Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between [LEGAL ENTITY NAME] ("Doublemind", "we", "processor") and the customer ("you", "controller") and applies where we process personal data on your behalf.

1. Roles

You are the controller of personal data you upload to or generate through the Service. We are the processor. Where we process personal data about you as our customer (billing, account administration, support), we act as controller and our Privacy Policy applies.

2. Subject matter and duration

We process personal data solely to provide the Service described in our Terms and Conditions, for the duration of your subscription and for the retention period set out in section 8.

3. Nature and purpose of processing

Storage, generation, scheduling and publication of social media content; brand analysis; performance reporting; and related support.

4. Categories of data subjects

[TO CONFIRM — likely: your employees and authorised users; individuals whose personal data appears in content you upload; followers and audience members whose engagement data is retrieved from connected social media accounts.]

5. Types of personal data

[TO CONFIRM — likely: names, email addresses, account credentials for connected social platforms, images and video containing identifiable individuals, social media engagement metrics.]

You must not upload special category data as defined in Article 9 UK GDPR unless separately agreed with us in writing.

6. Our obligations

We will:

• a) process personal data only on your documented instructions, including in relation to international transfers, unless required otherwise by law, in which case we will inform you before processing unless the law prohibits it;
• b) ensure that persons authorised to process personal data are bound by confidentiality;
• c) implement appropriate technical and organisational measures as set out in Annex B;
• d) not engage a sub-processor without your general written authorisation in accordance with section 7;
• e) assist you, taking into account the nature of processing, in responding to data subject requests under Chapter III UK GDPR;
• f) assist you in complying with Articles 32 to 36 UK GDPR, taking into account the information available to us;
• g) at your choice, delete or return all personal data at the end of the provision of services, and delete existing copies unless required by law to retain them;
• h) make available all information necessary to demonstrate compliance with Article 28 UK GDPR and allow for and contribute to audits as set out in section 10.

7. Sub-processors

You give general authorisation for us to engage the sub-processors listed in Annex A. We will inform you at least [30] days before adding or replacing a sub-processor, giving you the opportunity to object on reasonable grounds. Where you object, we will work with you to find a solution; if none can be found, you may terminate the affected part of the Service.

We remain fully liable to you for the performance of our sub-processors' obligations.

8. Retention and deletion

We retain personal data for the duration of your subscription. On termination, personal data will be deleted within [30] days unless you request return of the data in a commonly used format before that date, or unless we are required by law to retain it. Backups are deleted on the normal backup cycle, within [90] days.

9. Security and personal data breaches

We maintain the measures described in Annex B. We will notify you without undue delay and in any case within [48] hours of becoming aware of a personal data breach affecting your personal data, and will provide the information you need to meet your own notification obligations.

10. Audits

On reasonable notice and no more than once in any twelve-month period, you may request information demonstrating our compliance with this DPA. Where a physical audit is required, it will be at your cost, during business hours, subject to confidentiality, and must not unreasonably disrupt our operations.

11. International transfers

[TO CONFIRM WITH COUNSEL — depends on where your infrastructure runs.]

Personal data is primarily processed in [REGION]. Where personal data is transferred outside the UK or EEA, we rely on [the UK International Data Transfer Addendum to the EU Standard Contractual Clauses / an adequacy decision / other mechanism], and carry out transfer risk assessments where required.

12. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms and Conditions. Where this DPA conflicts with the Terms and Conditions in relation to data protection, this DPA prevails.

13. Governing law

This DPA is governed by the laws of England and Wales.

Annex A — Sub-processors

[TO CONFIRM — the list below reflects services in use and must be verified, including the processing location for each.]

Annex B — Technical and organisational measures

[TO COMPLETE — only list measures you actually have in place. Do not copy a template. Typical headings: access control and authentication, encryption in transit and at rest, network security, logging and monitoring, backup and recovery, personnel confidentiality and training, vendor management, incident response, secure development practices.]

Contact

Questions: hello@doublemind.ai

Digitalone Solutions Ltd, Flat 11, 24 Bardolph Road, Richmond, London, TW9 2LH, United Kingdom, 13468617