Data Processing Agreement

Parties and scope

This DPA forms part of the Terms of Service between Aurumaxis Labs Limited ("Processor") and the business customer ("Controller"). It applies when we process personal data on the customer's behalf, mainly leads captured through agency widgets, client contact emails, and alert recipients.

Details of processing

• Subject matter and duration: providing ShownInAI for the term of the subscription.
• Nature and purpose: storage, analysis and delivery of scan reports, alerts and leads.
• Data subjects: the Controller's users, clients, prospects and widget submitters.
• Categories of data: names, email addresses, business details, technical identifiers.
• No special categories of data are intended to be processed.

Processor obligations

• Process personal data only on the Controller's documented instructions (these terms and product settings).
• Ensure staff are bound by confidentiality.
• Apply the technical and organisational measures described on the Security page.
• Assist with data subject requests, DPIAs and prior consultations where reasonably required.
• Notify the Controller without undue delay, and within 48 hours where feasible, after becoming aware of a personal data breach.
• Delete or return personal data within 30 days of the end of the service, unless law requires retention.
• Make available the information needed to demonstrate compliance, and allow audits through reasonable written questionnaires or third-party reports.

Subprocessors

The Controller gives general authorisation for the subprocessors on the Subprocessors page. We will update that page and email account owners at least 14 days before adding or replacing a subprocessor; the Controller may object on reasonable data protection grounds and terminate if we cannot resolve the objection. We impose data protection obligations on subprocessors that are no less protective than this DPA.

International transfers

Where personal data is transferred out of the EEA, Switzerland or the UK to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 controller-to-processor and Module 3 processor-to-processor as applicable) and the UK International Data Transfer Addendum are incorporated by reference. Docking clause: optional; Clause 11 option: not applied; Clause 17 and 18: laws and courts of Ireland. Annex I is the 'Details of processing' section above; Annex II is the Security page; Annex III is the Subprocessors page. Transfers under the UAE PDPL follow its cross-border transfer provisions.

CCPA service provider terms

To the extent we process personal information of California consumers, we act as a service provider. We will not sell or share it, or retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service.

Order of precedence

If this DPA conflicts with the Terms of Service, this DPA prevails for data protection matters; the SCCs prevail over both. For a countersigned copy, email [email protected].