Data Processing Addendum

1. Subject Matter

The Processor provides social media monitoring, AI comment generation, and sentiment analysis services involving Personal Data.

2. Duration

Processing occurs for the duration of the Services unless otherwise required by law.

3. Nature and Purpose

• Collection and analysis of social media data
• AI-driven sentiment classification
• Analytics and reporting

4. Types of Personal Data

• Public social media identifiers
• Content metadata
• Account information
• Usage data

5. Categories of Data Subjects

• Controller's employees
• Social media users (public data only)

6. Processor Obligations

Processor shall:

• Process data only on documented instructions
• Ensure confidentiality
• Implement appropriate security measures (Art. 32)
• Assist with data subject requests
• Notify Controller of data breaches without undue delay

7. Subprocessors

Processor may engage subprocessors and shall:

• Maintain a list upon request
• Ensure equivalent data protection obligations
• Remain liable for subprocessors' performance

8. International Transfers

Transfers outside the EEA rely on:

• Standard Contractual Clauses (SCCs)
• Supplementary safeguards as required

9. Data Subject Rights

Processor shall assist Controller in fulfilling GDPR obligations related to:

10. Security

Processor maintains administrative, technical, and physical safeguards appropriate to risk.

11. Audits

Upon reasonable notice, Controller may audit Processor's compliance, subject to confidentiality and security restrictions.

12. Deletion or Return

Upon termination, Processor shall delete or return Personal Data unless legally required to retain it.

13. Governing Law

This DPA is governed by the laws of the State of California, subject to GDPR requirements.