Get Early Access

Data Processing Agreement

Last updated

This Data Processing Agreement (“DPA”) forms part of the NPAmplify Terms of Use (the “Agreement”) between NPAmplify (“NPAmplify” or “Processor”) and the customer that accepted the Agreement (“Customer” or “Controller”).

The DPA applies when NPAmplify processes Customer Personal Data on Customer’s behalf. If this DPA conflicts with the Agreement, this DPA controls with respect to the processing of Customer Personal Data.

1. Definitions

  • “Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Agreement. These include the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the CCPA, and other U.S. state privacy laws.
  • “Customer Personal Data” means personal data contained in Customer Content or workspace data that NPAmplify processes on Customer’s behalf.
  • “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
  • “SCCs” means the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914.
  • “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
  • “Subprocessor” means any third party engaged by NPAmplify to process Customer Personal Data.
  • Terms such as “controller,” “processor,” “data subject,” “personal data,” and “processing” have the meanings given in the GDPR. For the CCPA, “controller” includes “business” and “processor” includes “service provider.”

2. Roles and scope

  • Customer is the controller and NPAmplify is the processor of Customer Personal Data.
  • NPAmplify is an independent controller of the account, billing, and usage data it processes for its own business purposes, as described in the Privacy Policy.
  • Prohibited data. Customer will not submit protected health information, patient data, or special categories of personal data (GDPR Article 9) to the Services. This DPA does not cover such data, and NPAmplify is not a HIPAA business associate.
  • The subject matter, nature, purpose, and duration of processing, and the types of data and data subjects, are described in Annex 1.

3. Customer’s obligations

Customer is responsible for:

  • having a lawful basis for the processing;
  • providing any notices to data subjects that Data Protection Laws require; and
  • making sure its instructions to NPAmplify comply with Data Protection Laws.

4. NPAmplify’s obligations

NPAmplify will:

  1. process Customer Personal Data only on Customer’s documented instructions, which include the Agreement, this DPA, and Customer’s use of the Services’ features, unless law requires otherwise. In that case, NPAmplify will notify Customer unless the law prohibits it;
  2. tell Customer if, in its opinion, an instruction violates Data Protection Laws;
  3. make sure personnel authorized to process Customer Personal Data are bound by confidentiality obligations;
  4. implement the technical and organizational measures described in Annex 2;
  5. not use Customer Personal Data to train AI models; and
  6. for the CCPA, not sell or share Customer Personal Data; not retain, use, or disclose it outside the direct business relationship or for any purpose other than performing the Services; and not combine it with personal data from other sources except as the CCPA permits.

5. Subprocessors

  • Customer gives general authorization for NPAmplify to engage Subprocessors. NPAmplify will provide a list of its current Subprocessors on request to [email protected].
  • NPAmplify will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than this DPA. NPAmplify remains liable for its Subprocessors’ performance.
  • NPAmplify will notify Customer by email at least 30 days before a new Subprocessor begins processing Customer Personal Data.
  • Customer may object to a new Subprocessor on reasonable data protection grounds by emailing [email protected] within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unused period.

6. Data subject requests

NPAmplify will:

  • tell Customer promptly if it receives a request from a data subject relating to Customer Personal Data, and will not respond to the request except to direct the data subject to Customer; and
  • give Customer reasonable assistance, through the Services’ features or otherwise, in responding to data subject requests.

7. Security Incidents

NPAmplify will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will include, to the extent known:

  • the nature of the incident;
  • the categories and approximate number of data subjects and records affected;
  • the likely consequences; and
  • the measures taken or proposed to address it.

NPAmplify will take reasonable steps to contain and fix the incident. NPAmplify’s notification is not an admission of fault or liability.

8. Assistance

Taking into account the nature of the processing, NPAmplify will give Customer reasonable assistance with:

  • data protection impact assessments; and
  • prior consultations with supervisory authorities.

9. Deletion and return

When the Agreement ends, NPAmplify will allow Customer to export Customer Content for 30 days. After that, NPAmplify will delete Customer Personal Data within 90 days, except where law requires it to be kept.

