Data Processing
Agreement (DPA)

1. Scope & Applicability

This Data Processing Agreement ("DPA") supplements the Terms of Service and applies between FanpageInsight Inc. ("FI", "Processor", "Service Provider", "we", "us"), a Delaware corporation with principal offices at 650 University Ave #10, Berkeley, CA 94710, United States, Phone: (510) 646-8368, and the legal entity or subscriber identified as the customer ("Customer", "Controller", "you").

This DPA governs the processing of Personal Data in connection with the cloud-based social intelligence platform, telemetry analytics, and APIs provided by FI, in full compliance with the European Union General Data Protection Regulation (EU GDPR 2016/679), UK GDPR, Swiss FADP, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

2. Roles of the Parties & Processing Instructions

2.1 Role Designation: Customer acts as the Data Controller (or "Business" under CCPA) determining the purposes and means of processing Customer Data. FI acts as a Data Processor (or "Service Provider" under CCPA) processing data strictly on behalf of and under documented instructions from Customer.

2.2 Documented Instructions: FI shall process Personal Data solely in accordance with Customer’s documented instructions, including the configuration of queries, monitored pages, sentiment rules, lead score tags, and CRM pipeline webhooks, except where required by applicable federal, state, or international laws.

2.3 CCPA Service Provider Certification: FI certifies that it does not sell, retain, use, or disclose Personal Data for any commercial purpose other than the specific business purpose of providing the Platform services specified in the Agreement.

3. Details of Processing & Data Categories

4. Technical & Organizational Measures (TOMs)

FI implements and maintains robust technical, physical, and administrative safeguards designed to ensure the confidentiality, integrity, availability, and resilience of processing systems:

• Encryption Standards: All data in transit is encrypted using TLS 1.3 with forward secrecy. All persistent data at rest (databases, search indexes, backups) is encrypted using AES-256 with managed KMS keys.
• Access Control & Least Privilege: Multi-Factor Authentication (MFA) is mandatory for all internal infrastructure access. Strict Role-Based Access Control (RBAC) and automated provisioning logs are maintained.
• Confidentiality Obligations: All FI personnel with access to Personal Data are subject to strict contractual confidentiality and data protection obligations.
• Audits & Certifications: Infrastructure operations undergo annual third-party SOC 2 Type II examinations and regular vulnerability scanning and penetration testing.
• Business Continuity & Backups: Daily automated snapshots with geo-redundant storage and disaster recovery recovery point objective (RPO) under 1 hour.

5. Sub-processors

Customer provides general written authorization for FI to engage third-party sub-processors to assist in delivering the services. FI imposes data protection obligations on each sub-processor no less protective than those set forth in this DPA.

FI maintains an updated list of sub-processors. Customer may subscribe to notifications of new sub-processors by emailing dpo@FanpageInsight.com and retains the right to object on reasonable data protection grounds.

6. Data Subject Requests & Right to Erasure

FI provides self-service features and direct technical assistance to enable Controllers to fulfill Data Subject Requests (DSRs) under GDPR Chapter III and CCPA (access, correction, restriction, objection, portability, and erasure).

If FI receives a request directly from a data subject regarding public graph telemetry, FI shall verify the request and execute the deletion across active search indexes within 24 hours via our automated Personal Data Erasure Portal.

7. Security Incident & Breach Notification

In the event of a confirmed Security Incident resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by FI, FI shall notify affected Customers without undue delay and, in any event, within 48 hours of becoming aware of the incident.

The notification shall describe the nature of the incident, estimated affected records, likely consequences, and remediation measures taken or planned.

8. Cross-Border Data Transfers & Standard Contractual Clauses

To the extent the processing of Personal Data involves transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) and UK Addendum are hereby incorporated by reference into this DPA.

9. Deletion and Return of Personal Data

Upon termination or expiration of the Agreement, FI shall, at Customer's election, delete or return all Customer Personal Data within thirty (30) days, except to the extent that FI is required by applicable law to retain copies of such data (in which case FI shall isolate and protect such data until statutory retention periods expire).

10. Executed by Data Processor

This DPA is entered into and effective as of the effective date of Customer's master subscription agreement.