Privacy policy & DPA.
The privacy policy in plain language, and how to execute the data processing agreement.
Impulse Creative Privacy Policy
Effective date: October 17, 2026
Last updated: October 17, 2026
1. Who we are
This Privacy Policy explains how Impulse Creative Inc., a Florida corporation ("Impulse Creative," "we," "us," or "our"), collects, uses, shares, and protects personal information.
Impulse Creative is a marketing, web, and HubSpot services agency. This policy covers:
- Our website at impulsecreative.com and its subpages (the "Site").
- Our forms, chat, email, phone, text message, and meeting interactions with you.
- Our sales and client relationship activities.
This policy covers our agency services only. Other products and websites have their own terms and policies.
Client data. When we do work for a client, we often handle personal information that belongs to that client, such as contacts in the client's HubSpot portal. For that data, the client is in charge and we act on the client's instructions. The client's own privacy policy and our Data Processing Agreement with the client apply to that data. If you are a customer or contact of one of our clients, please contact that client about your data.
2. Summary
- We collect analytics data when you use the Site, and the details you give us in forms, email, calls, texts, and meetings.
- We use it to answer you, deliver services, bill clients, market our services, and keep our systems safe.
- We do not sell personal information. We do not share it with third parties for their own use.
- We do not sell or share mobile phone numbers or text messaging consent with third parties for their marketing.
- We may record phone calls and meetings. We tell you when we do.
- We use AI tools under paid accounts that do not use our inputs to train models.
- You can ask to see, correct, or delete your information. You can opt out of marketing at any time.
3. Information we collect
3.1 Information you give us
- Contact details: name, email address, phone number, job title, company name, and website.
- Form and chat content: what you type into forms or our website chat, such as your project needs, budget, and questions. We store this in our CRM.
- Billing details: billing contact, billing address, and payment records. Our payment processor (Stripe) collects card and bank details. We do not store full card numbers.
- Communications: emails, text messages, chat messages, and notes about our conversations.
- Meeting content: if we record a call or video meeting with you, the recording, transcript, and notes.
3.2 Analytics data we collect automatically
When you use the Site, we and our service providers collect:
- IP address and approximate location (city, region, country).
- Browser type, device type, and operating system.
- Pages you view, links you click, time on page, referring website, and search terms.
- Cookie identifiers and similar identifiers.
3.3 Information from calls and texts
We use CallRail for call tracking. When you call or text a tracked phone number, we collect:
- Your phone number and caller ID name.
- The date, time, and length of the call.
- The ad, search, or web page that led to the call.
- A recording and transcript of the call, if recording is on (see Section 7).
- The content of text messages you send to or get from us.
3.4 Information from other sources
- Business sources: public business websites and professional networks.
- Partners: HubSpot or other partners may refer you to us and share your contact details.
- Advertising platforms: Google Ads tells us how our ads perform, mostly in summary form.
- Clients: when we work for a client, the client may give us contact details for its staff.
4. How we use information
We use personal information to:
- Answer your questions and requests.
- Provide, manage, and improve our services.
- Plan, run, and record meetings and calls.
- Send proposals, contracts, invoices, and receipts, and take payments.
- Send marketing emails and, with your consent, text messages.
- Understand how people use the Site and which ads and channels work.
- Protect the Site, our systems, our clients, and you from fraud, abuse, and security threats.
- Follow the law, enforce our contracts, and defend legal claims.
Legal bases (EU, UK, and similar laws). Where the GDPR, UK GDPR, or a similar law applies, we rely on these legal bases:
- Contract: to provide services you or your company asked for.
- Legitimate interests: to run and grow our business, market to business contacts, secure our systems, and improve the Site. We weigh these interests against your rights.
- Consent: for non-essential cookies, text messages, and other marketing where the law requires consent. You can withdraw consent at any time.
- Legal obligation: to keep tax and accounting records and respond to lawful requests.
