Data Processing Agreement (DPA)

1. Parties and roles

The customer is the controller for personal data belonging to its own contacts and audience that it processes through the service (notably via the CRM and knowledge base).

TheFactory Labs acts as a processor for that data, on the customer's instructions.

For data relating to its own account and contract performance, TheFactory Labs acts as controller (see the privacy policy).

2. Subject matter, duration, and nature of processing

Subject matter: providing the HyperReach service, including generating reply suggestions, tracking the customer's audience relationships, and measuring outcomes.

Duration: for the duration of the contract between the customer and TheFactory Labs, and until data is deleted or exported upon account closure.

Nature: collection, storage, structuring and automated processing of personal data limited to the customer's contacts and audience interactions on X.

3. Documented instructions

TheFactory Labs processes customer data only on the customer's documented instructions, as expressed through its configuration and use of the service. TheFactory Labs will inform the customer if an instruction appears to infringe the GDPR.

4. Confidentiality

Personnel authorized to process customer data are bound by confidentiality obligations.

5. Security

Encryption of sensitive data at rest and in transit, including API keys and access tokens (stored in an encrypted vault).

Strict data isolation between customers at the database level (Row Level Security, enforced per tenant).

6. Subprocessors

TheFactory Labs' list of subprocessors is published on the dedicated subprocessors page: gethyperreach.com/legal/subprocessors. Any significant addition or replacement will be notified to the customer before it takes effect, allowing the customer to object on legitimate grounds.

7. Assistance to the customer

TheFactory Labs assists the customer with data subject requests (access, rectification, erasure, portability), as well as with impact assessments and prior consultation with the supervisory authority where required.

8. Data breach notification

TheFactory Labs notifies the customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf.

9. Deletion and return at end of contract

Upon account closure, the customer can export their data directly from the application. Data is then deleted, subject to applicable legal retention obligations.

10. Audits

Upon reasonable request, and no more than once a year, TheFactory Labs will make available to the customer the information necessary to demonstrate compliance with the obligations set out in this agreement.

11. Transfers outside the European Union

Where a subprocessor is located outside the European Union, the transfer is governed by Standard Contractual Clauses (SCCs), as detailed on the subprocessors page.