Data Processing Agreement

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Process and Supervisory Authority have the meanings given in applicable data protection law. Applicable data protection law includes the UK GDPR, the Data Protection Act 2018, and, where relevant, the EU GDPR and member state law.

Content Swarm will process Customer Personal Data only to provide the LinkedIn engagement and content coordination software, Chrome extension, support, security, and related services described in the agreement, and on the customer's documented instructions. This DPA and use of the service are documented instructions.

If law requires other processing, Content Swarm will tell the customer before processing unless the law prohibits notice. Content Swarm will promptly tell the customer if, in its opinion, an instruction infringes applicable data protection law.

Content Swarm will ensure that people authorised to process Customer Personal Data are bound by confidentiality duties and receive access only where needed for their role.

Content Swarm will maintain appropriate technical and organisational measures taking account of the nature, scope, context, and purpose of processing and the risks to Data Subjects. Measures will address confidentiality, integrity, availability, resilience, restoration, and regular review as required by Article 32 of the UK GDPR and EU GDPR.

Current code evidence includes HTTPS service endpoints, secure and HttpOnly session cookies, CSRF controls, access controls, application logging, and error monitoring. This is not a complete security schedule.

The inspected materials do not provide a complete controls schedule covering access review, encryption at rest, key management, backups, recovery testing, vulnerability management, incident response, and staff controls.

The customer gives general authorisation for Content Swarm to use the subprocessors on the live Subprocessor Information page. Content Swarm will impose data protection terms on each subprocessor that protect Customer Personal Data to the standard required by applicable law. Content Swarm remains responsible for a subprocessor's performance of its data protection duties.

This DPA does not set a fixed notice or objection period for new or replacement subprocessors.

Taking account of the nature of processing, Content Swarm will provide reasonable technical and organisational assistance so the customer can answer requests to exercise Data Subject rights. If Content Swarm receives a request relating to Customer Personal Data, it will direct the requester to the customer unless authorised to respond.

Content Swarm will provide reasonable assistance with security, breach notifications, data protection impact assessments, and prior consultation with a Supervisory Authority, taking account of the nature of processing and information available to Content Swarm.

Content Swarm will notify the customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. It will provide available details needed for the customer's notification duties and will take reasonable steps to contain, investigate, and remediate the breach.

Content Swarm will not transfer Customer Personal Data outside the United Kingdom or European Economic Area without a lawful transfer mechanism. Where required, the parties incorporate the European Commission Standard Contractual Clauses, Module Two, for controller-to-processor transfers. For UK restricted transfers, the UK International Data Transfer Addendum to the EU clauses or the UK International Data Transfer Agreement will apply, as appropriate. The applicable clauses prevail over conflicting terms in this DPA.

Provider-specific processing locations and transfer safeguards are listed where available on the subprocessor page. Some are not documented in the inspected materials.

Content Swarm will provide information reasonably needed to demonstrate compliance with this DPA. On reasonable prior notice, it will allow one audit per year by the customer or an independent auditor, with additional audits after a material incident or where a Supervisory Authority requires one. Audits must protect other customers, security, and confidential information and should first use available reports and written evidence.

At the end of the services, Content Swarm will, at the customer's choice, return or delete Customer Personal Data and existing copies, unless applicable law requires retention. Data in backups will be put beyond ordinary use and deleted in line with the backup cycle. The live Retention and Deletion page describes the current schedule and open operational periods.

The inspected materials do not state a fixed production deletion window, export format, backup cycle, or complete legal-retention schedule.

If this DPA conflicts with the customer agreement on processing Customer Personal Data, this DPA prevails. The mandatory transfer clauses prevail over both. Notices about this DPA should be sent to support@contentswarm.io and to the customer contact in the agreement.