Data processing agreement

This data processing agreement belongs to the agreement on the use of Branddock (the terms) between:

• the customer using a workspace in Branddock (the controller); and
• the sole proprietorship Better Brands, owner Erik Jager, which provides Branddock (the processor), Chamber of Commerce number 75832208, VAT ID NL001895948B05, located at Frisopark 2, 6711 WZ Ede, reachable at hello@branddock.app.

Branddock is a processor for the personal data in the customer's workspace. For account and billing data Branddock is itself the controller; the privacy statement applies to those.

Branddock processes personal data only to provide the service the customer uses: storing and editing brand data, creating content with AI, connecting services the customer connects itself, and what that technically requires (hosting, storage, security, error tracking). Which processing that is, with the types of data, the data subjects and the retention periods, is set out in annex A. This agreement applies for as long as Branddock processes personal data for the customer.

Branddock processes the personal data only on documented instructions from the customer. Those instructions are this agreement together with what the customer sets up and does in Branddock. Branddock does not use the data for its own purposes and does not train AI models on it itself. Annex C lists which sub-processors receive what. If the law requires Branddock to process otherwise, Branddock informs the customer in advance, unless the law prohibits that. If Branddock believes an instruction infringes the GDPR, Branddock says so immediately.

Anyone at Branddock with access to the personal data is bound to confidentiality, by contract or by law. That access is limited to those who need it for the service.

Branddock takes appropriate technical and organisational measures to secure the personal data, matched to the risk. Those measures are listed in annex B and on the security page.

The customer gives general authorisation for the sub-processors on the list at branddock.app/marketing/security (annex C). Branddock informs the customer by email in advance of a new or replacing sub-processor, so the customer can object. Branddock imposes the same obligations as in this agreement on its sub-processors and remains responsible towards the customer for their compliance.

Branddock assists the customer, as far as reasonably possible, in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection) and with the obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and prior consultation). If a data subject's request reaches Branddock, Branddock forwards it to the customer.

Branddock notifies the customer of a personal data breach without undue delay, and at the latest within 48 hours after becoming aware of it. Branddock provides the information the customer needs to notify the supervisory authority and the data subjects itself, and adds to it as more becomes known.

Some sub-processors are established or process outside the European Economic Area (see the region in annex C). Transfers take place only on a valid basis: the EU-US Data Privacy Framework where the supplier is certified under it, and otherwise the standard contractual clauses of the European Commission. Which basis applies per supplier is set out in Annex C.

After the service ends, Branddock deletes the customer's personal data, or returns it if the customer asks, unless the law requires retention. The customer can export its data beforehand. When a workspace is deleted, its data disappears from the active database; from backups within 30 days at the latest.

Branddock provides the customer with the information needed to demonstrate compliance with this agreement, and cooperates with an audit by the customer or an independent auditor appointed by the customer, after reasonable notice and under confidentiality. The costs of an audit are borne by the customer, unless it shows a material failure by Branddock.

Liability is governed by the terms. In case of conflict between this data processing agreement and the terms, this agreement prevails as regards the processing of personal data. Dutch law applies to this agreement. Questions: hello@branddock.app.

• Processing: storing and editing the workspace content (brand DNA, personas, campaigns, content, knowledge base) and creating content with AI. Categories of data subjects: people the customer mentions in its content (for example contacts, clients, employees), and the customer's team members. Categories of data: what the customer or its team enters or uploads; names and email addresses of team members. Retention: for as long as the workspace exists; the customer can delete it.
• Processing: data from services the customer connects itself (for example Google Analytics, Search Console, social channels, a CRM), at the customer's initiative. Categories of data subjects: the customer's visitors, followers or contacts, to the extent that service provides them. Categories of data: what the connected service returns; usually aggregated figures. Retention: for as long as the connection or the derived data exists in the workspace; the customer can disconnect and delete.
• Processing (translation of the Dutch text approved in task 1647): import of questionnaire responses from a service connected by the controller (Typeform, Jotform), at a user's initiative. Categories of data subjects: respondents to the controller's questionnaire. Categories of data: answers to multiple-choice and scale questions (stored in aggregate only) and answers to open questions. Identifying fields (name, email, phone, address, hidden fields, metadata) are removed before storage; email addresses and phone numbers in open answers are replaced. Residual risk: personal data a respondent mentions in an open answer themselves is not recognised automatically and may remain in the stored answer. Retention: for as long as the persona or the summarising source exists in the workspace; the user can delete it.

The measures are listed on the security page: hosting and database in the EU, encryption of traffic and of connected tokens, a strict Content Security Policy, isolation per organisation and workspace, and role-based access. Branddock updates that page when the measures change.