Data Processing Agreement
Last updated: TODO: date it takes effect
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Customer”) and TODO: legal entity name (“Menzio”, the “Processor”), and applies when we process personal data on your behalf while providing the Service.
1. Roles
For personal data in Your Content (for example, your clients’ report recipients), you are the controller and we are the processor. For your own account and billing data we act as an independent controller, as described in the Privacy Policy.
2. Subject matter and details
- Purpose: providing the Service (tracking AI answers about brands, sending reports, running audits, the client portal).
- Duration: the term of your subscription, plus the deletion period in section 8.
- Data subjects: your team members, your clients’ contacts who receive reports, and people occasionally named in collected AI answers.
- Categories of data: names, business email addresses, job context, and any personal data contained in content you add.
- No special categories of data are needed or expected.
3. Our obligations
- Process personal data only on your documented instructions, which are these terms and your use of the Service.
- Make sure everyone with access is bound by confidentiality.
- Help you respond to data subject requests and with security, impact assessments and consultations, as reasonably needed.
- Tell you if we believe an instruction breaks data protection law.
4. Security
We apply appropriate technical and organizational measures, including encryption in transit, per-organization access controls in the database, access on a need-to-know basis, revocable random tokens for public report links, and salted hashing of IP addresses for rate limiting. TODO: complete list of security measures (annex)
5. Subprocessors
You authorize us to use the following categories of subprocessors. We impose data protection terms on each one that are at least as protective as this DPA, and we’ll notify you at least TODO: number of days before adding or replacing one, so you can object.
| Category | What it does | Provider and location |
|---|---|---|
| Hosting | Runs the website and the backend servers. | TODO: provider, country |
| Database and authentication | Stores account, brand and measurement data; handles sign-in. | TODO: provider, country |
| Payments | Processes subscriptions and invoices. We never see full card numbers. | TODO: provider, country |
| Email delivery | Sends sign-in links, reports, notifications and free-check results. | TODO: provider, country |
| AI providers | Suggest competitors and questions, extract mentions and write summaries from answers and public web pages. | TODO: provider, country |
| AI answer data provider | Submits the tracked questions to AI engines and search and returns their public answers. | TODO: provider, country |
6. International transfers
Where personal data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, we rely on the Standard Contractual Clauses or another valid transfer mechanism. TODO: confirm transfer mechanisms
7. Personal data breaches
We’ll notify you without undue delay, and in any case within TODO: number of hours of becoming aware of a breach affecting your personal data, with the information you need to meet your own obligations.
8. Deletion and return
When your subscription ends, you can export your data. We delete personal data processed for you within TODO: number of days, unless the law requires us to keep it.
9. Audits
We’ll make available the information reasonably needed to show compliance with this DPA, and allow audits by you or an auditor you appoint, with reasonable notice and at your cost, no more than once a year unless a breach makes it necessary.
10. Contact
TODO: data protection contact email
See also: Terms · Privacy · Cookies · Data Processing Agreement