5. How we share information
5.1 Service providers
We use service providers to run our business. They may use your information only to provide services to us. We do not let them use it for their own purposes. Our service providers are:
| Provider | What we use it for |
|---|---|
| Google (Workspace, Analytics, Ads, Gemini) | Email, documents, file storage, website analytics, advertising, and AI assistance |
| HubSpot | CRM, website hosting, forms, chat, marketing email, and cookie banner |
| Resend | Email delivery |
| Vercel | Hosting for our websites and applications |
| Grain | Call and meeting recording, transcripts, and notes |
| Day.ai | CRM and AI assistance for sales and client relationships |
| CallRail | Call tracking, call recording, transcripts, and text messages |
| Stripe | Payment processing |
| QuickBooks | Accounting and invoicing |
| Cursor | AI assistance for code and drafting |
| SpaceX AI | AI assistance for research and drafting |
| Anthropic (Claude) | AI assistance, including review of CRM data (see Section 8) |
This list is current as of the effective date of this policy.
5.2 Other sharing
- Clients and partners: if you work for a client, we share project information with the right people at that client. We may share referral information with HubSpot as part of our partner relationship.
- Legal and safety: we share information when the law requires it, or to protect rights, property, or safety.
- Business transfers: if we merge, are acquired, or sell assets, personal information may transfer to the new owner. This policy will still apply to it.
- With your consent: we share information in other ways when you tell us we can.
5.3 No sale. No sharing of mobile data.
We do not sell personal information. We do not share personal information with third parties for their own use.
Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. We do not share text messaging opt-in data or consent with any third party. This does not stop us from using service providers that help us send messages, such as CallRail and mobile carriers.
6. Cookies and analytics
6.1 What we use
The Site uses cookies and similar tools. They fall into these groups:
- Strictly necessary: needed for the Site to work and to remember your cookie choices.
- Analytics: HubSpot and Google Analytics measure visits and how pages are used.
- Advertising: Google Ads and HubSpot tags measure the results of our ads.
- Chat and call tracking: HubSpot chat and CallRail call tracking.
6.2 Your choices
- Use our cookie banner to accept or reject non-essential cookies. You can change your choice at any time with the cookie settings link on the Site.
- Set your browser to block or delete cookies.
- Opt out of Google Analytics with the Google Analytics opt-out add-on: https://tools.google.com/dlpage/gaoptout.
- Change your Google ad settings at https://adssettings.google.com.
6.3 Opt-out signals
Some US state laws give you the right to opt out of targeted advertising. We treat a Global Privacy Control (GPC) browser signal as a valid opt-out request for that browser. You may also email privacy@impulsecreative.com to opt out.
We do not respond to "Do Not Track" signals, because there is no common standard for them.
7. Call and meeting recording
Phone calls. We may record and transcribe calls to and from our tracked phone numbers. We use recordings for quality, training, records, and to follow up on what you asked. When a call is recorded, you will hear a notice at the start of the call. If you do not want to be recorded, tell us, hang up, or email us instead.
Video meetings. We may record and transcribe calls and video meetings with Grain. We tell participants at the start of the meeting, and the recording tool shows that it is active. You may ask us to stop recording at any time.
8. AI tools
We use generative AI tools to help with research, drafting, analysis, meeting notes, and code. The providers are Google (Gemini), Cursor, SpaceX AI, Anthropic (Claude), and Grain. Our rules for AI use are:
- We use paid accounts with each provider. Under those accounts, the provider does not use our inputs to train its models.
- We use Gemini, Cursor, and SpaceX AI only with information that is not sensitive. We do not put personal information into them.
- We use Anthropic's Claude to review CRM data, including names, email addresses, and contact details. When this is client CRM data, we do it only with the client's consent in our contract.
- We use Grain to make AI meeting notes and summaries of the calls and meetings we record. Grain uses only the content of those recordings.
- A person on our team reviews AI output before we rely on it or send it to a client.
- We do not use AI to make decisions that have legal or similarly significant effects on you.
Grain and Day.ai also use AI features to summarize meetings and organize CRM records.
9. Text messages (SMS)
Impulse Creative Inc. sends text message updates and responses about pricing and the products and services offered at impulsecreative.com. We send texts through CallRail. This section applies to text messages from any Impulse Creative Inc. phone number.
Consent. We send text messages only to people who give consent. You may give consent by checking a box on a form, by texting us first, or by telling us you want texts. Consent to texts is not a condition of buying anything. When you opt in, we may send you a message to confirm your signup.
