Introduction
This Data Processing Agreement (“DPA”) is between you, the customer, and Insightful Pipe, LLC (“Insightful Pipe,” “we,” “us”). It applies automatically when you use the Service. You do not need to sign it.
In this DPA, “customer personal data” means the personal data we process for you when you use the Service. “Service” has the meaning given in our Terms of Service (the “Terms”). Terms such as controller, processor, data subject and personal data breach have the meanings given in the GDPR.
1. Scope and Roles
This DPA applies when you use the Service to process personal data, for example data from connected platforms and uploaded files and content.
You are the controller of customer personal data, or a processor acting for your own clients. Insightful Pipe, LLC is the processor.
For account, billing and website data, we act as a controller under our Privacy Policy. Information about your workspace members' accounts and use of Insightful Pipe is account data, covered by our Privacy Policy.
This DPA forms part of the Terms.
2. Instructions
We process customer personal data only to provide the Service as described in the Terms and as you configure it, and on your other documented instructions. If the law requires us to process it in another way, we tell you, unless the law forbids us from doing so. We tell you immediately if we believe an instruction breaks data protection law.
3. Confidentiality
Everyone who processes customer personal data for us is bound by confidentiality.
4. Security
We take appropriate technical and organizational measures to protect customer personal data. Annex 2 lists them.
5. Subprocessors
You authorize us to use the subprocessors listed on our Subprocessors page.
We give at least 15 days' notice of a new or replaced subprocessor by updating our Subprocessors page and by emailing customers who have asked to be notified. You may object on reasonable data protection grounds within 10 days of the update. If we cannot resolve your objection, either party may end the affected Service.
We bind each subprocessor to data protection terms equivalent to this DPA, and we remain responsible for our subprocessors.
6. Assistance
As far as reasonable, given the nature of the processing, we help you:
- answer requests from data subjects who exercise their rights,
- carry out data protection impact assessments, and
- consult data protection authorities.
Help beyond the Service's standard features may be charged.
7. Personal Data Breaches
We notify you without undue delay after becoming aware of a personal data breach affecting customer personal data, and share details as they become available.
8. Deletion
When your account or workspace is deleted, by you or by us, or you ask us to delete it, we remove customer personal data within one month, or tell you if we need longer, except logs and backups, which are deleted on their regular schedule, data we must keep by law, and data in workspaces other people still own. If you ask before deletion, we will send you a copy of the customer personal data we store.
You can delete your account or workspace in Settings, or email [email protected].
9. Audits
We provide the documents reasonably needed to show that we comply with this DPA. If those are not enough, there are signs we are not complying, or a data protection authority requires it, you, or an auditor you appoint who is not our competitor, may audit us, and we will contribute to the audit. Audits happen at most once a year (unless there are signs we are not complying or a data protection authority requires one), on 30 days' notice, and whoever audits agrees to keep it confidential. Each party pays its own audit costs.
10. International Transfers
This section applies where customer personal data is transferred from the EEA, the UK or Switzerland to a country not covered by an adequacy decision, including to Insightful Pipe, LLC in the United States.
For those transfers, the EU Standard Contractual Clauses apply and are incorporated into this DPA by reference. Module 2 (controller to processor) applies, or Module 3 (processor to processor) where you are a processor.
For UK data, the UK Addendum to the Standard Contractual Clauses also applies. For Swiss data, the Standard Contractual Clauses apply with the adjustments required for Swiss data.
For the Standard Contractual Clauses: Clause 7 does not apply; under Clause 9, Option 2 (general authorisation) applies with the notice period in section 5; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by the law and courts of Ireland; the competent supervisory authority under Clause 13 is the one for the EEA country where you are established; and under the UK Addendum, neither party may end it under Table 4.
11. US State Privacy Laws
Where US state privacy laws apply, we act as your service provider or processor. We do not sell or share customer personal data, and we use it only to provide the Service.
12. Liability and Precedence
Liability under this DPA is subject to the limitations of liability in the Terms.
If this DPA conflicts with the Terms on data protection, this DPA prevails. The Standard Contractual Clauses prevail over both.
Annex 1: Details of Processing
- Subject matter and duration: providing the Service, for as long as your account exists, plus the deletion periods in section 8.
- Nature and purpose: connecting to your marketing platforms, reading and writing the data you request, storing uploaded media, scheduling and publishing posts, the AI features you use, and support.
- Data subjects: people whose data is in your connected platforms, such as audiences, followers, commenters and leads, people who appear in files and content you upload, and people you look up with our lead and enrichment tools.
- Categories of data: account identifiers, posts, comments, messages, and campaign and audience data from connected platforms; uploaded files and content; names, companies and email addresses you look up with our lead and enrichment tools.
- Special categories of data: none intended.
Annex 2: Security Measures
- Data in transit is encrypted with TLS.
- Connected-account credentials are encrypted at rest.
- Access is limited to authorized personnel.
- Customer personal data is hosted with the providers listed on our Subprocessors page.
- Backups.
- Monitoring and logging.
Contact
Insightful Pipe, LLC
Address: 1111B S Governors Ave, STE 39835, Dover, DE 19904, USA
Email: [email protected]