Data Processing Agreement
For customers who need one in writing: how we handle the personal data you bring into EngageDigital when you are the controller and we are the processor.
Roles
When you connect a social account and we import comments, reviews, author names and audience analytics on your behalf, that data belongs to your relationship with those people, not ours. For it, you are the controller and Proceed Interactive Marketing Group LTD is the processor.
For your own account data, your name, your email, your billing record, we are the controller, and the Privacy Policy applies instead.
Subject matter and duration
The processing also includes AI-assisted drafting of posts and of replies to comments and reviews, a brand memory kept per workspace, and storage of the media you upload. The types of data therefore also include photos and videos, which may show people, and the names and notes of anyone you invite to approve posts through a client link. Those people are data subjects too.
Our obligations
- We process personal data only on your documented instructions, which for most purposes means the actions you take in the product.
- Everyone with access is bound by confidentiality.
- We apply the technical and organisational measures described below and keep them under review.
- We assist you with data-subject requests, with impact assessments and with breach notification, as far as is reasonable given what we can see.
- On termination we delete or return the data, at your choice, except where law requires us to keep it.
- We make available the information you need to demonstrate compliance, and allow audits on reasonable notice.
AI-assisted processing
When you use the Assistant or any other AI feature, we send the content needed for that request to our AI sub-processor, named on the sub-processor page, and return the result to you.
- Approval is part of your instructions. Nothing the AI drafts is published, sent, scheduled or deleted until a user of your workspace approves it, and each approval is logged with who approved it and when.
- Personal data is not used to train any model, by us or by the sub-processor.
- Brand memory is kept per workspace and holds facts about the business, not about individuals. Contact details, payment details and health information are filtered out before saving, and you can view, edit or delete every entry.
- No workspace’s data is used to produce content for another workspace or another customer.
- Deleting a workspace or closing the account deletes its brand memory, Assistant conversations and media together with the rest of its data.
Sub-processors
You give general authorisation for us to engage the sub-processors listed on the sub-processor page. We impose the same obligations on each of them by contract and we remain responsible to you for what they do.
We will give at least 30 days’ notice before adding or replacing one. If you reasonably object, we will discuss it with you, and if we cannot resolve it you may terminate the affected part of the service without penalty.
Security measures
- Encryption in transit (TLS) and at rest, with connected-platform tokens encrypted under a separate key.
- Role-based access control, multi-factor authentication for production access, and access logging.
- Logical separation of customer data, with every query scoped to a single workspace.
- Regular backups with tested restores, and documented incident response.
International transfers
Where a sub-processor is outside the EEA we rely on an adequacy decision where one exists, and otherwise on the Standard Contractual Clauses (Commission Implementing Decision 2021/914) with a transfer impact assessment. Each entry on the sub-processor page names the mechanism relied on.
Breach notification
We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting data we process for you. The notice will describe what happened, the categories and approximate number of records affected, the likely consequences and what we are doing about it, and we will keep updating you as we learn more.
Your obligations
- You confirm you have a lawful basis for the data you bring into the service, and that you have the right to connect each account.
- You are responsible for responding to data subjects; we will help you locate and export what we hold.
- You will not use the service to process special-category data unless you have told us and we have agreed in writing.