Program details.
- Program name: Impulse Creative.
- Message types: updates and responses about pricing and our products and services, replies to your questions, scheduling, and project updates.
- Frequency: message frequency varies.
- Cost: message and data rates may apply.
Opt out. Reply STOP to any text message from us to stop all texts. We will send one message to confirm that you are unsubscribed. After that, you will get no more texts unless you sign up again. To join again, sign up the same way you did the first time.
Help. Reply HELP to any text message from us. We will reply with instructions on how to use the service and how to unsubscribe. You can also contact us at privacy@impulsecreative.com.
Carriers. Carriers are not liable for delayed or undelivered messages. Our Terms and Conditions list the participating carriers.
Text message privacy
- We use the information you give us to send and respond to your text messages.
- We share it only with CallRail, phone companies, and other vendors that help us deliver messages.
- Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.
- Text messaging opt-in data and consent are never shared with any third party.
- We may disclose information to meet legal, regulatory, or government requests, to avoid liability, or to protect our rights or property.
- This text message privacy section applies to your use of our text message service. It does not change the rest of this Privacy Policy, which governs our relationship with you in other contexts. See also Section 5.3.
10. How long we keep information
We keep personal information only as long as we need it for the purposes in this policy, unless the law requires us to keep it longer.
| Type of data | How long we keep it |
|---|---|
| Analytics data | 24 months |
| CRM data from forms, calls, texts, and meetings (for people who do not become clients) | 24 months |
| Client details, contracts, invoices, and payment records | 3 to 7 years after the client relationship ends, depending on the record and on tax and legal needs |
When we no longer need data, we delete it or remove details that identify you.
11. How we protect information
We use administrative and technical safeguards to protect personal information:
- Two-factor authentication on our accounts.
- Access limited to team members who need it for their job.
- Encryption in transit and at rest for our own applications.
- Security awareness training for our team every year.
- Reputable service providers that run their own security programs.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
12. Your privacy rights
We welcome visitors from around the world. Depending on where you live, you may have the rights below. We will honor them as the law in your location requires.
12.1 Rights for everyone
You can:
- Unsubscribe from marketing email with the link in any email.
- Reply STOP to stop text messages.
- Ask us to access, correct, or delete your personal information.
12.2 EU, UK, Switzerland, and similar laws
If the GDPR, UK GDPR, Swiss law, or a similar law applies, you have the right to:
- Access: get a copy of your personal data.
- Correction: fix personal data that is wrong or incomplete.
- Deletion: ask us to delete your personal data.
- Portability: get your data in a usable format, or have us send it to another company.
- Objection: object to our use of your data based on legitimate interests, including direct marketing.
- Restriction: ask us to limit how we use your data.
- Withdraw consent: withdraw consent at any time. This does not affect processing before you withdrew.
- Complain: complain to the data protection supervisory authority where you live or work. In the UK, this is the Information Commissioner's Office (ICO).
International transfers. We are based in the United States, and our service providers may store data in the US and other countries. When we transfer personal data out of the EU, UK, or Switzerland, we use safeguards that the law allows, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework where available.
12.3 California and other US states
Residents of California and of states with similar laws (such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others) may have these rights, depending on the state:
- Know and access: learn what personal information we collect, use, and disclose, and get a copy.
- Correct: fix personal information that is wrong.
- Delete: ask us to delete personal information.
- Portability: get your data in a usable format.
- Opt out of sale, sharing, and targeted advertising. We do not sell personal information. See Section 6.3 to opt out of targeted advertising.
- Opt out of profiling that produces legal or similarly significant effects. We do not do this kind of profiling.
- Limit use of sensitive personal information. We do not use sensitive personal information for purposes that require this right.
- Appeal: if we deny your request, you can appeal by replying to our decision. If you disagree with the result of the appeal, you may contact your state attorney general.
- No discrimination: we will not treat you differently for using your rights.
