Data Processing Agreement

This agreement applies where you are a business customer and Endromeda processes personal data on your behalf — for example the audience data behind your connected Instagram account, or the contacts your lead magnets collect. It forms part of the Terms of Service. Where we decide why and how data is used, such as your own account and billing details, we are the controller and the Privacy Policy governs instead.

• "Controller", "processor", "personal data", "processing", "data subject" and "supervisory authority" carry their meanings from the UK GDPR and EU GDPR.
• "Applicable data protection law" means the UK GDPR, the EU GDPR, and any other privacy law that applies to the processing.
• "Sub-processor" means a third party we engage to process personal data on your behalf.

• You are the controller for personal data you upload, connect, or collect through the product.
• Endromeda is the processor for that data, and acts only on your documented instructions.
• Endromeda is the controller for your own account, billing and support data, and for visitors to our websites.

Using the product is your instruction to process as described here and in the documentation. If an instruction would breach data protection law, we will tell you and may decline it.

• Process only on your documented instructions, except where the law requires otherwise — in which case we tell you first unless prohibited.
• Bind everyone with access to a duty of confidentiality.
• Apply the security measures in §08.
• Help you respond to data subject requests, and to consultations with a supervisory authority.
• Help you with data protection impact assessments where the data we hold is relevant.
• Tell you without undue delay if we believe an instruction breaches applicable law.
• Make available the information you reasonably need to show compliance.

• Have a lawful basis for the personal data you put into Endromeda, including any consent your audience must give.
• Give data subjects the notice their law requires.
• Do not upload special category data, or data about anyone under 16.
• Keep your credentials and your team’s access under control.
• Respond to data subject requests that reach you; we assist, we do not decide.

You give general authorisation for the sub-processors below. Each is bound by terms no less protective than these, and we remain liable for their performance.

AI generation sends the relevant content to Anthropic for text and to Google for images. Both are contractually prohibited from training models on it.

We will give at least 30 days' notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds, and if we cannot resolve it you may terminate the affected service and receive a pro-rata refund of anything prepaid.

These measures develop with the product. We will not reduce the overall level of protection during your term.

We notify you without undue delay and within 48 hours of becoming aware of a personal data breach affecting your data. This is deliberately shorter than the 72 hours Article 33 gives you to notify your supervisory authority, so you have time to act. We will tell you what happened, the categories and approximate number of people and records involved, the likely consequences, and what we are doing about it — and follow up as we learn more. We do not notify your data subjects on your behalf unless you ask us to in writing.

If a data subject contacts us directly about data we hold for you, we will not respond substantively; we will pass it to you without undue delay. The product gives you the means to access, export, correct and delete the data yourself, and where it does not, we will assist within 10 business days.

• While your account is open, data is kept as described in the Privacy Policy.
• On termination you may choose export or deletion. Tell us within 30 days.
• Absent an instruction, we delete personal data processed on your behalf within 90 days of termination.
• Encrypted backups are overwritten on a rolling cycle within 90 days.
• We retain what the law requires us to keep — invoices and tax records — and nothing more.

On reasonable written notice, not more than once a year unless a supervisory authority requires otherwise or a breach has occurred, you may verify our compliance. We will answer a reasonable written questionnaire and provide the documentation we hold. On-site or third-party audits are arranged by agreement, at your cost, under confidentiality, and scheduled not to disrupt the service.

Our sub-processors are largely US-based, so personal data will be transferred there. EEA transfers rely on the Standard Contractual Clauses, which are incorporated here by reference with Endromeda as data exporter or importer as the case requires. UK transfers rely on the UK International Data Transfer Addendum. Where a provider is certified under the EU-US Data Privacy Framework we rely on that as well.

Each side’s liability under this agreement is subject to the limits in the Terms of Service. This agreement starts when you first use the product as a business customer and continues until we have deleted or returned the data under §11. Sections that by their nature should survive, do.

Data protection matters: hello@endromeda.xyz, subject "Data Protection". For SCC or IDTA countersignature, say so and we will arrange it.