1. Scope and roles
- This DPA covers personal data that the Customer, its users or its connected accounts put into DigitalMarketingKing (“Customer Personal Data”).
- For Customer Personal Data, the Customer is the controller (GDPR) or Data Fiduciary (DPDP Act 2023), and we are the processor or Data Processor.
- Agencies that use DigitalMarketingKing for their clients act as processors for those clients. The agency is responsible for having the right agreements with its clients; we act on the agency’s instructions.
- Personal data about the Customer’s own users (account details, sign-in and billing data) is handled by us as controller under our Privacy Policy.
2. Details of processing
| Subject matter | Providing the DigitalMarketingKing marketing, SEO, advertising, social, messaging and lead-management service. |
|---|---|
| Duration | The term of the Customer’s subscription, plus the deletion periods in section 10. |
| Nature and purpose | Hosting, storage, analysis (including AI analysis), generating recommendations, reports and content, sending messages and emails the Customer approves or switches on, and syncing with platforms the Customer connects. |
| Data subjects | The Customer’s leads, contacts and customers; people who message the Customer on WhatsApp, Facebook or Instagram; people who submit the Customer’s website forms; reviewers of the Customer’s business; recipients of the Customer’s outreach emails; the Customer’s staff and clients who use the Service. |
| Types of personal data | Names, business email addresses, phone and WhatsApp numbers, company and job details, message and email content and metadata, form submissions, consent and opt-out records, review text and reviewer names, aggregated analytics and advertising data from connected accounts. |
| Special categories | None intended. The Customer must not upload special categories of data unless strictly necessary and lawful. |
3. Your instructions
We process Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA, the Customer’s settings in the app (including connections, autonomy settings and approved actions) are the Customer’s complete instructions. If we believe an instruction breaks the law, we will tell the Customer. If the law requires us to process data in another way, we will tell the Customer first unless the law forbids it.
4. Our obligations
- Everyone who can access Customer Personal Data is bound by confidentiality.
- We do not sell Customer Personal Data, use it for our own marketing or advertising, or use it to train generalised AI models.
- We keep each Customer’s data separate and never use it to provide services to another customer.
- We help the Customer, taking into account the nature of the processing, with security, breach notifications, data protection impact assessments and consultations with authorities.
5. Security measures
- Encryption in transit (TLS) for all traffic, and encryption at rest for access tokens, API keys and passwords stored for connected services.
- Database-level isolation of each workspace’s data (row-level security) and role-based access inside each organisation.
- Hashed passwords and session tokens; secrets are never written to logs or shown after saving.
- An audit log of connections, approvals, key changes and actions taken in connected accounts.
- Least-privilege staff access to production, logged; no staff impersonation of customer accounts.
- Encrypted backups with a regular restore test.
6. Sub-processors
The Customer authorises us to use the sub-processors below. Each is bound by written terms that protect personal data at least as well as this DPA. We will give at least 30 days’ notice of a new sub-processor by email or in the app. The Customer may object on reasonable data protection grounds; if we cannot address the objection, the Customer may cancel and receive a pro-rata refund of prepaid fees.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloud server provider (data centre in Mumbai, India) | Application servers, database and backups | Mumbai, India |
| S3-compatible object storage (same provider as hosting) | Media library files and encrypted backup copies | Mumbai, India |
| Anthropic, PBC | AI analysis and drafting (no training on customer data) | United States |
| Google LLC (Gemini API), or the AI provider you choose | AI analysis and drafting when selected in your settings; with your own key, your agreement with that provider applies | United States / as set by that provider |
| DataForSEO | Search, ranking and AI-answer data (receives keywords, domains and prompts, not contact data) | As stated in DataForSEO's own data processing terms |
| Brevo (Sendinblue SAS) | Service and report emails sent by the platform | European Union |
| Razorpay Software Private Limited | Payments for customers in India | India |
| Stripe, Inc. | Payments for customers outside India | United States |
Platforms the Customer connects (such as Google, Meta, WhatsApp, LinkedIn, HubSpot or Apollo), and services the Customer adds with its own keys (such as its own Brevo, SMTP, DataForSEO, WordPress or Shopify account), are not our sub-processors. The Customer’s own agreements with them apply.
7. International transfers
We and our sub-processors may process Customer Personal Data in India, the United States, the European Union and other countries. We follow any restrictions the Government of India sets on transfers under the DPDP Act. For personal data from the EU, EEA or UK, transfers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum), or on an adequacy decision or the EU–US Data Privacy Framework where available, with additional safeguards where needed. The Standard Contractual Clauses are incorporated into this DPA by reference, with the Customer as data exporter and us as data importer.
8. Data principal requests
DigitalMarketingKing lets the Customer export or delete an individual contact’s data and records consent and opt-outs. If we receive a request directly from a person about Customer Personal Data, we pass it to the Customer without undue delay and do not respond ourselves unless the Customer asks us to.
9. Personal data breaches
We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations to notify the Data Protection Board of India, supervisory authorities and affected people. We take reasonable steps to contain the breach and prevent it happening again.
10. Return and deletion
- The Customer can export its data while the subscription is active, including while the organisation is read-only after a failed payment.
- When the Customer deletes its organisation or asks us to, we delete Customer Personal Data within 30 days, and it leaves encrypted backups within a further 35 days.
- When the Customer disconnects an account, data received from that account is deleted within 30 days.
- We may keep data longer only where the law requires it, and then only for that purpose.
11. Audits
On reasonable written request, and no more than once a year unless a breach or an authority requires it, we will provide information needed to show compliance with this DPA, such as answers to a security questionnaire. On-site audits, if needed, are at the Customer’s cost, with reasonable notice, during business hours and under confidentiality.
12. Your obligations
- Have a lawful basis, and give the notices and collect the consents required, for the personal data you put into DigitalMarketingKing and for the messages you send.
- Follow our Acceptable Use Policy, including the rules on WhatsApp opt-in and email unsubscribe.
- Make sure your instructions comply with the law.
13. General
If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. Liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them. This DPA is governed by the same law as the Terms, except that the Standard Contractual Clauses are governed by the law they specify. Questions: privacy@34-100-232-26.sslip.io. Post: Suthar Technologies, Mumbai, Maharashtra, India, India.