Data processing addendum

This addendum ("DPA") forms part of the terms of service between Ascend Group Media, trading as Suggestible (suggestible.ai), of 7 Main Road, Heathfield, Cape Town, 7945, South Africa ("we", the processor) and the customer that holds a Suggestible account ("you", the controller). It applies where we process personal information on your behalf, and meets Article 28 of the UK GDPR and the EU GDPR and sections 20 and 21 of South Africa's POPIA (where we are your "operator" and you are the "responsible party"). It is written mainly for agencies, but applies to every customer.

1. The processing

2. Your instructions

We process personal information only on your documented instructions: these terms, this DPA and your use of Suggestible's settings. Your instructions include creating anonymous, aggregated statistics about how the service performs (terms of service, clause 16.6). If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process it otherwise, we will tell you first unless the law forbids it.

3. Our people

Everyone at Ascend Group Media who can access your personal information is bound by confidentiality and has access only as far as needed.

Our staff do not look at the content inside your account unless an owner switches on support access in the app (for a set time of up to 7 days, or until it is switched off), or we must investigate a security incident, abuse or a serious fault affecting the service, or the law requires it. Every support visit is time-limited, read only unless you ask otherwise, and recorded in a log. Where we look without your switch, we tell you afterwards unless the law forbids it (terms of service, clause 17).

4. Security

We keep appropriate technical and organisational measures in place. At launch they include the following; some apply once the feature they protect (such as sign-up, client viewers or the Google connection) is available:

• encryption in transit, and encryption at rest of Google refresh tokens (AES-256-GCM);
• separation of each account's data, with automated tests that check one account cannot read another's;
• two-factor sign-in for every user, roles inside each account, and client viewers limited to the clients you assign;
• rate limits and bot checks on sign-up and sign-in;
• read-only access to Google data, with tokens never written to logs or sent to the browser;
• hosting and database in London, United Kingdom, with the provider's backups.

5. Sub-processors

You authorise the sub-processors on our sub-processors page. We bind each one by contract to data protection terms no less protective than this DPA, and we remain responsible for them. We will give account owners at least 30 days' notice of a new sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may end the affected service and we will refund any prepaid fees for the period after it ends.

6. Helping you

• We help you answer requests from people exercising their rights, through the app (including CSV export) and on request. If a request comes to us directly, we pass it to you.
• We help you with security, breach notifications, data protection impact assessments and consultations with regulators, as they relate to Suggestible.

7. Breaches

If we become aware of a personal data breach affecting your information, we will tell you without undue delay, with what we know and what we are doing, and keep you updated, so you can meet your own duty to notify regulators and people affected (72 hours under the UK and EU GDPR; as soon as reasonably possible under POPIA).

8. When the service ends

When your account ends, the owner can sign in and export your data for 30 days. We then delete or return the personal information we process for you within a further 60 days, and copies in our backups are overwritten within 35 days after that, unless the law requires us to keep it. We confirm in writing on request. Google tokens are revoked and deleted when the account closes.

9. Information and audits

We will make available the information you reasonably need to show that this DPA is met, and allow reasonable audits by you or an auditor you appoint, on reasonable notice, at your cost, no more than once a year unless a regulator requires it or after a breach.

10. International transfers

Where we or a sub-processor transfer personal information outside the UK, the EEA or South Africa, we use the safeguards the law requires: the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses (module two or three as fits), or, for South Africa, a binding agreement that gives protection substantially similar to POPIA. These are incorporated by reference where needed.

11. Priority

If this DPA and the terms of service disagree on personal information, this DPA wins.

12. Contact

Ascend Group Media, trading as Suggestible (suggestible.ai), of 7 Main Road, Heathfield, Cape Town, 7945, South Africa. Email: info@ascendgroupmedia.com.