Data Processing Agreement (DPA)

Preamble and parties

This agreement governs the processing of personal data on behalf of a controller under Art. 28 of the General Data Protection Regulation (GDPR) between the Brand Dad customer as controller and SVIX Media, owner Konstantin Botschmanowski, Schulstraße 72, 41372 Niederkrüchten, Germany, as processor ("we").

It specifies the data protection obligations arising from the contract for the use of the Brand Dad platform under our Terms of Service ("main contract"). Brand Dad is offered exclusively to businesses (entrepreneurs within the meaning of Section 14 of the German Civil Code).

1. Subject matter and duration

The subject matter is the processing of personal data that the customer collects, stores or has processed via Brand Dad when we provide the services under the main contract.

This agreement applies for the term of the main contract, including any free trial. It ends with the main contract; obligations that continue beyond the end of the contract (in particular section 12 and confidentiality) remain in force.

2. Nature and purpose of processing

We process the data exclusively to provide the Brand Dad features used by the customer, in particular:

• Hosting of customer websites, including delivery, server log files and cookieless visitor statistics,
• Contact, booking and order forms on the customer website: receiving, storing and forwarding the details of website visitors to the customer,
• Lead inbox: managing incoming inquiries,
• Google Business Profile and reviews: retrieving and displaying profile and review data, creating and publishing reply drafts,
• Social media posts: planning, creating and publishing posts in the channels the customer connects,
• Team users: managing the accounts of the customer's staff or agents invited to the platform,
• AI features (text and image drafts, research) based on the content the customer provides for them.

Nature of processing: collection, recording, storage, organization, retrieval, consultation, use, disclosure to the recipients determined by the customer, erasure.

3. Types of data and categories of data subjects

Types of personal data:

• contact and communication data (e.g. name, email address, phone number, message content),
• booking and order data (e.g. requested appointment, booked service, ordered products, delivery details),
• review and profile data (e.g. name or display name of reviewers, review text, star rating),
• content of social media posts and images, insofar as they show or name individuals,
• user data of team members (name, email address, role, login and activity data),
• technical data (e.g. IP address, timestamp, browser details in server log files and for abuse prevention).

Categories of data subjects: visitors of customer websites, prospects and customers of the customer, persons who review the customer's business, staff and agents of the customer, other persons whose data the customer enters in Brand Dad.

Special categories of personal data (Art. 9 GDPR) are not covered by this agreement. The customer does not use forms to collect such data unless it has checked and established the legal requirements itself and informed us in advance.

4. Instructions of the customer

We process the data only on documented instructions from the customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case we inform the customer of that legal requirement before processing, unless that law prohibits such information.

The instructions result from the main contract, this agreement and the customer's settings and actions in the platform (e.g. publishing, connecting an account, the forwarding address for forms, deleting). The customer gives further instructions in text form to support@branddad.io.

If we believe that an instruction infringes data protection law, we inform the customer without undue delay and may suspend its execution until the customer confirms or changes it.

5. Confidentiality

We only use persons for the processing who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and who have been familiarized with the relevant data protection provisions. This obligation continues after their engagement ends.

6. Technical and organizational measures

We implement the technical and organizational measures (TOMs) required under Art. 32 GDPR, described in Annex 1. The measures are subject to technical progress; we may replace them with equivalent or better measures, provided the level of protection is not reduced. We document material changes.

7. Sub-processors

The customer grants general authorization to engage further processors (sub-processors). The sub-processors engaged when the agreement is concluded are listed in Annex 2 and are deemed approved.

We inform the customer in text form (e.g. by email to the account address or by a notice in the account) at least 30 days before engaging or replacing a sub-processor and update Annex 2. Within this period the customer may object in text form for an important reason relating to data protection. If we cannot find a reasonable solution, the customer may terminate the main contract effective on the date the new sub-processor is engaged; we refund fees already paid for the period after that pro rata.

We contractually bind each sub-processor to data protection obligations that essentially correspond to those of this agreement and remain responsible to the customer for its performance (Art. 28(4) GDPR).

