Data Processing Agreement

How this DPA applies

This DPA forms part of the Terms of Service and applies automatically whenever we process personal data on a customer's behalf; no separate signature is needed. If your organisation needs a signed copy for its records, email privacy@pulsepanels.com.

1. Scope and roles

This DPA applies where PulsePanels processes personal data contained in customer content or account data on behalf of the customer in connection with the services. For such data, the customer is the controller (or a processor acting for a third-party controller) and PulsePanels is the processor. This DPA forms part of, and is subject to, the Terms of Service or master agreement between the parties.

2. Processing instructions

PulsePanels will process customer personal data only on the customer's documented instructions, including as set out in this DPA and the agreement, and as necessary to provide the services — unless required to do otherwise by applicable law, in which case we will inform the customer where legally permitted.

The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are described in the Annexes.

3. Confidentiality

PulsePanels ensures that personnel authorised to process customer personal data are bound by appropriate confidentiality obligations and access it only on a need-to-know basis.

4. Security measures

PulsePanels implements appropriate technical and organisational measures to protect customer personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing. The measures are summarised in Annex B, and a fuller overview is provided on our Security page.

5. Subprocessors

The customer provides general authorisation for PulsePanels to engage subprocessors to process customer personal data. Our current subprocessors are listed on the Subprocessors page. We impose data-protection obligations on subprocessors that are consistent with this DPA, and we remain responsible for their performance.

We will give the customer at least 30 days' notice, by email or by updating the Subprocessors page, before a new subprocessor starts processing customer personal data. The customer may object to the change during that period by emailing privacy@pulsepanels.com, and we will work with the customer in good faith to address its concerns.

6. Data-subject requests

Taking into account the nature of the processing, PulsePanels will assist the customer, by appropriate technical and organisational measures and insofar as possible, to respond to requests from data subjects exercising their rights. If we receive such a request directly, we will, where lawful, direct the data subject to the customer.

7. Security incidents

PulsePanels will notify the customer without undue delay and, where feasible, within 72 hours after confirming a personal-data breach affecting customer personal data. We will provide the information reasonably available to us to help the customer meet its own notification obligations, and will update the customer as more information becomes available.

8. Deletion and return of data

During the term, the customer can delete its content at any time. On termination of the services, and at the customer's choice, PulsePanels will return or delete customer personal data. Customer personal data that remains is deleted within 90 days after the account is closed, unless retention is required by law. Data may persist in backups until routine rotation removes it. See the Data Retention statement for further detail.

9. Audits

PulsePanels will make available the information reasonably necessary to demonstrate compliance with this DPA. Once per year, on request, we will answer a reasonable security questionnaire and provide relevant documentation, such as a description of our security measures. PulsePanels does not currently hold third-party security certifications or audit reports. On-site audits are available only where required by applicable law, with reasonable advance notice, subject to confidentiality, and at the customer's cost.

10. International transfers

Customer data in the cloud service is hosted by Hetzner Online GmbH in Germany (European Union). Some subprocessors process data in other countries, including the United States, as listed on the Subprocessors page. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's standard contractual clauses offered by those providers. Customers with strict residency requirements may use the self-hosted / on-premise deployment.

Annex A — Details of processing

Annex B — Technical and organisational measures

• Encryption in transit: traffic to the dashboard, APIs and players is encrypted using TLS (HTTPS) through Cloudflare.
• Encryption of secrets: integration tokens, webhook signing secrets, two-factor secrets and live-stream credentials are encrypted with AES-256-GCM; passwords are hashed with bcrypt; API keys and connector tokens are stored only as SHA-256 hashes.
• Access control: role-based access at organisation and Space level, including custom roles; optional two-factor authentication that organisations can require; SAML 2.0 single sign-on; sign-in restrictions by IP range, country or email domain.
• Session security: sessions end after 24 hours of inactivity and at most 7 days after sign-in, and are revoked on password change or reset; failed sign-ins lead to account lockout and per-IP rate limiting.
• Tenant isolation: each organisation's data is logically separated and every request is checked against the organisation it belongs to.
• Network security: the origin server accepts web traffic only from Cloudflare; the database, cache and internal API ports are not reachable from the internet; security headers and strict input validation are applied.
• Logging: security-relevant actions are recorded in an audit log; service health is monitored with alerts.
• Backups: daily database and media backups with encrypted off-site copies and regular automated restore tests.
• Change management: changes go through pull requests with automated build, type-check and regression tests before release, and scripted deployments with rollback.
• Staff access: production access is limited to a small number of authorised staff using key-based SSH; platform administrator accounts require two-factor authentication.

Annex C — Subprocessors

The list of authorised subprocessors is maintained on the Subprocessors page and forms part of this DPA.