Data Processing Agreement

1.Parties and scope

This agreement is between the customer (controller) and BeHeard (processor) and applies to personal data processed in the BeHeard service on the customer’s behalf.

2.Details of processing

Subject matter

Providing the BeHeard marketing platform.

Data subjects

Customer users, the customer’s customers and audiences, and people who interact with the customer’s social accounts.

Data categories

Contact details, messages and comments, order data, ad and engagement metrics, content.

Duration

The term of the subscription plus the 30-day deletion grace period.

3.Processor obligations

• Process personal data only on documented instructions from the customer.
• Ensure staff with access are bound by confidentiality.
• Apply appropriate technical and organisational security measures.
• Assist the customer with data subject requests and impact assessments.
• Delete or return personal data at the end of the service.

4.Sub-processors

The customer authorises the sub-processors listed in the Privacy policy. BeHeard will give notice of new sub-processors and the customer may object on reasonable grounds.

5.Security measures

Encryption in transit and at rest for tokens, role-based access, two-factor authentication, audit logging, tenant isolation tests, backups with tested restores, and monitoring.

6.Personal data breaches

BeHeard notifies the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach, with the information needed to meet the customer’s own notification duties.

7.International transfers

Where personal data leaves its country of origin, the parties rely on the safeguards required by applicable law, such as standard contractual clauses.

8.Audits and signature

BeHeard makes available information needed to show compliance and allows reasonable audits. Signature blocks for both parties are added to the signed version.