This Data Processing Agreement ("DPA") forms part of the agreement between Echofy and a customer where Echofy processes personal data on behalf of that customer in circumstances governed by Article 28 of Regulation (EU) 2016/679 (GDPR).
1. Parties
Processor:
Echofy, operated by:
[LEGAL OPERATOR NAME]
[REGISTERED CORRESPONDENCE ADDRESS]
Poland
Email: hello@echofy.live
Controller:
The customer identified in the applicable service agreement, subscription record, or separately executed agreement.
This DPA applies only where the customer acts as a Data Controller and Echofy acts as a Data Processor in relation to the relevant personal data.
It does not automatically apply to processing for which Echofy independently determines the purposes and means.
2. Subject Matter and Duration
The subject matter of this DPA is the processing of personal data necessary to provide the applicable Echofy services.
Processing will continue for the duration of the relevant service relationship, subject to applicable deletion, retention, and legal requirements.
The specific nature, purpose, and categories of processing are described in Annex I.
3. Documented Instructions
Echofy shall process personal data only on documented instructions from the Controller, unless otherwise required by applicable law.
The applicable service agreement, authorized use of platform functionality, and other written instructions accepted by Echofy may constitute documented instructions.
Where legally permitted, Echofy shall inform the Controller if it is required by law to process personal data outside those instructions.
Echofy shall promptly inform the Controller if, in its opinion, an instruction infringes applicable data protection law.
4. Confidentiality
Echofy shall ensure that persons authorized to process personal data are subject to appropriate confidentiality obligations.
Access to personal data shall be limited to individuals who require such access for legitimate service-related purposes.
5. Security of Processing
Echofy shall implement appropriate technical and organizational measures as required by Article 32 of the GDPR, taking into account the nature, scope, context, and purposes of processing and the risks to individuals.
The agreed security measures must be documented in Annex II before this DPA is executed.
Echofy shall not represent that a particular certification, encryption standard, backup procedure, or security control is implemented unless that measure has been verified.
6. Subprocessors
The Controller authorizes Echofy to engage subprocessors identified in the agreed Subprocessor Schedule.
Echofy shall impose appropriate contractual data protection obligations on subprocessors, as required by applicable law.
Where general authorization is used, Echofy shall provide advance notice of intended additions or replacements and give the Controller an opportunity to object on reasonable data protection grounds.
Echofy remains responsible to the Controller for the performance of its subprocessors' applicable data protection obligations.
The initial Subprocessor Schedule must be completed and verified before this DPA is executed.
7. Assistance With Data Subject Rights
Taking into account the nature of the processing, Echofy shall provide reasonable assistance to enable the Controller to respond to requests concerning:
- Access.
- Rectification.
- Erasure.
- Restriction of processing.
- Data portability.
- Objection.
- Other applicable rights under data protection law.
Where Echofy receives a request relating to personal data processed solely on behalf of the Controller, it shall refer the request to the Controller unless otherwise required by law.
8. Personal Data Breaches
Echofy shall notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed on the Controller's behalf.
The notification shall include available information reasonably necessary for the Controller to assess its obligations under applicable data protection law.
Echofy shall provide reasonable assistance with breach investigation, mitigation, and legally required notifications.
9. Data Protection Impact Assessments
Taking into account the nature of processing and the information available to Echofy, Echofy shall provide reasonable assistance with Data Protection Impact Assessments and prior consultations with supervisory authorities where required by Articles 35 and 36 of the GDPR.
10. International Transfers
Personal data shall not be transferred outside the European Economic Area in violation of applicable data protection law.
Where an international transfer requires additional safeguards, the parties shall establish an appropriate lawful transfer mechanism before the relevant transfer takes place.
This may include an applicable adequacy decision or approved Standard Contractual Clauses, together with supplementary measures where required.
The parties shall verify the actual processing locations and transfer arrangements of relevant providers.
11. Return and Deletion of Data
Upon termination of the applicable services, Echofy shall, at the Controller's choice, delete or return personal data processed on the Controller's behalf, unless applicable law requires continued storage.
