Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Modash Terms of Service (the “Agreement”) entered into between Modash OÜ (“Modash”, “Processor”) and the customer entity agreeing to the Agreement (“Customer”, “Controller”).

By entering into the Agreement, Customer agrees to this DPA.

This DPA applies only to the extent that Modash processes Personal Data on behalf of Customer as a Processor under applicable Data Protection Laws.

1. Definitions

“Data Protection Laws” means the GDPR, UK GDPR, and any applicable data protection legislation.

“Personal Data”, “Controller”, “Processor”, “Data Subject”, and “Personal Data Breach” have the meanings given in the GDPR.

“Subprocessor” means any third party engaged by Modash to process Personal Data on behalf of Customer.

2. Scope and Roles

Customer acts as Controller.
Modash acts as Processor.

This DPA does not apply to processing activities for which Modash acts as an independent Controller, including but not limited to processing of publicly available creator data as describedin Modash’s Privacy Policy.

Modash shall process Personal Data:
‍
● Only on documented instructions from Customer (including as set forth in the Agreement);
● For the purpose of providing the Services;
● In accordance with Data Protection Laws.

3. Nature of Processing

Nature and Purpose
‍Modash provides influencer discovery, campaign management, analytics, outreach, and related services.

‍Categories of Data Subjects
‍May include Customer representatives, end users, influencers engaged by Customer, and campaign participants.

‍Categories of Personal Data
‍May include names, business contact information, account data, campaign data, communication data, and usage data submitted to or processed through the Services.

Modash does not intentionally process special category personal data on behalf of Customer.
Customer agrees not to upload or submit special category data unless explicitly agreed inwriting.

4. Security Measures

Modash implements appropriate technical and organizational measures designed to ensure alevel of security appropriate to the risk, including:

● Encryption of Personal Data in transit and at rest;
● Access controls based on least privilege principles;
● Strong authentication and identity management controls;
● Secure software development lifecycle practices;
● Regular vulnerability scanning and security testing;
● Backup and disaster recovery procedures;
● Incident response procedures with designated security personnel;
● Ongoing monitoring of system confidentiality, integrity, and availability.

Modash reviews and updates its security measures periodically.

5. Subprocessors

Customer authorizes Modash to engage Subprocessors listed at:
modash.io/legal/subprocessors

‍Modash shall:
‍
● Enter into written agreements with Subprocessors imposing data protection obligations no less protective than those in this DPA;
● Remain responsible for the performance of its Subprocessors;
● Update the Subprocessor list from time to time.

Modash will provide reasonable notice of material changes to Subprocessors via updates to theSubprocessor webpage. Customers may object to a new Subprocessor on reasonable dataprotection grounds.

6. International Transfers

Customer authorizes Modash to transfer Personal Data to Subprocessors located outside the EEA/UK, provided that appropriate safeguards are implemented in accordance with Article 46 GDPR.

Where required, Modash relies on:
‍
● The European Commission’s Standard Contractual Clauses (2021/914/EU);
● The UK International Data Transfer Addendum or other approved safeguards;
● Supplementary technical and organizational measures where appropriate.

7. Assistance to Customer

Taking into account the nature of processing, Modash shall provide reasonable assistance to Customer to enable compliance with Data Protection Laws, including:

● Assistance with responding to Data Subject rights requests;
● Providing information necessary to conduct Data Protection Impact Assessments where required;
● Assistance with supervisory authority consultations where applicable.

8. Personal Data Breaches

Modash shall notify Customer without undue delay and, where feasible, no later than 48 hoursafter becoming aware of a Personal Data Breach affecting Customer Personal Data.

Notification shall include, to the extent available:
‍
● A description of the nature of the breach;
● Categories and approximate number of affected Data Subjects and records;
● Likely consequences;
● Measures taken or proposed to address the breach.

9. Audit and Compliance

Upon reasonable request, Modash shall make available information necessary to demonstrate compliance with this DPA.

Where available, Modash may satisfy audit obligations by providing:
‍
● Relevant third-party audit reports (e.g., SOC 2);
● Security certifications;
● Security documentation.

On-site audits shall be permitted only where required by applicable Data Protection Laws andsubject to reasonable confidentiality and security safeguards.

10. Return and Deletion of Data

Upon termination of the Services, Customer may request export of Personal Data within thirty (30) days.

After such a period, Modash shall delete Personal Data unless retention is required by law.

11. Liability

Liability arising out of or in connection with this DPA shall be subject to the limitations and exclusions of liability set forth in the Agreement.

12. Governing Law

This DPA shall be governed by the governing law specified in the Agreement.

Modash Data Processing Agreement (DPA)