Data processing agreement

This data processing agreement ("DPA") is part of the terms of service between the customer ("you", the controller) and the operator of Plainrival named in the imprint ("we", the processor). It applies whenever we process personal data on your behalf while providing Plainrival, and meets Article 28 of the EU General Data Protection Regulation (GDPR). It takes effect when you accept the terms; no signature is needed.

Terms used here, such as "personal data", "processing" and "personal data breach", have the meaning given in the GDPR.

1. Subject matter and duration

We process personal data to provide Plainrival to you as described in the terms. This DPA lasts as long as we process personal data for you, and ends when that data has been deleted or returned under section 11.

2. Nature and purpose

Hosting, storing, collecting, analysing, summarising (partly with AI), displaying and delivering data, so that you can:

• watch the competitors' public web pages and public posts you choose, and see what changed
• receive explanations, suggested actions and the weekly brief, in the app, by email and through the integrations you connect
• plan launches in Plainrival Timeline
• give your AI assistant read-only access to your workspace

3. Types of personal data

• Users: names, email addresses, sign-in data and account settings of the people in your workspace
• Usage data: which features are used, linked to internal IDs
• Workspace content: what you enter, such as your company profile, competitor details, notes and Timeline items, which may contain personal data
• Public content: personal data contained in the public pages and posts collected for you, such as names, job titles, usernames and public statements
• Integration data: identifiers and access tokens of the tools you connect

You will not put special categories of personal data (Art. 9 GDPR) or data about criminal convictions (Art. 10 GDPR) into Plainrival.

4. Categories of data subjects

• your employees and other people you give access to your workspace
• people whose data appears in content you enter
• people who appear on the public pages and in the public posts collected for you, such as employees of your competitors or authors of posts

5. Your instructions

We process personal data only on your documented instructions, including for transfers outside the EU and the European Economic Area, unless EU or member state law requires otherwise; in that case we tell you first unless that law forbids it. The terms, this DPA and the way you configure and use Plainrival are your instructions. If we think an instruction breaks data protection law, we will tell you.

You are responsible for having a legal basis for the processing, including for the pages and sources you choose to watch, and for using only publicly available information.

6. Confidentiality

Everyone we authorise to process personal data for you is bound to confidentiality.

7. Security

We take appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the cost and the risk, including encryption in transit and at rest, separation of each workspace's data, access only for the people who need it, and regular backups. We may update these measures as long as the overall level of protection does not fall.

8. Sub-processors

You give us general authorisation to engage sub-processors for hosting and storage, security, email, analytics and AI processing. Your workspace data is stored in the EU. The current list of sub-processors, with their location, is available on request at [email protected]. We will tell you about any intended addition or replacement at least 14 days in advance, by email or in the app. You may object on reasonable data protection grounds within that time; if we cannot resolve the objection, you may end the affected service.

We bind every sub-processor by contract to data protection obligations that are at least as protective as this DPA, and we remain responsible to you for their work.

The payment provider that acts as merchant of record is not our sub-processor: it processes payment data as its own controller.

9. Transfers outside the EEA

We transfer personal data outside the EU and the European Economic Area only with appropriate safeguards under Chapter V GDPR, such as an adequacy decision of the European Commission or the Standard Contractual Clauses.

10. Assistance

Taking into account the nature of the processing, we help you:

• answer requests from data subjects exercising their rights (Chapter III GDPR). If a request reaches us directly, we pass it to you and do not answer it ourselves unless you ask us to
• meet your obligations on security, breach notification, data protection impact assessments and prior consultation (Art. 32 to 36 GDPR)

We tell you without undue delay after becoming aware of a personal data breach that affects your data, with the information you need to meet your own obligations.

11. Deletion and return

When the agreement ends, or when you delete your workspace, we delete the personal data we process for you, unless EU or member state law requires us to keep it. You can export your data before then. Copies in backups are overwritten on a rolling schedule and are not restored except to recover from an incident.

12. Information and audits

We make available the information you need to show that we meet Article 28 GDPR. We allow and contribute to audits and inspections by you or an auditor you appoint who is bound to confidentiality. Audits are held during business hours, with at least 30 days' notice, no more than once a year unless a breach or an authority requires it, and at your cost. Where possible we first answer with written information.

13. Liability and order of precedence

Liability under this DPA follows the terms, as far as the GDPR allows. If this DPA and the terms conflict on data protection, this DPA wins. This DPA is governed by the same law as the terms.