Data processing agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Rumorly ("Processor") and the customer ("Controller") for the Rumorly service. It applies whenever Rumorly processes personal data on the Controller's behalf.

1. Subject matter and duration

Processing of respondent data to collect, classify and report on self-reported attribution answers, for as long as the Controller uses the service, plus 30 days.

2. Nature and purpose

Storing answers to "how did you hear about us?" and related identifiers; classifying the answer into a channel and named source; writing results to the Controller's CRM; matching respondents to the Controller's billing customers to compute revenue by channel.

3. Categories of data and data subjects

• Data subjects: the Controller's users, prospects and customers who answer the question.
• Data: email address, name, user id, company domain, the free-text answer (which may mention other people), page and campaign context (UTM parameters, referrer, landing page), and billing customer records read from the Controller's Stripe account (customer id, email, name, subscription amounts).
• No special categories of data are intended to be processed. The Controller should not ask respondents for them.

4. Processor obligations

The Processor will:

1. process personal data only on documented instructions from the Controller, including this DPA;
2. ensure that people authorised to process it are bound by confidentiality;
3. implement the security measures in section 6;
4. engage subprocessors only as set out in section 5;
5. assist the Controller with data subject requests, including erasure via DELETE /v1/people;
6. notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach;
7. delete or return all personal data at the end of the service, at the Controller's choice;
8. make available the information needed to demonstrate compliance and allow for audits.

5. Subprocessors

The Controller authorises the subprocessors listed at /legal/subprocessors. The Processor will announce changes at least 30 days in advance; the Controller may object on reasonable grounds and, if no solution is found, terminate.

6. Security measures

• Data encrypted in transit (TLS 1.2+) and at rest; CRM tokens and billing keys additionally encrypted with AES-256-GCM.
• Billing access uses read-only restricted keys.
• Tenant isolation enforced on every query; API keys hashed, shown once, revocable.
• The respondent's email and name are not sent to the AI provider.
• Access to production limited to named staff, with logging.

7. International transfers

Where a subprocessor is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses (Modules 2 and 3), supplemented by a transfer impact assessment.