RevenueIQ · Social Reign Media, LLC
Data Processing Agreement
This Data Processing Agreement (“DPA”) is entered into between the Customer accepting the Terms of Service (“Customer,” “Controller,” or “Business”) and Social Reign Media, LLC, a Nevada limited liability company (“Social Reign Media,” “Processor,” or “Service Provider”), and supplements the RevenueIQ Terms of Service (“Terms”) between the parties. This DPA reflects the parties' agreement with respect to the processing of personal data in connection with the RevenueIQ Service.
Capitalized terms not defined in this DPA have the meanings given to them in the Terms or the Privacy Policy. In the event of a conflict between this DPA and the Terms with respect to data protection matters, this DPA controls.
1. Definitions
1.1 “Personal Data” means any information relating to an identified or identifiable natural person that is processed by Social Reign Media on behalf of Customer as part of Customer Data in connection with the Service, including information about Customer's own end users, customers, or website visitors.
1.2 “Data Protection Laws” means all applicable laws and regulations governing the processing of Personal Data, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), Nevada's online privacy law (NRS 603A), and other applicable U.S. state privacy laws.
1.3 “Controller,” “Processor,” “Service Provider,” “Business,” “Sell,” “Share,” and “Process” (and variations thereof) have the meanings given in applicable Data Protection Laws, with “Controller”/“Business” referring to Customer and “Processor”/“Service Provider” referring to Social Reign Media, unless context requires otherwise.
1.4 “Subprocessor” means any third party engaged by Social Reign Media to process Personal Data on Social Reign Media's behalf in order to provide the Service.
1.5 “Security Incident” means any confirmed unauthorized access to, or acquisition, disclosure, or loss of, Personal Data processed by Social Reign Media.
2. Roles of the Parties
2.1 As between the parties, Customer is the Controller (or Business) of the Personal Data contained within Customer Data, and determines the purposes and means of processing that data.
2.2 Social Reign Media is a Processor (or Service Provider) acting only on behalf of, and under the documented instructions of, Customer, for the purpose of providing the Service as described in the Terms.
2.3 Social Reign Media will not: (a) Sell or Share Personal Data, as those terms are defined under applicable Data Protection Laws; (b) retain, use, or disclose Personal Data for any purpose other than providing the Service, unless required by law; or (c) combine Personal Data received from Customer with personal data received from other sources, except to the extent permitted by applicable Data Protection Laws for the purpose of improving or maintaining the Service (e.g., through aggregated, de-identified analysis as described in the Terms and Privacy Policy).
3. Customer Instructions
3.1 Social Reign Media will process Personal Data only in accordance with Customer's documented instructions, which are set out in the Terms, this DPA, and Customer's configuration of the Service (including connected integrations), unless otherwise required by applicable law.
3.2 If Social Reign Media believes an instruction from Customer violates applicable Data Protection Laws, it will promptly inform Customer.
4. Nature and Purpose of Processing
4.1 Subject Matter. Provision of the RevenueIQ predictive analytics Service.
4.2 Duration. For the term of the Terms, plus the data retention/export period described in the Privacy Policy.
4.3 Nature and Purpose. Ingestion, storage, and analysis of Customer's behavioral, transactional, and operational data to generate demand forecasts, churn predictions, conversion scores, expansion/upsell recommendations, and related Insights and alerts.
4.4 Categories of Data Subjects. Customer's end users, customers, or website/product visitors whose activity is reflected in Customer Data.
4.5 Categories of Personal Data. May include: identifiers (e.g., email address, customer ID, device/cookie identifiers); commercial information (e.g., purchase history, subscription status); usage and behavioral data (e.g., product/website interaction events); and other categories Customer elects to connect via integrations. Customer should not connect sensitive categories of personal data (e.g., government identifiers, health data, financial account numbers, precise geolocation of individuals) unless separately agreed in writing, as the Service is not designed to process such categories.
5. Subprocessors
5.1 General Authorization. Customer provides general authorization for Social Reign Media to engage Subprocessors to support delivery of the Service (e.g., cloud infrastructure, payment processing, customer support, and model-hosting providers).
5.2 Subprocessor List. Social Reign Media will maintain a current list of its Subprocessors and will make it available to Customer upon request at contact@socialreignmedia.com.
5.3 Notice of Changes. Social Reign Media will provide Customer with notice of any new Subprocessor (such as by email or an in-product notice) at least ten (10) days before granting the new Subprocessor access to Personal Data. Customer may object on reasonable data-protection grounds within that period by contacting contact@socialreignmedia.com; the parties will work in good faith to resolve the objection, which may include Social Reign Media not using that Subprocessor for Customer's data or, if no resolution is reached, Customer terminating the affected portion of the Service as its sole remedy.
