respondology mark

Data Processing Agreement

Last updated: August 6, 2026

This Data Processing Agreement (the “DPA”) is entered into by and between the Client  and Respondology, LLC (“Respondology”), and is effective as of the effective date of the applicable Software as a Service Agreement, Order Form, or other agreement that incorporates this DPA by reference (the “Effective Date”).

Recitals

WHEREAS, the Parties entered into that certain Software as a Service Agreement, (the “Agreement”);

WHEREAS, pursuant to the Agreement, the Parties have agreed that it may be necessary for Respondology to Process certain Client Personal Data (as defined below) on behalf of Client, as more fully described in attached Exhibit A; and

WHEREAS, in light of this Processing, the Parties have agreed to enter into this DPA to address the compliance obligations imposed upon Client pursuant to Applicable Privacy Law. Respondology is appointed by Client, as a Processor (as defined under the GDPR), to Process Client Personal Data on behalf of Client to the extent necessary to provide the Services in accordance with the terms of this DPA and the Master Agreement. For the avoidance of doubt, this DPA shall not apply to the extent Respondology is operating in the capacity as a Controller (as defined under the GDPR) or joint Controller of personal data (as defined under the GDPR), notwithstanding the fact that such data may also constitute Client Personal Data hereunder.

NOW THEREFORE, in consideration of the foregoing and the mutual covenants and promises to set forth herein, and for other good and valuable consideration, the receipt of which the Parties hereby acknowledge, the Parties hereby agree as follows:

Agreement

  1. Definitions. In addition to the defined terms specified in the first paragraph, recitals and substantive provisions of this DPA, the following terms have the meanings set forth below:
    1. “Applicable Privacy Law” means the relevant data protection and privacy law (including GDPR) to which Client is subject, and any guidance or statutory codes of practice issued by the relevant Privacy Authority including, without limitation, the GDPR;
    2. “Claim” means any third-party action, claim, assertion, demand or proceeding;
    3. “Client Personal Data” means any information, provided or made available to Respondology by or on behalf of Client in connection with Respondology’s performance of the Services, which relates to an identified or identifiable natural person as defined by the Applicable Privacy Law, and including the categories of data listed in the Processing Appendix together with any additional such personal data to which Respondology has access from time to time in performing the Services under this DPA;
    4. “GDPR” means Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “General Data Protection Regulation”) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as modified by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, as updated, superseded or replaced from the time to time;
    5. “Losses” means any (a) Claim, and (b) direct loss, damage, cost, charge, fine, fees, levies, award or expense. For the avoidance of doubt, Losses shall not include any indirect or consequential losses;
    6. “Privacy Authority” means the relevant supervisory authority with responsibility for privacy or data protection matters in the jurisdiction of Client;
    7. “Process”, “Processing” or “Processed” means any operation or set of operations which is performed upon Client Personal Data whether or not by automatic means, including collecting, recording, organizing, storing, adapting or altering, retrieving, consulting, using, disclosing, making available, aligning, combining, blocking, erasing and destroying Client Personal Data;
    8. “Services” means the services provided by Respondology in relation to the Processing of Client Personal Data as described in the Agreement; and
    9. “Transfer Contract Clauses” means the model contract clauses approved by the UK government for the transfer of Client Personal Data to Processors established in third countries, as may be amended or replaced by the UK government from time to time.
  2. Processing Requirements.
    1. Respondology acknowledges and agrees that, for purposes of this DPA, Client is appointing Respondology to undertake various activities in respect of Client’s social media accounts on behalf of the Client (which will involve Respondology processing Client Personal Data and only Client (including on behalf of its end clients, where applicable) shall have the right to direct Respondology in connection with Respondology’s Processing of the Client Personal Data.
    2. Respondology represents and warrants, with respect to all Client Personal Data that it Processes on behalf of Client, that at all times, unless otherwise expressly permitted under the Agreement:
      1. it shall Process such Client Personal Data only for the purposes of providing the Services and as may subsequently be agreed between the Parties in writing and, in so doing, shall act solely on the instructions of Client;
      2. it shall not Process, apply, or use, the Client Personal Data for any purpose other than as required and necessary to provide the Services; and
      3. it shall not create or maintain identifiable data derived from the Client Personal Data, except for the purposes of providing the Services. For the avoidance of doubt, nothing set forth herein shall prevent Respondology from creating aggregate, non-identifiable data which is derived from the Client Personal Data.
    3. Respondology shall have in place, and maintain, appropriate processes and any associated technical measures that will ensure that Client’s reasonable and lawfufl instructions, as they relate to the Processing of Client Personal Data, can be complied with.
    4. Respondology shall comply with Applicable Privacy Law, to the extent applicable to Respondology’s Processing of the Client Personal Data.
    5. Respondology shall provide to Client such co-operation, assistance and information as Client may reasonably request to enable it to comply with its obligations under any Applicable Privacy Law and co-operate and comply with the directions or decisions of a relevant Privacy Authority, in each case within such reasonable time as would enable Client to meet any time limit imposed by the Privacy Authority. Respondology shall provide Client with all reasonable assistance and information with respect to any notifications to, or registration with, Privacy Authorities as required by Applicable Privacy Law.
    6. The Parties acknowledge and agree that Respondology shall not be entitled to reimbursement of any costs which Respondology may incur as a result of or in connection with complying with Client’s instructions for the purposes of providing the Services and/or with any of its obligations under this DPA or any Applicable Privacy Law; provided, however, that Client shall reimburse Respondology for its reasonable costs associated with Respondology’s compliance with (a) its obligations set forth in Section 2.5 above, and/or (b) the directions or decisions of any Privacy Authority, in each case to the extent such obligations arise as a result of Client’s failure to comply with Applicable Privacy Law.
    7. Respondology shall maintain at all times, and provide or make available to Client, promptly following receipt of Client’s written notice, an accurate and complete written record of the Processing of Client Personal Data by Respondology on behalf of Client (including, without limitation, any Processing undertaken by Sub-Processors).
    8. To the extent required by Applicable Privacy Law, Respondology shall designate (a) a data protection officer, and (b) a data protection representative in the EU.
  3. Processing and Storage Locations.
    1. Client acknowledges and agrees that Respondology may Process Client Personal Data in the United States.
    2. To the extent Respondology stores Client Personal Data in a cloud environment, Respondology shall require the applicable cloud service provider to comply with industry standard best practices for cloud computing security.
  4. Security of Client Personal Data.
    1. Respondology shall maintain, during the term of the Agreement, appropriate technical and organizational security measures to protect the Client Personal Data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorized disclosure or access and against all other unlawful forms of Processing, as more fully described in the attached Exhibit B (the “Security Measures”).
    2. Respondology shall ensure the reliability (as such term is used in the GDPR) of any employees and Sub-Processor personnel who access the Client Personal Data and ensure that such personnel have undergone appropriate training in the care, protection and handling of Client Personal Data, and have entered into an agreement, in relation to the Processing of Client Personal Data, the terms of which are no less onerous than those found in this DPA. Respondology will remain liable for any unauthorized access to, Processing, or disclosure of Client Personal Data by each such Sub-Processor as if it had undertaken such action itself.
  5. Sub-Processors.
    1. Respondology shall not sub-contract or outsource or otherwise permit any Processing of Client Personal Data, or otherwise disclose any Client Personal Data, to any other person or entity (each a “Sub-Processor”) unless and until:
      1. Respondology has imposed legally binding terms no less onerous than those contained in this DPA on such Sub-Processor; and
      2. Respondology has, entered into Transfer Contract Clauses with the Sub-Processor, if and to the extent the scope of sub-processing involves the transmission of Client Personal Data to, the storage of Client Personal Data in, or the Processing of Client Personal Data by any other means in, third countries.
    2. Client acknowledges and agrees that Respondology is authorized to outsource Processing of Personal Data to those listed in Exhibit A. Respondology shall notify Client in writing of the addition or replacement of any Subprocessor at least thirty (30) days prior to the proposed engagement.
  6. Breach Notification.
    1. Unless otherwise prohibited by applicable law, Respondology shall notify Client, as soon as is reasonably possible under the circumstances but in any event no later than within 24 hours after becoming aware, of any accidental, unauthorized, or unlawful destruction, loss, alteration, or disclosure of, or access to, Client Personal Data (“Security Breach”). Such notification shall include (a) a detailed description of the Security Breach, (b) the type of data that was the subject of the Security Breach and (c) the identity of each affected person (or, where not possible, the approximate number of data subjects and of Client Personal Data records concerned). Respondology shall communicate to Client (i) the name and contact details of Respondology’s chief security officer or other point of contact where more information can be obtained; (ii) a description of the likely consequences of the Security Breach; (iii) a description of the measures taken or proposed to be taken by Respondology to address the Security Breach, including, where appropriate, measures to mitigate its possible adverse effects; and additionally in such notification or thereafter (iv) as soon as such information can be collected or otherwise becomes available, any other information Client may reasonably request relating to the Security Breach.
    2. Respondology shall take prompt action to investigate the Security Breach and shall use industry standard, commercially reasonable, efforts to mitigate the effects of any such Security Breach in accordance with its obligations hereunder and, subject to Client’s prior written agreement, to carry out, at Respondology’s sole cost, any recovery or other action reasonably necessary to remedy the Security Breach. Unless required to do so under Applicable Privacy Law, Respondology shall not release or publish any filing, communication, notice, press release, or report concerning any Security Breach (“Notices”) without Client’s prior written approval. Respondology shall provide written notice to Client of all corrective actions undertaken by Respondology following a Security Breach.
  7. Privacy Impact Assessment. Respondology shall, promptly upon receipt of written request by Client, make available to the Client such information as is reasonably necessary to demonstrate Respondology’s compliance with Applicable Privacy Law and shall assist the Client, at Client’s expense, in carrying out such privacy impact assessment of the Services as is reasonable in light of the Client Personal Data that is being processed. Respondology shall reasonably cooperate with Client to implement such mitigation actions as are reasonably required to address privacy risks identified in any such privacy impact assessment. Unless such request follows a Security Breach, or is otherwise required by Applicable Privacy Law, Client shall not make any such request more than once in any 12-month period.
  8. Audit Rights. Respondology shall permit Client and/or its authorized agents to audit its records to the extent reasonably required in order to confirm that Respondology is complying with its obligations under this DPA or any Applicable Privacy Law, provided always that any such audit does not involve the review of any third-party data and that the records and information accessed in connection with such audit is treated as confidential information by Client. Client shall bear its own costs in relation to such audit, unless the audit reveals any material non-compliance with Respondology’s obligations under this DPA, in which case the costs of the audit shall be borne by Respondology.
  9. Deletion of Client Personal Data. Respondology shall, promptly or within no more 60 days, following receipt of written notice from the Client, delete Client Personal Data from its records and, upon completion of the Services, comply with all reasonable instructions from the Client with respect to the deletion of any remaining Client Personal Data.
  10. Third Party Disclosure Requests.
    1. Unless prohibited by applicable law, Respondology shall, and shall procure that any Sub-Processor shall, inform Client promptly of any inquiry, communication, request or complaint from:
      1. any governmental, regulatory or supervisory authority, including Privacy Authorities or the U.S. Federal Trade Commission; and/or
      2. any data subject, relating to the Services, any Client Personal Data or any obligations under Applicable Privacy Law, and shall provide all reasonable assistance to enable Client to respond to such inquiries, communications, requests or complaints and to meet applicable statutory or regulatory deadlines.
    2. Respondology shall, and shall require that any Sub-Processor shall, not disclose Client Personal Data to any of the persons or entities listed in (a) or (b) above unless it is (i) legally required to do so and has otherwise complied with the obligations in this Section, or (ii) Client has expressly authorized it in writing to do so.
    3. Unless prohibited by applicable law, in the event that Respondology or any Sub-Processor is required by law, court order, warrant, subpoena, or other legal judicial process (“Legal Request”) to disclose any Client Personal Data to any person or entity other than Client, Respondology shall, and shall procure that any Sub-Processor shall, notify Client promptly and shall provide all reasonable assistance to Client to enable Client to respond or object to, or challenge, any such demands, requests, inquiries or complaints and to meet applicable statutory or regulatory deadlines. Respondology shall, and shall procure that any Sub-Processor shall, not disclose Client Personal Data pursuant to a Legal Request unless it is required to do so and has otherwise complied with the obligations in this Section.
  11. Indemnity. Respondology shall indemnify Client (and each of its respective officers, employees and agents), against all Losses arising out of or in connection with any material breach by Respondology (and by any Sub-Processor) of the provisions of this DPA. Client shall promptly notify Respondology, in writing, of any such alleged breach and Client shall not incur any costs or liabilities with respect to the same and with respect to which it would be indemnified by Respondology hereunder, without the prior written consent of Respondology, such consent not to be unreasonably delayed or withheld. Respondology’s maximum aggregate liability hereunder shall be limited to the amounts paid and payable to Respondology in the 12 months preceding the material breach of the provisions in this DPA.
  12. Term. This DPA shall commence on the Effective Date and shall continue in full force and effect until the later of (a) the termination or expiration of the Agreement, or (b) completion of the last of the Services to be performed pursuant to the Agreement.
  13. Governing Law. This DPA will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Data Protection Laws.
  14. Counterparts. This DPA may be executed in any number of counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument.