California disclosures (last 12 months).
| Category (CCPA) | Examples | Source | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email, phone, IP address, cookie ID | You, your device, partners | All purposes in Section 4 | Service providers |
| Commercial information | Services bought, invoices | You, our records | Services and billing | Service providers (Stripe, QuickBooks, Google Workspace) |
| Internet activity | Pages viewed, clicks | Your device | Analytics, ads, security | Google, HubSpot |
| Geolocation (approximate) | City or region from IP address | Your device | Analytics | Google, HubSpot |
| Audio and electronic information | Call and meeting recordings | You | Records, quality, service | CallRail, Grain |
| Professional information | Job title, company | You, business sources | Sales and service | Service providers |
| Inferences | Interest in our services | Site and email activity | Marketing | HubSpot, Day.ai |
We do not sell personal information, and we do not share it with third parties for their own use. We do not knowingly sell or share the personal information of people under 16.
12.4 Australia
If the Australian Privacy Act 1988 applies, you may ask to access or correct your personal information. If you have a complaint, contact us first. If you are not satisfied with our answer, you may complain to the Office of the Australian Information Commissioner (OAIC). Your information may be stored in the United States and other countries where our service providers operate.
12.5 How to make a request
Email privacy@impulsecreative.com or call 239-244-8812. Remington Begg handles privacy requests.
We track and manage requests in HubSpot. We will verify your identity before we act. We may ask for your name, email, and phone number so we can match them to our records. You may use an authorized agent. We may ask the agent for proof that you gave them permission.
We respond within 30 days. If a law allows more time and we need it, we will tell you why within those 30 days.
13. Children
Our Site and services are for businesses and adults. They are not directed at children. We do not knowingly collect personal information from children. If you think a child gave us personal information, contact us and we will delete it.
14. Links to other sites
The Site may link to other websites and platforms. Their privacy practices are their own. Read their privacy policies.
15. Changes to this policy
We may update this policy. We will post the new version on this page and change the "Last updated" date. If we make material changes, we will give more notice, such as an email or a notice on the Site.
16. Contact us
Impulse Creative Inc.
Attn: Remington Begg, Privacy
6627 County Road 78
Fort Denaud, Florida 33935
Email: privacy@impulsecreative.com
Phone: 239-244-8812
Impulse Creative Data Processing Agreement
Version: 1.0
Effective date: October 17, 2026
Last updated: October 17, 2026
This Data Processing Agreement ("DPA") is between:
- Impulse Creative Inc., a Florida corporation, of 6627 County Road 78, Fort Denaud, Florida 33935 ("Impulse Creative" or "Processor"); and
- The client named in the signature block or in the Agreement ("Client" or "Controller").
This DPA forms part of the agreement between the parties for Impulse Creative's agency services. That agreement may be a master services agreement, statement of work, proposal, or quote, together with the Impulse Creative Terms and Conditions (the "Agreement").
1. Purpose and scope
1.1 This DPA applies when Impulse Creative processes Client Personal Data to provide the Services.
1.2 This DPA does not apply to personal data that Impulse Creative processes as a controller for its own business. Examples are Client's staff contact details used for billing and account management, and Impulse Creative's own marketing data. The Impulse Creative Privacy Policy covers that data.
1.3 This DPA covers the Impulse Creative agency services only.
2. Definitions
In this DPA:
- "Applicable Data Protection Law" means all privacy and data protection laws that apply to the processing of Client Personal Data under the Agreement. This includes, where applicable: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as part of UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection; the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"); other US state privacy laws; and the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles ("Australian Privacy Act").
- "Client Personal Data" means personal data or personal information that Impulse Creative processes for Client under the Agreement.
- "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data that Impulse Creative or its Subprocessors process.
- "Services" means the services Impulse Creative provides to Client under the Agreement.
- "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
- "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
- "Subprocessor" means a third party that Impulse Creative engages to process Client Personal Data.
Terms such as "controller," "processor," "data subject," "personal data," "processing," "business," "service provider," "sell," and "share" have the meanings given in Applicable Data Protection Law.
3. Roles of the parties
3.1 Client is the controller (or, under the CCPA, the "business") of Client Personal Data. Impulse Creative is the processor (or, under the CCPA, the "service provider").
3.2 If Client is itself a processor for a third-party controller, Impulse Creative is a subprocessor. Client confirms that the third-party controller has authorized Client's instructions and Impulse Creative's engagement.