Data in backups will be overwritten on a rolling schedule and protected under this DPA until then.

10. Audits

  • NPAmplify will make available the information reasonably needed to demonstrate compliance with this DPA. This includes answers to reasonable security questionnaires and any third-party audit reports NPAmplify has.
  • If that information is not enough to meet Customer’s obligations under Data Protection Laws, Customer may conduct an audit, once per 12 months, on at least 30 days’ written notice, during business hours, at Customer’s expense, and subject to confidentiality obligations.
  • A supervisory authority may also conduct an audit where Data Protection Laws require it.

11. International transfers

For transfers of Customer Personal Data from the EEA, UK, or Switzerland to NPAmplify in a country without an adequacy decision, the parties agree:

  • EEA transfers: the SCCs are incorporated by reference, as follows:
    • Module Two (controller to processor);
    • Clause 7 (docking clause) applies;
    • Clause 9, Option 2 (general authorization) applies, with the notice period in Section 5 of this DPA;
    • the optional language in Clause 11 does not apply;
    • Clause 17, Option 1: the governing law is the law of Ireland;
    • Clause 18: disputes will be resolved by the courts of Ireland.
    • Annex I of the SCCs is completed by Annex 1 of this DPA, and Annex II by Annex 2.
  • UK transfers: the UK Addendum is incorporated by reference. Tables 1 to 3 are completed with the information in this DPA and its Annexes. In Table 4, either party may end the Addendum as set out in Section 19 of the Addendum.
  • Swiss transfers: the SCCs apply with these changes:
    • references to the GDPR are read as references to the Swiss FADP;
    • the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner;
    • “Member State” includes Switzerland, so that Swiss data subjects can enforce their rights there.
  • If the SCCs conflict with this DPA, the SCCs control.

12. Liability

Each party’s liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow those limitations.

13. Term

This DPA remains in effect for as long as NPAmplify processes Customer Personal Data under the Agreement.

Annex 1: Details of processing

A. Parties

  • Data exporter (Controller): Customer, as identified in its NPAmplify account. Contact: the account owner’s email.
  • Data importer (Processor): NPAmplify. Contact: [email protected].

B. Description of processing

Item Detail
Categories of data subjects Customer’s workspace members (employees and contractors); individuals who may appear in Customer Content, such as staff featured in posts
Categories of personal data Names, email addresses, job titles, profile images, and any personal data Customer includes in Customer Content; connected social media account identifiers
Special categories None. Customer must not submit special-category data or PHI.
Frequency of transfer Continuous, for the duration of the Agreement
Nature and purpose of processing Hosting, storage, and AI-assisted generation, scheduling, and publishing of social media content, as described in the Agreement
Retention For the duration of the Agreement, then as described in Section 9
Subprocessor transfers To NPAmplify’s Subprocessors (list available on request), for the same purposes and duration

C. Competent supervisory authority

The supervisory authority determined under Clause 13 of the SCCs.

Annex 2: Technical and organizational security measures

  • Encryption: TLS for data in transit; encryption at rest for databases and file storage.
  • Access control:
    • row-level security that keeps customer workspaces separate;
    • role-based permissions within workspaces;
    • least-privilege staff access, with multi-factor authentication on administrative systems.
  • Credential handling: passwords stored only as salted hashes; third-party access tokens stored encrypted and revoked on disconnect.
  • Availability: managed cloud infrastructure, regular backups, and documented restore procedures.
  • Logging and monitoring: application and access logging, plus error monitoring.
  • Secure development: code review, dependency updates and patching, and separate development and production environments.
  • Vendor management: written data protection terms with every Subprocessor.
  • Incident response: a documented process for detecting, containing, and notifying customers of Security Incidents.
  • Data minimization: only the inputs needed for each request are sent to AI providers, and NPAmplify does not use Customer Content to train AI models.

Annex 3: Subprocessors

NPAmplify’s current list of Subprocessors is available on request to [email protected].