Data Processing Agreement

You are the Controller and we are the Processor of the “Customer Personal Data” — the end-customer message content and identifiers processed through your connected channels. You are responsible for the lawfulness of your instructions and for having a valid basis (including any required consent) to message your customers.

• Subject matter: providing the HyperDM Service.
• Duration: the term of your subscription plus deletion periods below.
• Nature & purpose: receiving inbound messages; generating and sending replies; storing conversations and consent state; analytics for you.
• Data types: message content, platform-scoped identifiers, usernames/profile images, opt-in/opt-out state.
• Data subjects: your end-customers who message your connected accounts.

• Process Customer Personal Data only on your documented instructions (including via the Service’s settings), unless legally required otherwise.
• Ensure personnel are bound by confidentiality.
• Implement the security measures in §6 (Art. 32).
• Assist you, taking account of the nature of processing, with data-subject requests and with your obligations under Art. 32–36 (security, breach notification, DPIAs).
• Not sell Customer Personal Data and not use it for our own purposes or to train third-party foundation models.

You authorize us to engage the sub-processors below. We impose data-protection terms on each and remain responsible for their performance. We will give notice of new sub-processors and a reasonable opportunity to object.

Where we transfer Customer Personal Data outside the UK/EEA, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated by reference and available on request.

• Encryption in transit (TLS) and encryption of stored channel access tokens.
• Strict tenant isolation via database row-level security and an application scoping layer.
• Signed-webhook verification, least-privilege access, and audit logging of sends and policy checks.
• Ongoing monitoring and access controls appropriate to the risk.

We will promptly notify you of a data-subject request we receive relating to your data and assist you in responding. We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and provide the information you reasonably need to meet your notification obligations.

On termination or your instruction, we will delete or return Customer Personal Data and delete existing copies within a commercially reasonable period, except where retention is legally required. You may also delete data during the term via the Service.

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits (including via third-party reports or a questionnaire) on reasonable notice, subject to confidentiality.

Data-protection contact: hello@hyperdm.app — Anthony Casauria (sole trader), St Helena, Victoria 3088 (full registered address available on request), Victoria, Australia.