The method and timing of deletion or return shall be agreed in light of the service's technical capabilities and applicable legal obligations.
Echofy's general account deletion target is approximately seven business days following verification of a valid request. This target does not override legally required retention or independently applicable backup deletion procedures.
12. Demonstration of Compliance and Audits
Echofy shall make available information reasonably necessary to demonstrate compliance with its obligations under Article 28 of the GDPR.
Echofy shall allow for and contribute to audits and inspections as required by applicable law, subject to reasonable confidentiality, security, scheduling, and operational arrangements.
Any alternative audit procedure must preserve the Controller's mandatory rights under applicable law.
13. Use of Data for AI Training
Echofy shall not independently use personal data processed on behalf of the Controller to train or develop general-purpose AI models.
Echofy shall establish appropriate contractual restrictions with relevant subprocessors before representing that this protection extends to their processing activities.
Processing necessary to provide AI-supported functionality requested by the Controller remains subject to this DPA and the applicable documented instructions.
14. Order of Precedence
In the event of a conflict between this DPA and the general Terms of Service concerning personal data processing governed by Article 28 of the GDPR, this DPA shall prevail to the extent of that conflict.
Nothing in this DPA limits mandatory rights or obligations under applicable data protection law.
15. Governing Law
This DPA shall be governed by Polish law, subject to the directly applicable provisions of the GDPR and other mandatory data protection legislation.
ANNEX I — DESCRIPTION OF PROCESSING
Subject Matter: Provision of Echofy's brand monitoring, reporting, and related services, to the extent that personal data is processed on behalf of the Controller.
Duration: The applicable service relationship and any lawful retention period.
Nature of Processing: Receipt, storage, organization, retrieval, analysis, generation of reports, deletion, and other operations necessary for the requested service.
Purpose: Delivery of the functionality requested by the Controller.
Categories of Data Subjects: [TO BE VERIFIED BASED ON ACTUAL CUSTOMER USE]
Categories of Personal Data: [TO BE VERIFIED — DO NOT ASSUME THAT PUBLIC SOCIAL MEDIA DATA IS NON-PERSONAL]
Special Categories of Personal Data: Not intentionally requested as part of the standard service. Any actual processing must be separately assessed.
Controller Instructions: The applicable service agreement and documented instructions.
ANNEX II — TECHNICAL AND ORGANIZATIONAL MEASURES
The following information must be verified and completed before execution:
- Hosting and infrastructure security.
- Encryption in transit and at rest.
- Authentication and access controls.
- Administrative access restrictions.
- Backup and recovery procedures.
- Logging and monitoring.
- Vulnerability management.
- Incident response procedures.
- Data retention and deletion controls.
- Subprocessor security arrangements.
No unverified technical measure shall be deemed contractually guaranteed.
ANNEX III — SUBPROCESSOR SCHEDULE
The following providers require assessment to determine their actual contractual roles and whether they process personal data on behalf of Echofy:
| Provider | Relevant Function | Status |
|---|---|---|
| Base44 | Application infrastructure and integrated functionality | Role and processing terms to verify |
| Tavily | Search functionality | Role and data flows to verify |
| Xpoz | Social data functionality | Role and data flows to verify |
| Other underlying AI providers | AI-supported processing, if applicable | Identity and role to verify |
Stripe, Google, and analytics providers must be separately assessed according to their actual processing activities and contractual roles. They should not automatically be classified as subprocessors for all processing operations.
For each confirmed subprocessor, the final schedule must specify:
- Legal entity.
- Processing purpose.
- Categories of personal data.
- Processing location.
- Applicable transfer mechanism.
- Contractual safeguards.
ANNEX IV — EXECUTION
For Echofy
Legal Name: [LEGAL OPERATOR NAME]
Authorized Representative: [NAME]
Date: [DATE]
For the Controller
Legal Name: [CUSTOMER LEGAL NAME]
Authorized Representative: [NAME]
Date: [DATE]
This DPA becomes binding only upon valid acceptance or execution by the relevant parties.