Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between RetentionRail Inc. ("Processor") and you ("Controller") and governs the processing of personal data by RetentionRail on your behalf.

This DPA applies where RetentionRail processes personal data as a data processor on your behalf in connection with the Services.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on personal data. "Controller" means the entity that determines the purposes and means of processing personal data. "Processor" means the entity that processes personal data on behalf of the Controller.

All other terms used in this DPA have the meanings set forth in the Terms of Service or applicable data protection laws.

3. Scope of Processing

RetentionRail processes personal data solely to provide the analytics Services described in our Terms of Service. The categories of data subjects include your end users and creator account holders. The types of personal data processed include analytics identifiers, usage metrics, and account information.

We process data only on your documented instructions and for no other purpose, unless required to do so by applicable law.

4. Processor Obligations

RetentionRail shall: (a) process personal data only on documented instructions from you; (b) ensure that personnel authorized to process personal data are bound by confidentiality obligations; (c) assist you in responding to data subject requests; (d) notify you without undue delay of any personal data breach; (e) delete or return all personal data upon termination of the Services.

5. Sub-Processors

You authorize RetentionRail to engage sub-processors to assist in providing the Services. We will maintain a list of sub-processors and notify you of any changes. We impose data protection terms on all sub-processors that are at least as protective as this DPA.

Current sub-processors include cloud infrastructure providers and analytics service providers. A current list is available upon request.

6. Data Subject Rights

We will assist you in fulfilling your obligations to respond to data subject requests, including requests for access, rectification, erasure, restriction, and data portability.

Where a data subject contacts RetentionRail directly regarding their personal data, we will promptly forward the request to you unless prohibited by law.

7. Security Measures

RetentionRail implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption in transit and at rest, access controls, regular security assessments, and incident response procedures.

8. International Transfers

Where personal data is transferred outside the European Economic Area or other restricted regions, RetentionRail ensures that appropriate safeguards are in place, such as Standard Contractual Clauses or other lawful transfer mechanisms.

9. Contact Us

For questions about this Data Processing Agreement, contact our privacy team at hello@retentionrail.com.