Data Processing Agreement

Article 1 — Parties

This Data Processing Agreement ("DPA" or "Agreement") is entered into between:

• Controller: The organisation (marketing agency or business) that has subscribed to Copifai and that processes personal data of its clients and end users ("Controller" or "you").
• Processor: Klarifai, established in the Netherlands, Chamber of Commerce number [KVK_NUMBER], email: privacy@copifai.com ("Klarifai" or "Copifai").

By accepting this agreement via the platform, the parties declare their acceptance of all provisions of this DPA, in accordance with the requirements of Article 28 of the General Data Protection Regulation (GDPR).

Article 2 — Definitions

• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation or set of operations performed on personal data, such as collection, recording, storage, adaptation, consultation, use, and erasure.
• Sub-processor: A third party engaged by Klarifai to process personal data on its behalf.
• Data Subject: An identified or identifiable natural person to whom the personal data relates.
• Personal Data Breach: A breach of security leading to destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Article 3 — Processing on instructions

3.1 Klarifai shall process personal data only on documented instructions from the Controller, including the instructions set out in this Agreement and the main services agreement.

3.2 The personal data that Klarifai processes in the context of the services includes:

• Account data of platform users (name, email address, organisation name).
• Content, briefs, and prompts entered by users into the platform.
• AI-generated content produced by the platform.
• Analytical data on content performance (where connected via integrations).

3.3 Klarifai shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection provisions.

Article 4 — Confidentiality

4.1 Klarifai shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.2 Klarifai shall restrict access to personal data to those employees and sub-processors for whom access is necessary for the performance of the services.

Article 5 — Security measures (Art. 32 GDPR)

5.1 Klarifai shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include:

• Encryption of personal data in transit (TLS/HTTPS).
• Access security with role-based authorisation and strong authentication.
• Isolation of organisation data (multi-tenancy with organisation-ID filtering on every database query).
• Regular security testing and vulnerability assessments.
• Implemented security headers (CSP, HSTS, X-Frame-Options).
• Structured logging and monitoring for incident detection.

5.2 Klarifai shall regularly assess the effectiveness of the measures taken and adjust them where necessary.

Article 6 — Sub-processors

6.1 The Controller hereby grants Klarifai general written authorisation to engage sub-processors, subject to the conditions set out in this article.

6.2 Klarifai shall ensure that sub-processors are bound by data protection obligations equivalent to those set out in this DPA via contractual arrangements.

6.3 An up-to-date list of engaged sub-processors is available at: copifai.com/processors.

6.4 Klarifai shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object.

Article 7 — Rights of data subjects

7.1 Klarifai shall assist the Controller in fulfilling its obligations to respond to requests for the exercise of data subject rights (access, rectification, erasure, restriction, portability, objection).

7.2 Requests from data subjects received directly by Klarifai shall be forwarded to the Controller unless Klarifai is legally obliged to respond itself.

Article 8 — Personal data breach notification

8.1 Klarifai shall notify the Controller without undue delay — and where feasible within 24 hours — after becoming aware of a personal data breach involving personal data it processes on behalf of the Controller.

8.2 The notification shall include at least:

• A description of the nature of the personal data breach.
• The categories and (estimated) number of data subjects affected.
• The (estimated) number of personal data records concerned.
• The likely consequences of the personal data breach.
• Measures taken or proposed to address the breach.

Article 9 — DPIA support

9.1 Klarifai shall, taking into account the nature of the processing and the information available to it, assist the Controller in carrying out a Data Protection Impact Assessment (DPIA) as referred to in Article 35 GDPR, and in the possible prior consultation of the supervisory authority as referred to in Article 36 GDPR.

Article 10 — Deletion and return upon termination

10.1 Upon termination of the services, Klarifai shall delete or return all personal data to the Controller, at the Controller's choice, unless Union or Member State law requires storage of the personal data.

10.2 The Controller may request a data export via the platform settings or by contacting privacy@copifai.com.

Article 11 — Audit

11.1 Klarifai shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this article.

11.2 Klarifai shall allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor, with a minimum of 30 days' prior notice and at the Controller's expense.

Article 12 — Duration

12.1 This DPA enters into force on the date on which the Controller accepts it via the platform and remains in force for the duration of the Service Agreement. Upon termination of the Service Agreement, this DPA also terminates, subject to the provisions on deletion of personal data (Article 10).

Article 13 — Governing law and jurisdiction

13.1 This DPA is governed exclusively by Dutch law.

13.2 Any disputes arising from or in connection with this DPA shall be submitted exclusively to the competent court in the Netherlands.