Not sub-processing within the meaning of this section are services of platforms that the customer connects to Brand Dad itself and to which we transfer data on its instructions: Google (Business Profile API, Search Console API, Sign in with Google), Meta (Facebook, Instagram) and TikTok (once approved by TikTok). Their own terms apply to these platforms; they process the data under their own responsibility. Likewise, the payment provider Paddle is not a sub-processor, as it acts as a separate controller.

8. Transfers to third countries

Processing outside the EU/EEA only takes place if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (for the USA the EU-U.S. Data Privacy Framework, where the recipient is certified) or the EU Standard Contractual Clauses. The respective basis is stated in Annex 2.

9. Support with data subject rights

We support the customer with appropriate technical and organizational measures in responding to requests from data subjects for access, rectification, erasure, restriction, data portability and objection (Art. 12–22 GDPR). The customer can carry out many of these steps itself in the platform (e.g. view, export or delete inquiries); otherwise we support on request.

If a data subject contacts us directly, we forward the request to the customer without undue delay and do not answer it ourselves unless agreed otherwise.

10. Further assistance and notification of personal data breaches

Taking into account the nature of processing and the information available to us, we assist the customer in complying with the obligations under Art. 32 to 36 GDPR (security of processing, notification and communication of personal data breaches, data protection impact assessment, prior consultation).

We notify the customer of personal data breaches affecting the customer's data without undue delay, at the latest within 48 hours after becoming aware of them, in text form to the account email address. As far as known, the notification includes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not yet available is provided without undue delay as it becomes available.

Notifying the supervisory authority and communicating with data subjects is the responsibility of the customer as controller.

11. Audit rights of the customer

We make available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, in particular this agreement with its annexes, the description of the TOMs and the list of sub-processors and, where available, evidence and certificates of our sub-processors (e.g. ISO 27001 of Hetzner's data centers).

In addition, we allow for audits, including inspections, by the customer or an auditor mandated by it who is bound to confidentiality and is not a competitor of ours. Audits must be announced with reasonable notice, as a rule at least 14 days in advance, and carried out during normal business hours without disrupting operations. The data centers of our sub-processors are not subject to on-site audits; their certificates and audit reports suffice. For audits exceeding one per calendar year that are not prompted by a specific reason (e.g. a personal data breach), we may charge reasonable compensation for our effort.

12. Deletion and return at the end of the contract

After the main contract ends, the customer can export or request its data for another 30 days. After that, we delete all personal data of the customer unless Union or Member State law requires storage. If the customer deletes its account itself, the data is deleted immediately.

Data contained in encrypted database backups is overwritten within the backup rotation after 14 days at the latest. On request, we confirm the deletion in text form.

13. Agencies and reselling

If an agency uses Brand Dad to process data on behalf of its own clients (white label or reselling), the agency is the processor towards its clients and we are a further processor (sub-processor) of the agency. The agency ensures that it has concluded an agreement under Art. 28 GDPR with its clients that allows the use of Brand Dad and the sub-processors in Annex 2, and passes on its clients' instructions to us. The agency remains our point of contact.

14. Liability

Liability of the parties is governed by Art. 82 GDPR. Otherwise, the liability provisions of the main contract (Terms of Service section 15) apply unless Art. 82 GDPR mandatorily provides otherwise.

15. Conclusion, form and final provisions

This agreement becomes part of the main contract as soon as the customer accepts the Terms of Service, which refer to this agreement, when registering or booking. The agreement is thus concluded in electronic form (Art. 28(9) GDPR); no signature is required. The customer can open, print or save this page as a PDF at any time. On request we send a copy by email.

In case of conflict, the provisions of this agreement take precedence over those of the main contract insofar as the protection of personal data is concerned. We announce changes to this agreement; the procedure follows the amendment clause of the Terms of Service (section 17), and section 7 of this agreement for sub-processors.

The law of the Federal Republic of Germany applies. The place of jurisdiction is Mönchengladbach, Germany, to the extent permitted. Should individual provisions be invalid, the validity of the remaining provisions remains unaffected. This agreement is available in German and English; the German version prevails.

How we process data as a controller ourselves (e.g. the customer's account data) is described in our Privacy Policy. Questions about this agreement: support@branddad.io.