Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Agreement”) between SyncingBeam (“SyncingBeam”, “we”) and the Customer. It governs our processing of personal data on the Customer’s behalf when the Customer uses the SyncingBeam service. “GDPR”, “controller”, “processor”, “personal data”, “data subject”, and “personal data breach” have the meanings given in Regulation (EU) 2016/679.

1. Parties and roles

For the marketing analytics data processed through the service, the roles follow the agency model the service is built for:

• Where the connected accounts belong to the Customer’s own business, the Customer is the controller and SyncingBeam is its processor.
• Where the Customer is an agency connecting accounts of its clients, the end client is the controller, the Customer acts as that client’s processor (and warrants its authority under Section 2 of the Agreement), and SyncingBeam acts as the Customer’s subprocessor. In that case this DPA applies to us as the GDPR Article 28(4) subprocessor contract, and references to the Customer’s “instructions” include the instructions the Customer is required to pass through from its controller.
• Google (and any other connected platform) is not our subprocessor: it is a separate recipient/provider authorized directly by the OAuth grant of the account holder, outside our processing chain.
• For account data — the names, email addresses, and login records of the Customer’s own users — SyncingBeam is an independent controller; that processing is described in the Privacy Policy, not this DPA.

2. Order of precedence

For the processing of personal data, this DPA controls over the Terms of Service: if this DPA and the Agreement conflict with respect to personal data, this DPA prevails, and where the Standard Contractual Clauses in Section 12 apply, those Clauses prevail over both.

3. Details of processing

4. Processing on documented instructions

We process personal data only on the Customer’s documented instructions — which are: this DPA, the Agreement, and the Customer’s configuration of the service (which accounts to connect, which features to enable, which reports to generate) — including with regard to international transfers, unless EU or Member State law requires otherwise, in which case we will inform the Customer before processing unless that law forbids it. We will inform the Customer if, in our opinion, an instruction infringes the GDPR.

5. Confidentiality

We ensure that every person we authorize to process personal data is bound by a contractual or statutory duty of confidentiality, and that access is limited to what each person needs to provide the service.

6. Security

We implement and maintain appropriate technical and organizational measures under GDPR Article 32, including: encryption of data in transit (TLS) and at rest; OAuth-based platform access using the narrowest available scopes and application-level reporting-only use where a provider offers no read-only scope, with tokens stored encrypted and never exposed to the browser; tenant isolation with row-level access controls; least-privilege, logged administrative access; network-level isolation of the production environment; backups; and secure development practice. A current summary is published on the Security & Google data page. We may improve these measures over time but will not materially reduce the overall level of protection during the term.

7. Subprocessors

The Customer gives general authorization for us to engage subprocessors to provide the service. The current list — name, function, and location of each — is published at syncingbeam.app/subprocessors and kept current as a binding obligation under this DPA. We will give the Customer advance notice of any intended addition or replacement via an update to this page, with material changes emailed to affected customers, at least 15 days before the change takes effect. The Customer may object on reasonable data-protection grounds within that period; if we cannot address the objection, the Customer may terminate the affected service with a pro-rata refund of prepaid unused fees. We impose data-protection obligations on each subprocessor equivalent to those in this DPA and remain fully liable to the Customer for each subprocessor’s performance.

Platforms the Customer connects as sources (for example Google and HubSpot) and destinations the Customer nominates (for example a Slack workspace, where the Customer supplies the incoming webhook and Slack delivery is configured) are not our subprocessors: the Customer authorizes them directly and they handle the data under the Customer’s own agreements with them. Where such a destination is configured, we transmit the report or brief content to it on the Customer’s instruction. The subprocessor list identifies which providers fall on which side of this line.

8. Assistance

Taking into account the nature of the processing, we will assist the Customer with appropriate technical and organizational measures in responding to data subject requests (GDPR Chapter III), and will assist the Customer — and, through the Customer, its controller — with its obligations under GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments, and prior consultation), in each case with the information available to us. If a data subject contacts us directly about data we process under this DPA, we will forward the request to the Customer without undue delay and will not respond on the merits except on the Customer’s instruction or where law requires.

9. Personal data breach

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA, to the Customer’s account email address. The notification will describe, to the extent then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point ([email protected]), and we will supplement it as further information becomes available. We will reasonably cooperate with the Customer’s own notification obligations.

10. Deletion and return

During the term, the Customer may at any time instruct us to disconnect a connected account and delete the data derived from it, and we will do so. Authorized administrators can disconnect supported connectors in the application. Workspace owners can request data return or deletion, and use the available workspace deletion control. Disconnecting stops future collection; it does not by itself erase retained reports or remove data from the original provider. For a verified privacy request, contact [email protected]. We confirm completion and explain any retained records or outstanding processor actions. Backup copies expire through the backup rotation. Feature-specific retention jobs do not replace a verified request to return or delete the complete account data. The timings in this Section apply regardless of whether a control or an operator performs the work.

On termination of the Agreement, at the Customer’s choice we will delete or return all personal data processed under this DPA and delete existing copies within 30 days, except where EU or Member State law requires longer storage — in which case we protect the retained data under this DPA and delete it when the requirement ends. Retention periods: Analytics aggregates and generated reports are retained for the life of the customer relationship, and deleted within 30 days of account termination or of a verified deletion request

11. Audits

We will make available to the Customer the information reasonably necessary to demonstrate compliance with GDPR Article 28 — including this DPA, the subprocessor list, and our security documentation — and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. Audits beyond document review require 30 days’ notice, occur at most once per year unless a supervisory authority requires more or a breach has occurred, run during business hours under confidentiality, must not endanger other customers’ data, and are at the Customer’s expense.

12. International transfers

We store personal data in the European Economic Area by default. Where providing the service involves transferring personal data protected by the GDPR to a country without an adequacy decision (including through the subprocessors listed at /subprocessors), the parties incorporate by reference the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, which apply as follows: Module Two (controller → processor) where the Customer acts as controller and Module Three (processor → processor) where the Customer acts as processor for its clients; the optional docking clause (Clause 7) applies; option 2 of Clause 9(a) (general authorization) applies with the notice period in Section 7; the optional redress language in Clause 11 does not apply; the governing law and forum of the Clauses (Clauses 17 and 18) are those of an EU Member State consistent with the Agreement’s key terms; and the annexes are completed by the processing details in Section 3, the security measures in Section 6, and the subprocessor list. If the Clauses and this DPA conflict, the Clauses prevail. If a transfer mechanism we rely on is invalidated, we will cooperate in good faith to put a lawful alternative in place.

13. Term and general

This DPA takes effect on 14 September 2026, or on the effective date of the Agreement if later, and lasts as long as we process personal data under it. Liability under this DPA is subject to the limitations in the Agreement to the extent permitted by applicable data protection law, which no part of this DPA limits where it may not. Questions and privacy contacts: [email protected].