3.3 Annex I describes the processing.
4. Client's responsibilities
Client will:
(a) Comply with Applicable Data Protection Law when it uses the Services.
(b) Have a lawful basis, and give all notices and get all consents required, for Impulse Creative to process Client Personal Data. This includes consent for marketing email, text messages, call recording, cookies, and tracking that Impulse Creative sets up for Client.
(c) Make sure its instructions follow Applicable Data Protection Law.
(d) Own and control the accounts it uses for the Services, such as its HubSpot portal, Google Ads account, Google Analytics property, CallRail account, and website hosting. Client controls who has access to those accounts.
(e) Not send Impulse Creative special category or sensitive personal data unless the parties agree in writing. Examples are health data, financial account numbers, government ID numbers, and data about children.
5. Impulse Creative's obligations
5.1 Instructions
Impulse Creative will process Client Personal Data only on Client's documented instructions. The Agreement, this DPA, and Client's written requests during the engagement (including by email or other written messages) are Client's instructions. Impulse Creative may process Client Personal Data without instructions only if the law requires it. In that case, Impulse Creative will tell Client first, unless the law forbids this.
Impulse Creative will tell Client promptly if it believes an instruction breaks Applicable Data Protection Law.
5.2 Confidentiality
Impulse Creative will make sure that every person it authorizes to process Client Personal Data is bound by a duty of confidentiality.
5.3 Security
Impulse Creative will apply the technical and organizational measures in Annex II. These measures will give a level of security that fits the risk. Impulse Creative may update the measures, but will not reduce the overall level of protection.
5.4 Where Client Personal Data is kept
Most Client Personal Data stays in Client's own systems, such as Client's HubSpot portal. Impulse Creative staff work in those systems through named user accounts that Client grants and can remove.
Some Client Personal Data may also be in Impulse Creative's own systems during the engagement. Examples are:
- Exports or imports of contact lists in Google Drive.
- Email and messages that include contact details.
- Recordings and transcripts of calls and meetings with Client staff (Grain).
- Website and application files hosted on Vercel.
- Call records and recordings in an Impulse Creative CallRail account, where Impulse Creative manages call tracking for Client.
- CRM data that Claude (Anthropic) reviews under Section 5.5.
Impulse Creative will keep copies in its own systems to the minimum needed for the Services.
5.5 AI tools
Impulse Creative uses generative AI tools to perform the Services. The providers are Google (Gemini), Cursor, SpaceX AI, Anthropic (Claude), and Grain. When it uses them:
(a) It uses paid accounts under which the provider does not use the inputs to train its models.
(b) It uses Gemini, Cursor, and SpaceX AI only with Client information that is not sensitive and contains no personal data.
(c) It uses Claude (Anthropic) to review Client CRM data, including names, email addresses, and contact details, to perform the Services.
(d) It uses Grain to make AI meeting notes and summaries of recorded calls and meetings with Client staff. Grain uses only the content of those recordings.
(e) A person reviews AI output before Impulse Creative delivers it.
(f) It will not use Client Personal Data to train or improve AI models for itself or for any other client.
(g) The AI providers are Subprocessors under Section 6.
5.6 Client consent to AI processing of CRM data
Client authorizes and consents to Impulse Creative's use of Anthropic's Claude to process Client CRM data, including names, email addresses, and contact details, as described in Section 5.5. This processing is part of Client's documented instructions. Client confirms that it has given any notices and has any legal basis or consents that it needs for this processing. Client may withdraw this consent by written notice. After notice, Impulse Creative will stop putting Client Personal Data into Claude. Some Services may then take longer or cost more, and the parties will agree any change in writing.
6. Subprocessors
6.1 General authorization. Client gives general authorization for Impulse Creative to use Subprocessors. Annex III lists the current Subprocessors.
6.2 Subprocessor terms. Impulse Creative will have a written contract with each Subprocessor. The contract will impose data protection duties that are no less protective than this DPA, to the extent that fits the service the Subprocessor provides.
6.3 Changes. Impulse Creative will tell Client at least 14 days before it adds or replaces a Subprocessor. Notice may be by email to Client's main contact.
