Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service between [LEGAL ENTITY NAME]("BrandTitan", the processor or service provider) and the customer (the controller or business). It applies to personal information in the contacts, leads, messages, call data, and similar content that the customer loads into or collects through BrandTitan ("Customer Data"). If this DPA conflicts with the Terms on the processing of Customer Data, this DPA controls.

2. Details of processing

• Subject matter: provision of the BrandTitan platform (CRM, campaigns, landing pages, inbox, calling and texting, advertising integrations, analytics).
• Duration: the term of the customer's subscription, plus the return and deletion period in Section 9.
• Nature and purpose: storing, organizing, transmitting, analyzing, and displaying Customer Data to deliver the features the customer uses.
• Categories of data subjects: the customer's leads, prospects, customers, and their staff or users.
• Categories of personal data: names, email addresses, phone numbers, addresses, messages and form answers, call logs and recordings, advertising identifiers, and other data the customer chooses to submit. The customer should not submit special-category or sensitive data unless agreed in writing.

3. Instructions

BrandTitan will process Customer Data only on the customer's documented instructions, which are these terms, the customer's configuration and use of the service, and any further written instruction we accept. We will tell the customer if we believe an instruction violates law. We will not sell Customer Data, and will not retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the service, except as law allows.

The customer is responsible for the lawfulness of its instructions, including having the notices, consents, and opt-ins required to contact people and to process their data (see the Terms of Service, Section 5).

4. Confidentiality

BrandTitan limits access to Customer Data to personnel and contractors who need it to provide or support the service and who are bound by confidentiality obligations.

5. Security measures

We maintain technical and organizational measures appropriate to the risk, summarized in plain language on our Security page. We may update those measures if we do not materially reduce the overall level of protection.

6. Sub-processors

The customer authorizes BrandTitan to use the sub-processors listed at /subprocessors. We impose data-protection obligations on each that are no less protective than this DPA, and remain responsible for their performance. We will give at least 30 days' notice before adding or replacing a sub-processor, by updating that page and notifying customers by email. The customer may object on reasonable data-protection grounds within that period; if we cannot resolve the objection, the customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

7. Assistance with data-subject requests and compliance

The customer handles requests from its own contacts. If a data subject contacts us directly, we will refer them to the customer and will not respond substantively unless required by law. Taking into account the nature of the processing, we will provide reasonable assistance, through product features or on written request, with access, correction, deletion, and export requests, data-protection impact assessments, and consultations with regulators.

8. Personal data breach

We will notify the customer without undue delay and within 72 hours of confirming a breach affecting Customer Data, and will provide the information reasonably available to us (nature of the breach, data and records affected, likely consequences, and measures taken or proposed), with updates as we learn more. Notice is not an admission of fault.

9. Return and deletion

At the customer's choice, on termination we will return or delete Customer Data. The customer may export its data during [30] days after termination; after that we delete it from active systems within [30] days and from backups as they age out, unless law requires retention. On request we will confirm deletion in writing.

[COUNSEL / JAMES: confirm the export and deletion windows match what the product does at offboarding.]

10. Audit

On reasonable written request, no more than once a year unless a breach has occurred, we will make available the information needed to show compliance with this DPA, such as our security summary and responses to a reasonable security questionnaire. On-site audits are available only where required by law or by a regulator, on reasonable notice, during business hours, at the customer's cost, and under confidentiality.

11. International transfers

Customer Data is processed in the United States. Where the customer transfers personal data subject to GDPR, UK GDPR, or Swiss law to BrandTitan, the parties agree to the Standard Contractual Clauses (Module Two, controller to processor) and the UK Addendum, incorporated by reference.

[COUNSEL: attach the SCCs, complete the annexes (parties, description of transfer, security measures, sub-processor list), and select the governing law, supervisory authority, and docking and optional clauses.]

12. Liability and contact

Liability under this DPA is subject to the limitations in the Terms of Service. Questions or notices about this DPA: legal@brandtitan.app or privacy@brandtitan.app.

[COUNSEL: confirm how this DPA is accepted (incorporated by the Terms or countersigned on request) and any customer-specific signed version.]