Data Processing Addendum

1. Roles

The Customer is the controller (or, where it acts for its own clients, a processor) of the personal data it puts into the service. HireMediaMind is the processor (or sub-processor). For personal data of our own website visitors and account holders, HireMediaMind is the controller under our Privacy Policy.

2. Subject matter, duration and nature of processing

• Purpose: providing the services the Customer ordered, including lead and contact management, WhatsApp and email messaging, review requests, AI-drafted replies and content, bookings and reporting, and any custom automation we build for the Customer.
• Duration: the term of the agreement, plus the deletion period in section 10.
• Data subjects: the Customer's leads, customers, prospects and staff users.
• Data types: names, phone numbers, email addresses, business details, message content, review content, booking details and usage records. We do not knowingly process special-category data or children's data, and the Customer must not submit it.

3. Instructions

We process personal data only on the Customer's documented instructions, which are the agreement, this DPA and the Customer's use and configuration of the service. If we believe an instruction breaks the law, we will tell the Customer. Where applicable law requires us to process data otherwise, we will tell the Customer first unless the law forbids it.

4. Confidentiality

Only people who need access to deliver and support the service can reach Customer personal data, and they are bound by confidentiality duties.

5. Security

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (HTTPS/TLS);
• separation of each Customer's data from other Customers' data inside the service;
• role-based access for team members, so each user sees only what their role allows;
• encrypted storage of the credentials a Customer connects to the service;
• audit logging of important account actions;
• human approval before AI-drafted outbound messages are sent;
• checks against the Customer's do-not-disturb list before each message is sent.

A more detailed description of our security measures is available on request.

6. Sub-processors

The Customer gives general authorisation for the sub-processors listed on our Sub-processors page. We bind each one to data protection obligations no less protective than this DPA. We will update that page and email the account owner of each Customer at least 14 days before a new sub-processor starts handling Customer personal data. The Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the Customer may end the affected service and receive a pro-rata refund of prepaid fees for it.

7. International transfers

HireMediaMind is based in India and hosts the service on servers in India, with some databases in the United Kingdom. Our sub-processors may be in the United States and elsewhere. Where personal data from the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914): Module Two (controller to processor) or Module Three (processor to processor) as applicable, with the Customer as data exporter and HireMediaMind as data importer, incorporated by reference with: the Customer's supervisory authority as the competent authority; the law of the EU Member State where the Customer is established (otherwise Ireland); sections 5 and 6 of this DPA as the technical and organisational measures and the sub-processor authorisation; and the processing details in section 2 as Annex I. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies in the same way, with the law of England and Wales and the Information Commissioner's Office (ICO) as the competent authority, and for Switzerland the clauses apply with references adapted to Swiss law. The optional docking clause (Clause 7) applies, so another party may accede to the clauses with our agreement.

8. Assisting the Customer

Taking into account the nature of processing, we will help the Customer respond to requests from data subjects (the service includes data export and deletion tools), and help with security, breach notification, data protection impact assessments and prior consultation where required.

9. Personal data breaches

We will tell the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe, as far as known, the nature of the breach, the data and approximate number of people affected, likely consequences, and the measures taken or proposed, and we will keep the Customer updated. Our contact for this is team@hiremediamind.com.

10. Return and deletion

On termination, the Customer can export its data using the service, and can delete it at any time with the account deletion tool, which anonymises personal data immediately. We delete or anonymise any remaining Customer personal data within 30 days after account closure or the Customer's written request, unless law requires us to keep it (for example billing records), in which case we keep it only for that purpose and keep protecting it.

11. Audits

We will give the Customer the information needed to show compliance with this DPA, and allow a reasonable audit, no more than once a year unless a breach or a regulator requires otherwise, on at least 30 days' written notice, during business hours and subject to confidentiality. We may satisfy a request first by providing existing reports or written answers.

12. Liability and precedence

Liability under this DPA is subject to the limits in the main agreement, except where law does not allow it. If this DPA conflicts with the main agreement on data protection, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

13. Contact