6.4 Objection. Client may object to a new Subprocessor on reasonable data protection grounds by written notice within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Client may end the affected Services by written notice. Client will pay for Services delivered up to the end date.
6.5 Client-chosen platforms. Platforms that Client contracts with directly are not Impulse Creative Subprocessors. Examples are Client's HubSpot portal, Client's Google Ads account, and Client's own hosting. Client's contract with each provider governs that processing.
6.6 Liability. Impulse Creative remains responsible to Client for its Subprocessors' performance under this DPA.
7. Help with data subject requests
7.1 If Impulse Creative gets a request from a data subject about Client Personal Data, it will send the request to Client without undue delay. It will not respond to the request itself unless Client tells it to, or the law requires it.
7.2 Impulse Creative will give Client reasonable help to respond to data subject requests, taking into account the nature of the processing. Much of this help consists of Client using its own tools, such as its HubSpot portal. If help takes more than a small amount of time, Impulse Creative may charge its standard rates.
8. Personal Data Breaches
8.1 Impulse Creative will notify Client without undue delay, and in any case within 72 hours, after it becomes aware of a Personal Data Breach.
8.2 The notice will include the details Impulse Creative has at that time, and further details as they become available. These details include:
(a) What happened, and when.
(b) The types and approximate number of data subjects and records affected.
(c) The likely effects.
(d) The steps taken or proposed to deal with the breach and reduce harm.
(e) A contact person.
8.3 Impulse Creative will take reasonable steps to contain the breach and reduce harm. It will help Client meet its duties to notify authorities and data subjects. This includes duties under the GDPR, UK GDPR, US state breach laws, and the Australian Notifiable Data Breaches scheme.
8.4 Notice of a breach is not an admission of fault or liability.
9. Impact assessments and consultation
Impulse Creative will give Client reasonable help with data protection impact assessments and prior consultations with authorities, where the law requires them. This help is limited to the processing Impulse Creative does and the information it has.
10. Return and deletion
10.1 When the Services end, Client will remove Impulse Creative's access to Client's systems.
10.2 Within 30 days after the Services end, Impulse Creative will delete or return Client Personal Data in its own systems, as Client chooses. If Client does not choose, Impulse Creative will delete it.
10.3 Impulse Creative may keep Client Personal Data that the law requires it to keep, and copies in backups until they are overwritten in the normal cycle. This DPA continues to protect any data kept.
10.4 On request, Impulse Creative will confirm deletion in writing.
11. Audits and information
11.1 Impulse Creative will make available the information Client reasonably needs to show compliance with this DPA. Impulse Creative will answer reasonable written security questionnaires.
11.2 If the questionnaire answers are not enough, or an authority requires it, Client may audit Impulse Creative's compliance with this DPA. Client or an independent auditor bound by confidentiality may do the audit. Client must give at least 30 days' written notice. Audits will take place during normal business hours, no more than once in any 12-month period (unless after a Personal Data Breach or at an authority's demand). Client pays its own audit costs.
11.3 Client may rely on the Subprocessors' own certifications and audit reports for their services.
12. International transfers
12.1 Impulse Creative is based in the United States. Client Personal Data may be processed in the United States and in other countries where Impulse Creative's Subprocessors operate.
12.2 EU transfers. For transfers of personal data from the European Economic Area to Impulse Creative that are not covered by an adequacy decision, the SCCs are incorporated into this DPA by reference, as follows:
(a) Module Two (controller to processor) applies where Client is a controller. Module Three (processor to processor) applies where Client is a processor.
(b) Clause 7 (docking clause) applies.
(c) Clause 9: Option 2 (general written authorization) applies, with the notice period in Section 6.3 of this DPA.
(d) Clause 11: the optional language does not apply.
(e) Clause 13: the supervisory authority is the one that has authority over Client under Clause 13(a).
(f) Clauses 17 and 18: the SCCs are governed by the law of, and disputes go to the courts of, Ireland.
(g) Annexes I, II, and III of this DPA complete the Annexes of the SCCs.
12.3 UK transfers. For transfers of personal data from the United Kingdom, the UK Addendum is incorporated into this DPA by reference. The SCCs as set out in Section 12.2 complete Table 2. Annexes I to III of this DPA complete Table 3. For Table 4, either party may end the UK Addendum as allowed by its Section 19.
