Data Processing Agreement

“Controller” means the Customer who determines the purposes and means of processing personal data using the Service.

“Processor” means EngageCloud LLC, which processes personal data on behalf of the Controller.

“Personal Data” means any information relating to an identified or identifiable natural person, as defined by GDPR Article 4(1).

“Processing” means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

EngageCloud LLC processes personal data on behalf of the Controller to provide the EngageCloud Pro service, which includes:

• Storing user account information (name, email, role)
• Processing social media OAuth tokens on behalf of connected users
• Storing AI-generated content drafts and published content records
• Recording approval workflow activity and audit logs
• Collecting usage analytics for platform improvement

Processing is performed for the duration of the Customer’s subscription and for 30 days following termination (data export window).

The Controller agrees to:

• Ensure a lawful basis exists for processing personal data under GDPR Article 6
• Provide required privacy notices to data subjects
• Notify the Processor of any data subject rights requests received
• Not instruct the Processor to process data in violation of applicable law

EngageCloud LLC, as Processor, shall:

• Process personal data only on documented instructions from the Controller
• Ensure personnel with access to personal data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures (see Section 6)
• Assist the Controller in responding to data subject rights requests
• Delete or return all personal data upon termination of the agreement
• Make available information necessary to demonstrate compliance with this DPA
• Notify the Controller within 72 hours of becoming aware of a personal data breach

The Controller provides general authorization for EngageCloud LLC to engage the following sub-processors:

We will notify the Controller at least 30 days before adding new sub-processors. The Controller may object to new sub-processors within 10 business days.

EngageCloud LLC implements the following measures to protect personal data:

• Encryption at rest: AES-256 via Google Cloud KMS and Firestore encryption
• Encryption in transit: TLS 1.3 enforced on all endpoints
• Access control: Role-based access with principle of least privilege; MFA required for admin access
• Network security: VPC isolation, Cloud Armor WAF/DDoS protection
• Vulnerability management: Regular dependency scanning and container image scanning
• Incident response: Documented runbook, 72-hour breach notification per GDPR Article 33
• Personnel: All staff with data access subject to confidentiality agreements and security training

Full security details are available at engagecloud.pro/security.

EngageCloud LLC will assist the Controller in fulfilling data subject rights requests under GDPR Articles 15–22, including:

• Right of access (Art. 15): We provide data export functionality in account settings
• Right to erasure (Art. 17): Account deletion purges all personal data within 30 days
• Right to portability (Art. 20): Data exports available in JSON format
• Right to rectification (Art. 16): Users can update profile information at any time
• Right to restriction (Art. 18): Contact privacy@engagecloud.pro to restrict processing

Personal data is primarily stored and processed in the United States on Google Cloud infrastructure. For data transfers from the EU/EEA to the United States, EngageCloud LLC relies on:

• Standard Contractual Clauses (SCCs) under EU Commission Decision 2021/914
• Google Cloud’s existing adequacy mechanisms and SCCs

Enterprise customers may request EU-region deployment where available under their agreement. Contact enterprise@engagecloud.pro for details.

Personal data is retained for the duration of the active subscription. Upon termination:

• A 30-day export window is provided for data retrieval
• After 30 days, personal data is permanently deleted from active systems
• Backup copies are purged within 90 days of account deletion
• Audit logs required for legal compliance may be retained for up to 7 years in anonymized form

To formally execute this DPA for your Enterprise agreement, or for any questions about data processing practices, contact:

Data Protection Contact
EngageCloud LLC
privacy@engagecloud.pro
Subject: DPA Execution Request