Exhibit A - Summary of Processing

Subject Matter: Processing of Client Personal Data for the execution of any applicable Order Form.

Duration of Processing: For the duration of the client’s use of Respondology’s services, or until deletion is requested.

Nature and Purpose of Processing: To receive, analyze, and return results on user-generated content submitted through Customer Content Sources for the purpose of enabling Customers to manage online interactions. Processing includes, depending on products purchased: (a) applying automated rules, machine learning models, and human review to identify and classify comments or other content for potential hiding, removal, or escalation; (b) extracting insights such as topics, trends, sentiment, and related metrics to support Customer’s analysis and decision-making; and (c) generating and delivering proposed responses to user content, based on parameters and guidance provided by Customer, with options for human oversight. Processing also involves storage, transmission, and display of Customer Content as necessary to provide these functions, together with related account configuration, reporting, system maintenance, security, and product improvement. Where Customer uses Respondology’s API or provides other Customer Content Sources, Respondology processes such data in the same manner to deliver the moderation, intelligence, and response functions described above.

Categories of Data Subjects:

  • Client employees and contacts
  • Internet users who interact with Client posts


Types of Personal Data Processed:

Client Data Categories

  • Client company name
  • Client employee names for users of the platform and relevant contacts (such as billing)
  • Client employee email and phone number
  • OAuth tokens for social media asset access


Internet User Data Categories

  • Internet User’s comment content, and related metadata such as time and date, platform, etc.
  • User’s account handle and/or name
  • User’s avatar (if any)

While some information in the “Internet User” category is deemed PII, Respondology does not collect personal information of individuals that is not already made public on the platform, nor does it collect any data of a sensitive nature.

All data processing for Respondology is done within the US.

Contact Details of Respondology’s Privacy Contact:


Approved Subcontractors and Data Transfers

Our full list of subprocessors can be found at https://trust.respondology.com/

Exhibit B - Security Measures

Our security measures represent industry-standard best practices sufficient for the types of data we collect and use on our clients’ behalf. Respondology is committed to the security and responsible processing of our client’s data, and complies with all laws that govern its services. We regularly review our data uses, current technologies, and the latest regulations. We will promptly update our security policies as new developments occur.

Security Oversight

Respondology’s Security & Compliance Committee, overseen by our Security & Compliance Officer, is responsible for our Information Security Program, which is designed to promote the protection and ensure the confidentiality, integrity, availability, accountability, and auditability of Respondology’s information assets. The ISP’s objective is to enable the company to carry out operations in a secure environment where risk is carefully managed and protection of assets is both comprehensive and pervasive. The program covers all computing resources and information assets and applies to employees, contractors and third party partners. This includes network and data security, patching and monitoring of Respondology’s computing resources, as well as employee training in proper handling and protection of data.

Questions can be directed to security@respondology.com.

Access Control

Respondology adheres to the principle of least privilege when granting access to any data or system. Access is granted only with documented business need and only upon the approval of our Security & Compliance Committee. Access to any high risk system is audited quarterly by the Committee.

Data Management

Respondology is hosted in the US-East-1 region of AWS cloud hosting facilities. AWS is an industry standard vendor and maintains best in class security. Our RDS databases are automatically backed up daily and retained for 35 days in a separate storage region.

Data is encrypted in transit (RSA2048 certificate with TLS1.2) and at rest (AES-256).

Third-Party Audited

Respondology is proud to be SOC 2 tested and attested by the third party auditing firm, Prescient Assurance. Our letter of attestation is available upon request. Our full SOC 2 audit report is also available, and requires a signed NDA with Respondology.

We also undergo annual penetration testing by a third party. Results are available upon request with a signed NDA.