a customer's collection, retention or use of Client Data is lawful, nor does it assume responsibility for making the customer's privacy decisions.

This does not limit any legal obligations applicable directly to Inka Inc.

Individuals may also raise concerns with an appropriate privacy or data-protection authority where permitted by applicable law, including the Office of the Privacy Commissioner of Canada.

11. Users' Consent

By using the Services, users acknowledge that information may be processed as described in this Privacy Policy.

Acknowledgment of this Privacy Policy does not, by itself, constitute consent to activities for which separate consent is legally required.

Where consent is required for particular activities, we obtain it through an appropriate mechanism.

Consent for optional analytics, marketing communications or other optional processing may be requested separately.

Where processing depends on consent, users may request to withdraw that consent by contacting us using the details in Section 18. Requests to withdraw consent for application analytics must be sent to legal@crmsoda.com rather than made through in-app settings. We will handle withdrawal requests in accordance with applicable law and explain any legally relevant consequences. Withdrawal does not prevent necessary service communications or processing supported by another lawful basis.

Withdrawal generally applies to future processing and does not necessarily invalidate processing lawfully carried out before the withdrawal.

Withdrawal also does not automatically require deletion of information that must or may lawfully be retained for other purposes.

Users may manage preferences where controls are provided for a particular function, or contact us using the details in Section 18. Requests relating to analytics consent must be made by contacting us.

Customers are separately responsible for obtaining any consents or other legal authority required for the personal information they collect or process through CreamSoda.

12. Minors and Children's Privacy

CreamSoda accounts and direct access to the Services are intended for individuals aged 18 years or older.

The Services are not directed to children under 18, and individuals under 18 should not independently register for or access a CreamSoda account.

If we become aware that a minor has registered for an account contrary to this policy, we may take appropriate steps to restrict access and delete associated information, subject to applicable legal requirements.

Parents or guardians who believe that a minor has improperly registered for the Services may contact legal@crmsoda.com.

Customer Information Concerning Minors

The account-access restrictions above are separate from information a customer may collect about children or other minors using customer-configured CRM records, forms or workflows.

Customers are responsible for determining whether they are legally permitted to collect and process such information and whether the Services are appropriate for that purpose.

Customers must obtain any required parental authorization, provide applicable notices and implement appropriate safeguards.

The availability of CreamSoda features does not constitute approval or certification of their suitability for handling information concerning minors.

13. Data Security

Inka Inc. maintains administrative, technical and organizational safeguards designed to protect personal information processed through the Services.

Depending on the relevant systems and functionality, these measures may include:

• Authentication and access controls.
• Password protection.
• Application-level permission controls.
• Network and infrastructure protections.
• Encryption of connections using TLS/SSL technology.
• Monitoring, maintenance and security procedures.
• Other safeguards appropriate to the Services.

Security measures are intended to reduce risk but cannot eliminate it entirely.

Application permissions, encryption and access controls do not necessarily make personal information anonymous.

No method of storage, communication or transmission is completely secure.

Inka Inc. cannot guarantee that information will never be accessed, disclosed, altered, lost or destroyed without authorization.

Customer Security Responsibilities

Customers are responsible for:

• Managing their users and permissions.
• Protecting credentials and connected accounts.
• Granting access only to appropriate personnel.
• Reviewing their configurations and integrations.
• Avoiding unnecessary collection or disclosure of sensitive information.
• Using available security features appropriately.
• Determining whether the Services meet their particular legal and organizational requirements.

Customers are also responsible for the actions of their authorized users, subject to applicable law and the relevant agreements.

Security Incidents

Where Inka Inc. becomes aware of a security incident involving personal information, we will assess the incident and provide notifications to affected parties or authorities where required by applicable law.

Where customer-controlled information is involved, we may coordinate with the relevant customer so that the parties can address their respective obligations.

Nothing in this section transfers responsibility for customers' independent data-processing activities to Inka Inc. or excludes Inka Inc.'s own applicable legal duties.

14. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected or processed, and as otherwise permitted or required by applicable law. Retention periods vary according to the nature of the information, the Services used, the status of the account, operational needs, applicable contractual commitments and legal requirements.

In determining how long information is retained, we may consider whether an account or customer relationship remains active; whether information is needed to provide requested services or support; applicable tax, accounting, security and recordkeeping requirements; the need to resolve disputes, enforce agreements or establish or defend legal claims; and whether a lawful request for deletion or withdrawal of consent applies.

We maintain retention and disposal procedures appropriate to the information we handle. When personal information is no longer required for the purposes for which it is retained, we take steps to delete, securely destroy or de-identify it, subject to applicable legal requirements and technical processes.