5.4 Subprocessor Obligations. Social Reign Media will impose data protection obligations on each Subprocessor that are substantially consistent with those in this DPA, and will remain liable to Customer for each Subprocessor's performance of those obligations.
6. Security Measures
6.1 Social Reign Media will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including (as applicable): encryption of data in transit and at rest, access controls and authentication requirements, network security monitoring, and periodic review of security practices.
6.2 Social Reign Media personnel authorized to process Personal Data are subject to confidentiality obligations.
7. Security Incident Notification
7.1 Social Reign Media will notify Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any Security Incident affecting Customer's Personal Data.
7.2 Notification will include, to the extent then known: the nature of the incident, categories and approximate volume of Personal Data affected, likely consequences, and measures taken or proposed to address the incident.
7.3 Social Reign Media will reasonably cooperate with Customer's investigation of, and response to, any Security Incident, including providing information reasonably requested to allow Customer to meet any notification obligations to affected individuals or regulators under applicable Data Protection Laws.
7.4 Notification of a Security Incident is not an acknowledgment of fault or liability by Social Reign Media.
8. Assistance to Customer
8.1 Data Subject Requests. Taking into account the nature of the processing, Social Reign Media will provide reasonable assistance to Customer, by appropriate technical and organizational measures, to enable Customer to respond to requests from data subjects to exercise their rights under applicable Data Protection Laws (e.g., access, correction, deletion). Where Social Reign Media receives such a request directly from a data subject regarding Customer's Personal Data, it will promptly direct the data subject to Customer and notify Customer of the request.
8.2 Data Protection Impact Assessments. Social Reign Media will provide reasonable assistance to Customer in connection with any data protection impact assessment or prior consultation with a regulator that Customer reasonably determines is required under applicable Data Protection Laws, to the extent such information is reasonably available to Social Reign Media and not otherwise available to Customer.
9. Return or Deletion of Data
Upon termination or expiration of the Terms, and subject to the export/retention window described in the Privacy Policy, Social Reign Media will, at Customer's election, make Customer Data available for export or delete it from Social Reign Media's active production systems, except to the extent applicable law requires retention, or Personal Data remains in encrypted backups pending routine, scheduled deletion.
10. Audits
10.1 Social Reign Media will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, which may include relevant security certifications, summaries of independent audit reports, or completed security questionnaires, upon reasonable written request no more than once per twelve-month period.
10.2 If such information is insufficient to demonstrate compliance, and Customer has a good-faith, documented reason for an audit (including a request from a regulator), Social Reign Media will permit Customer, or an independent third-party auditor bound by confidentiality, to conduct an audit of Social Reign Media's relevant policies and procedures, subject to reasonable advance notice (at least thirty (30) days), during business hours, no more than once per twelve-month period unless required by a regulator or following a Security Incident, and subject to reasonable confidentiality protections. Customer bears the cost of any such audit unless it identifies a material non-compliance, in which case Social Reign Media bears its reasonable costs of remediation.
11. International Transfers
Personal Data processed under this DPA is processed and stored in the United States. Social Reign Media does not intentionally transfer Personal Data outside the United States except as may occur through a Subprocessor's infrastructure; where such transfers occur, Social Reign Media will ensure appropriate safeguards consistent with applicable Data Protection Laws.
12. Liability
Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms. Nothing in this DPA relieves either party of any obligations, liabilities, or rights under the Terms.
13. Term and Termination
This DPA is effective as of the date Customer accepts the Terms (or the Effective Date above, whichever is later) and will remain in effect for as long as Social Reign Media processes Personal Data on behalf of Customer under the Terms.
14. Governing Law
This DPA is governed by the laws of the State of Nevada, without regard to its conflict-of-laws principles, consistent with the Governing Law provision of the Terms.
15. Order of Precedence
In the event of a conflict between the terms of this DPA and the Terms, this DPA governs solely with respect to the parties' data protection obligations regarding Personal Data. In all other respects, the Terms remain in full force and effect.
Questions regarding this DPA, security practices, or the current Subprocessor list can be directed to contact@socialreignmedia.com. Customers who require a countersigned copy for their own records can request one at the same address.
Social Reign Media, LLC
Email: contact@socialreignmedia.com
Website: socialreignmedia.com
This document is a template for general informational purposes and does not constitute legal advice.