This document is a template provided for demonstration purposes and should be reviewed and adapted by qualified legal counsel before being used in production.
This Data Processing Agreement (“DPA”) forms part of, and is subject to, the Terms of Service between you (“Customer”, the controller) and Social Tycoon (the processor). It governs the processing of personal data carried out by us on your behalf in connection with your social network, and reflects the requirements of Article 28 of the EU General Data Protection Regulation (“GDPR”) and equivalent UK provisions.
01Roles of the parties
For Customer Content processed within your network, you act as the controller and determine the purposes and means of processing; we act as the processor and process such data only on your documented instructions. For our own account, billing and website data, we act as a controller as described in our Privacy Policy.
02Scope & instructions
We will process personal data only to provide and support the Service, as instructed by you through your use of the Service and its configuration, and as otherwise documented in this DPA. We will inform you if, in our opinion, an instruction infringes applicable data protection law, unless legally prohibited from doing so.
03Details of processing
| Subject matter | Provision of the white-label social networking platform. |
|---|---|
| Duration | For the term of the Terms of Service, plus any retention period described below. |
| Nature & purpose | Hosting, storage, transmission, display and processing of Customer Content to operate your network. |
| Types of personal data | Profile data, contact details, user-generated content, messages, media, device and usage data, and any other data your end users submit. |
| Categories of data subjects | Your administrators, members and end users. |
04Confidentiality
We ensure that personnel authorized to process personal data are bound by appropriate confidentiality obligations and receive suitable data protection training.
05Security measures
We implement appropriate technical and organizational measures to protect personal data, taking into account the state of the art and the risks of processing. These include encryption in transit and at rest, access controls, network protection, logging and monitoring, and regular testing. See our Security overview for further detail.
06Sub-processors
You authorize us to engage sub-processors (for example, hosting, content delivery, communications and analytics providers) to support the Service. We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We will maintain a list of sub-processors and give you reasonable notice of changes so you may object on legitimate grounds.
07Data subject requests
Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects exercising their rights. Where we receive a request directly relating to your network, we will advise the individual to contact you, the controller.
08Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Content, and will provide information reasonably available to us to help you meet your own notification obligations.
09International transfers
Where processing involves transferring personal data outside the EEA, UK or other restricted regions, we put in place appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with any supplementary measures required.
10Audits
We will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality and security conditions. Where available, we may satisfy audit requests by providing third-party certifications or reports.
11Return & deletion
Upon termination of the Service, and at your choice, we will delete or return Customer Content, and delete existing copies unless retention is required by law, following a short recovery window as described in our Privacy Policy.
12Contact
Questions about this document? Call 0745.393.778, use the contact form or write to Social Tycoon, 2261 Market Street, Suite 5520, San Francisco, CA 94114.