Customer-Controlled Records

Customers determine appropriate retention periods for Client Data they collect or manage through the Services and are responsible for their own retention and deletion decisions. Account cancellation, workspace closure, deletion of a user and removal of an individual record are different actions and may have different effects on stored information.

CreamSoda's availability of storage or deletion functionality does not independently determine whether a customer's retention practices comply with applicable law. Requests to close an account or remove information may be submitted using the contact information in Section 18.

Archives, Backups and Third-Party Copies

Deletion from active systems may not immediately remove information from backups, archives or external services. Backup and archive information is handled under applicable retention and security procedures and is removed or de-identified when it is no longer required, subject to applicable legal requirements and technical processes.

Information may also remain in records held by recipients or third parties to whom it was previously disclosed. External providers may apply their own retention policies. Disconnecting an integration does not automatically delete copies already transferred to another provider.

We may retain limited information when reasonably necessary for legal obligations, records of consent or withdrawal, unsubscribe or suppression lists, security, disputes or legal claims. Such retention does not authorize indefinite storage without a lawful purpose.

15. Data Storage and International Transfers

CreamSoda is operated by Inka Inc., a Canadian company. The Services are hosted in Canada. However, certain information may be processed, accessed or transferred to other countries in connection with operating the Services, including through technical infrastructure, support, email delivery, payments, analytics, integrations, AI tools and other authorized third-party providers.

Personal information stored or processed in Canada is subject to applicable Canadian laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable. Information accessed or processed in other countries may also be subject to the laws of those jurisdictions, including lawful access requests from public authorities.

Where applicable law imposes requirements relating to international processing or transfers, those requirements apply according to the nature of the processing and the parties involved. This Policy does not represent that any particular international transfer mechanism applies to every provider or transaction.

Customers are responsible for determining whether their collection, use, disclosure and transfer of Client Data through the Services and customer-selected integrations comply with laws applicable to their activities. Inka Inc. remains responsible for its own handling of personal information as required by applicable law.

Questions about processing locations and international transfers may be submitted using the contact information in Section 18.

16. Privacy Compliance Features and Customer Responsibilities

16.1 Nature of the Services

CreamSoda is a configurable customer relationship management platform operated by Inka Inc., a Canadian company.

The Services provide software features that customers may use to manage contacts, communications, relationships, transactions, records, marketing activities, workflows and other business processes.

Customers determine how the Services are configured and used for their business purposes.

16.2 Privacy Compliance Features

CreamSoda may provide features that assist customers in managing certain privacy and data-protection obligations, including requirements relating to GDPR, PIPEDA, CASL, CAN-SPAM and other applicable laws.

These features may assist with activities such as managing contact information, permissions, communications, consent-related records, access and deletion requests, and other customer-directed processes.

CreamSoda does not provide legal advice, regulatory compliance assessments, compliance certification or a guarantee that a customer's use of the Services complies with any law or regulation.

The availability, configuration or use of a feature does not, by itself, establish legal compliance.

Customers are responsible for determining which legal requirements apply to their activities and whether CreamSoda's functionality is suitable for meeting those requirements.

16.3 Customer Responsibility for Client Data

Personal information, reports, addresses, files, folders, documents, communications and other information that customers or their authorized users enter, upload, store, collect or process through the Services are referred to in this Policy as "Client Data."

Customers determine the purposes for which Client Data is collected, used, retained, disclosed and otherwise processed.

Customers are responsible for:

• Determining what Client Data to collect.
• Establishing the lawful basis or authority for collection and processing.
• Providing required privacy notices.
• Obtaining and maintaining required consents.
• Determining appropriate retention and deletion practices.
• Managing user permissions and access.
• Ensuring the accuracy and legality of customer-provided content.
• Determining whether sensitive information may lawfully be processed.
• Reviewing and authorizing communications and marketing activities.
• Responding to requests concerning personal information under their control.
• Ensuring that their use of the Services complies with applicable law.

Customers are responsible for the nature, content, accuracy and lawfulness of Client Data they collect, upload or otherwise process through CreamSoda.

Inka Inc. does not undertake to independently review, approve, verify or certify Client Data or customer processing activities for regulatory compliance.

16.4 CreamSoda's Role in Processing Client Data

Inka Inc. provides CreamSoda as a technology platform through which customers collect, store, manage and process Client Data for their own business purposes. Inka Inc. does not claim ownership of Client Data and does not independently determine the purposes for which customers collect or use that information.