12.4 Swiss transfers. For transfers of personal data from Switzerland, the SCCs apply as in Section 12.2, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent authority; references to the GDPR include the Swiss Federal Act on Data Protection; and the term "member state" includes Switzerland, so that Swiss data subjects can enforce their rights.
12.5 Conflict. If the SCCs or the UK Addendum conflict with this DPA, the SCCs or the UK Addendum control.
12.6 Other mechanisms. If a Subprocessor is certified under the EU-US Data Privacy Framework or a similar program, Impulse Creative may rely on that certification for onward transfers to that Subprocessor.
13. CCPA and US state privacy law terms
13.1 Impulse Creative is a service provider (and, where relevant, a contractor or processor) under the CCPA and other US state privacy laws. Client discloses Client Personal Data to Impulse Creative only for the limited and specified business purposes in Annex I.
13.2 Impulse Creative will not:
(a) Sell or share Client Personal Data. "Share" includes disclosure for cross-context behavioral advertising.
(b) Keep, use, or disclose Client Personal Data for any purpose other than the business purposes in the Agreement and this DPA, or as the CCPA otherwise permits.
(c) Keep, use, or disclose Client Personal Data outside the direct business relationship between Client and Impulse Creative.
(d) Combine Client Personal Data with personal information it gets from other sources or from other clients, except as the CCPA permits.
13.3 Impulse Creative will comply with the CCPA and give Client Personal Data the same level of privacy protection the CCPA requires of Client.
13.4 Impulse Creative will tell Client if it decides it can no longer meet its duties under the CCPA.
13.5 Client may take reasonable and appropriate steps to stop and fix unauthorized use of Client Personal Data. Client may also take reasonable steps to make sure Impulse Creative uses Client Personal Data in a manner that follows the CCPA.
13.6 Impulse Creative certifies that it understands and will comply with the limits in this Section 13.
13.7 Advertising work. When Client tells Impulse Creative to run ads, build audiences, or upload customer lists to ad platforms (such as Google Ads Customer Match), Client is responsible for giving the notices and opt-outs the law requires for that activity. Impulse Creative does this work only as Client's service provider.
14. Australian Privacy Act
14.1 Where the Australian Privacy Act applies to Client Personal Data, Impulse Creative will handle that data in a manner consistent with the Australian Privacy Principles, as they apply to the Services. This applies even where the Act does not apply directly to Impulse Creative.
14.2 Client consents to the disclosure of Client Personal Data to Impulse Creative in the United States and to the Subprocessors in Annex III. Client is responsible for meeting its own duties under Australian Privacy Principle 8 (cross-border disclosure) and for giving any notices it needs to give its data subjects.
14.3 Impulse Creative will help Client assess and respond to suspected eligible data breaches under the Notifiable Data Breaches scheme, as set out in Section 8.
15. Liability
Each party's liability under this DPA is subject to the limitation of liability in section 11 of the Impulse Creative Terms and Conditions, which form part of the Agreement. Under that section, Impulse Creative's total liability arising out of or related to the Agreement does not exceed the total amount paid by Client to Impulse Creative under the Agreement. These limits do not restrict a data subject's rights under the SCCs or the UK Addendum.
16. Term and order of precedence
16.1 This DPA lasts as long as Impulse Creative processes Client Personal Data for Client. Sections that by their nature should continue (including Sections 10, 11, and 15) survive.
16.2 If this DPA conflicts with the Agreement about the processing of Client Personal Data, this DPA controls, except as stated in Section 12.5.
16.3 The governing law and venue of the Agreement apply to this DPA, except where the SCCs or UK Addendum require otherwise.
16.4 Impulse Creative may update this DPA to reflect changes in law. It will tell Client in writing at least 30 days before an update takes effect. An update will not reduce the protection of Client Personal Data.