Customers determine the nature and content of Client Data, the purposes for which it is processed, who may access it through their accounts, and how it is used through the Services.

Inka Inc. processes Client Data as reasonably necessary to provide, operate, maintain, secure and support the Services, carry out authorized customer instructions and comply with applicable legal obligations. Inka Inc. does not routinely review, verify or approve the content or legality of Client Data collected or maintained by customers.

Access to Client Data by Inka Inc. may occur where authorized by the customer or reasonably necessary for service delivery, support, security, troubleshooting or compliance with legal requirements. Authorized third-party service providers may also process information as described elsewhere in this Privacy Policy.

Customers remain responsible for determining whether their collection, use, disclosure, retention and other processing of Client Data comply with applicable privacy and data-protection laws.

Where applicable law distinguishes between data controllers and processors, the respective roles and obligations of Inka Inc. and its customers depend on the nature of the processing and applicable legal and contractual requirements.

Nothing in this Privacy Policy guarantees regulatory compliance, transfers customers' responsibilities for their independent data-processing decisions to Inka Inc., or excludes obligations imposed directly on Inka Inc. under applicable law.

16.5 Customer-Directed Marketing and Communications

Customers may use CreamSoda to configure communications, marketing workflows, contact lists, forms, tracking tools and related functionality.

Customers are responsible for determining whether they have the legal authority to contact recipients and use the relevant information.

This includes responsibility for applicable consent requirements, unsubscribe mechanisms, privacy notices, contact lists, message content and other legal requirements.

Where Inka Inc. provides separately agreed onboarding, configuration, migration or marketing setup assistance, the scope and contractual responsibilities for that assistance are governed by the applicable Terms of Service and any additional accepted services agreement. That assistance may involve access to information the customer supplies or authorizes us to access for the agreed work.

The customer must review, test and approve the resulting configuration, recipient lists, content, permissions and launch settings before activation, publication or sending. Unless the accepted services agreement expressly authorizes Inka Inc. to perform a final action on the customer's behalf, the customer performs that action. Any such action by Inka Inc. requires prior customer authorization.

Where agreed in the applicable Terms of Service or a separately accepted services agreement, Inka Inc.'s total aggregate liability to the customer for marketing setup or assistance is limited to the amount the customer actually paid Inka Inc. for the marketing portion of the relevant engagement, excluding fees for unrelated CRM subscriptions and non-marketing services. This Privacy Policy does not independently establish a contractual liability cap or limit liability that cannot lawfully be limited.

Providing technical assistance does not, by itself, constitute legal approval or certification of the customer's activities.

16.6 No Guarantee of Regulatory Compliance

CreamSoda does not guarantee that use of the Services will result in compliance with GDPR, PIPEDA, CASL, CAN-SPAM or any other law or regulatory requirement.

Customers remain responsible for assessing their obligations, selecting appropriate configurations, maintaining required records and using the Services lawfully.

CreamSoda does not assume responsibility for customers' independent business decisions or their failure to meet regulatory requirements, except to the extent liability arises from Inka Inc.'s own conduct and cannot lawfully be excluded.

16.7 Privacy Questions and Complaints

Inka Inc. maintains procedures for receiving and addressing privacy questions and complaints concerning its own handling of personal information.

Where a request or complaint concerns Client Data controlled by a customer, we may refer the matter to the relevant customer or provide assistance as required by applicable law or agreement.

Where a complaint concerning Inka Inc.'s own practices is found to be justified, we will take appropriate action consistent with applicable legal obligations.

17. Changes, Updates and Language

We may revise this Privacy Policy periodically to reflect changes to the Services, business practices, technology or applicable legal requirements.

The current version will be made available through the Website or Services.

Material changes will be communicated where required by applicable law, and any required additional consent will be obtained.

Users should review this Privacy Policy periodically.

The original language of this Privacy Policy is English.

Inka Inc. may provide translations for convenience. Where permitted by applicable law, the English version will govern in the event of a conflict between translations.

Nothing in this provision limits mandatory language rights under applicable law.

18. How to Contact Us

If you have questions about this Privacy Policy, Inka Inc.'s privacy practices or requests concerning personal information, please contact:

Inka Inc. — CreamSoda

Attention: Privacy / Legal

Email: legal@crmsoda.com

Website: https://www.crmsoda.com

Where your request concerns information maintained by a CreamSoda customer, please identify the relevant customer organization, where known.

Requests concerning customer-controlled information may need to be directed to that organization.

We will address requests concerning Inka Inc.'s own handling of personal information in accordance with applicable legal requirements.