Signatures
| Client | Impulse Creative |
|---|---|
| Legal name: | Impulse Creative Inc. |
| Signature: | Signature: |
| Name: | Name: Remington Begg |
| Title: | Title: Chief Remarkable Officer |
| Date: | Date: |
| Privacy contact email: | Privacy contact email: privacy@impulsecreative.com |
Annex I. Description of the processing
A. Parties
- Data exporter: Client (controller), as named above. Activities: receives agency services from Impulse Creative.
- Data importer: Impulse Creative (processor), as named above. Contact: Remington Begg, Chief Remarkable Officer, privacy@impulsecreative.com, 239-244-8812. Activities: provides marketing, website, HubSpot, advertising, and related agency services.
B. Categories of data subjects
- Client's customers, prospects, leads, and website visitors.
- Client's email and text message subscribers.
- People who call or text Client's tracked phone numbers.
- Client's staff and contractors.
- Other people whose data Client loads into the systems Impulse Creative works on.
C. Categories of personal data
- Contact details: name, email, phone number, postal address, job title, and company.
- CRM data: lifecycle stage, deal and ticket records, notes, form submissions, and email engagement.
- Online identifiers: IP address, cookie IDs, device and browser data, and page view and click data.
- Call data: caller phone number, call metadata, call recordings, transcripts, and text messages.
- Advertising data: ad click IDs, conversion data, and hashed customer lists.
- Meeting data: recordings and transcripts of calls and meetings with Client staff.
- Other data that Client chooses to give Impulse Creative.
D. Sensitive data
None, unless the parties agree otherwise in writing. If the parties agree, they will record the added safeguards in writing.
E. Frequency of transfer
Continuous during the Services.
F. Nature and purpose of processing (business purposes)
Impulse Creative processes Client Personal Data to provide the Services described in the Agreement. These may include:
- HubSpot setup, migration, data cleanup, integration, and administration.
- Website design, development, hosting, and maintenance.
- Marketing email, workflow, and campaign setup and management.
- Advertising campaign management in Client's Google Ads and other ad accounts.
- Analytics setup and reporting.
- Call tracking and call analysis.
- Building and operating AI agents and automations for Client.
- Review of Client CRM data with AI tools, as described in Section 5.5.
- Support and troubleshooting.
G. Retention
For the length of the Services, then as set out in Section 10.
H. Subprocessor transfers
As listed in Annex III, for the purposes listed there, for the length of the Services.
I. Competent supervisory authority
As set out in Section 12.2(e).
Annex II. Technical and organizational security measures
- Two-factor authentication. Impulse Creative uses two-factor authentication on its accounts.
- Access control. Access to Client Personal Data is limited to team members who need it for the Services. Each team member uses a named account. Impulse Creative removes access when a team member leaves or no longer needs it.
- Client-controlled access. Impulse Creative works in Client systems under Client's own user permissions. Client can remove that access at any time.
- Encryption. Impulse Creative's own applications encrypt data in transit and at rest.
- Training. Team members complete security awareness training every year.
- AI tools. AI tools are used only as set out in Section 5.5.
- Service providers. Impulse Creative uses reputable service providers that run their own security programs.
Annex III. Subprocessors
This list is current as of the effective date of this DPA. Impulse Creative will give notice of changes as set out in Section 6.3.
| Subprocessor | Purpose |
|---|---|
| Google (Workspace, Analytics, Ads, Gemini) | Email, documents, file storage, analytics, ad account management through Impulse Creative's manager account, and AI assistance with non-personal data |
| HubSpot | Impulse Creative's own CRM, forms, and marketing email |
| Resend | Email delivery |
| Vercel | Hosting for websites and applications, including Impulse Creative's own products |
| Grain | Call and meeting recording and transcripts, and AI meeting notes and summaries |
| Day.ai | CRM and AI assistance for client relationships |
| CallRail | Call tracking, call recording, transcripts, and text messages |
| Stripe | Payment processing |
| QuickBooks | Accounting and invoicing |
| Cursor | AI assistance for code and drafting, with non-personal data only |
| SpaceX AI | AI assistance for research and drafting, with non-personal data only |
| Anthropic (Claude) | AI review of Client CRM data, including names, email addresses, and contact details |
Subprocessors may process data in the United States and in other countries where they operate.
Client's own HubSpot portal, Google Ads account, and other client-owned accounts are not Subprocessors (see Section 6.5).