This Data Processing Agreement ("DPA") forms part of the Terms of Service between Gain Solutions AS, Solheimsgata 11A, N-2000 Lillestrøm, Norway (organisation number 918 479 961) ("SignalBraid", "we", "us") and the customer ("you") for customers subject to the GDPR. It applies automatically when you accept the Terms and use the service. We send a countersigned copy on request to privacy@signalbraid.com. Enterprise customers may negotiate their own terms.

1. Roles and scope

For the personal data contained in the data you connect to SignalBraid from third-party platforms ("Customer Personal Data"), you are the controller and SignalBraid is your processor. If you are yourself a processor acting for your own client, SignalBraid is your subprocessor and this DPA applies in the same way. For account, billing and support data of your users, and for our website, SignalBraid is a controller, as the Privacy Policy explains; this DPA does not apply to that data.

2. Details of the processing

  • Subject matter and purpose. Providing the SignalBraid service: reading data from the platforms you authorize, storing, normalizing and reconciling it, and serving it to your authorized users, API clients and AI clients.
  • Duration. The term of your subscription, and the deletion period in section 10.
  • Types of personal data. Whatever your connected platforms return and you choose to enable, for example names, email addresses, identifiers, order, campaign and audience data, and user identifiers. Fields that contain contact-level personal data are classified before storage and are excluded by default unless you enable them.
  • Data subjects. Your customers, leads, contacts and website visitors, and the users of your advertising and analytics accounts.
  • Special categories of data. We do not ask for them. Please do not connect sources in order to send us data of that kind.

3. Our obligations

We process Customer Personal Data only on your documented instructions: the Terms, this DPA, and the settings you choose in the service. We do not sell it, use it for advertising or use it to train machine-learning models. If we think an instruction infringes data-protection law, we will tell you. If the law requires us to process the data otherwise, we will tell you first unless the law forbids it. People who work with Customer Personal Data on our side are bound by confidentiality.

4. Security

We apply technical and organisational measures appropriate to the risk, as Article 32 GDPR requires. The measures are described on our Security page and include encrypted credentials that are never displayed or returned, access scoped per workspace and audited, and least-privilege read-only connections. We may improve the measures but will not lower the level of protection during the term.

5. Where data is stored and transferred

Customer data at rest is stored in European Union regions; some processing takes place on Cloudflare's global network and with providers outside the EU, as the Security and Subprocessors pages state. Where personal data is transferred outside the EEA, it relies on an adequacy decision, such as the EU–US Data Privacy Framework, or on the Standard Contractual Clauses, as the Subprocessors page lists. We do not promise that no data ever leaves the EU.

6. Subprocessors

You give us general authorization to use the subprocessors listed on the Subprocessors page. We bind each to data-protection obligations that match this DPA, and we remain responsible to you for their performance. We will tell you by email at least 30 days before a new subprocessor starts to process Customer Personal Data. If you have a reasonable data-protection objection within that period, we will work with you to resolve it; if we cannot, you may stop using the affected part of the service and the refund rules in the Terms apply.

7. Helping you meet your obligations

If a data subject asks us about Customer Personal Data, we will pass the request to you without undue delay and will not answer it ourselves unless you tell us to. Taking into account the nature of the processing and the information we hold, we will help you answer data-subject requests and carry out data-protection impact assessments and consultations with a supervisory authority. The service lets you delete connections, workspaces and your account yourself.

8. Personal data breach

We will tell you without undue delay after we become aware of a personal data breach affecting Customer Personal Data, and give you the information we have that you need to meet your own notification duties. We will keep you updated as we learn more.

9. Audit

We will give you the information needed to show that we comply with this DPA. If that is not enough, you may carry out an audit, at most once every 12 months unless a supervisory authority requires otherwise or we have had a breach, on 30 days' written notice, during business hours, subject to confidentiality and without access to other customers' data. You bear the cost of your audit.

10. Deletion and return

You can export your data and delete connections, workspaces and your account at any time. When a workspace or account is deleted, access and scheduling stop immediately, live copies we manage are erased within 30 days, and backup copies expire within a further 30 days, so every copy we manage is gone within 60 days. At the end of the contract we make your data available for export for 30 days and then delete it in the same way. Data you have already delivered to a place you control, such as a Google Sheet, a downloaded file, an AI-client conversation or a Looker Studio report, is yours and is not deleted by SignalBraid. We may keep data that the law requires us to keep.

11. Liability

The limits in section 10 of the Terms of Service apply to this DPA.

12. Term, order of precedence and governing law

This DPA lasts as long as we process Customer Personal Data for you. If it conflicts with the Terms on the processing of personal data, this DPA prevails. It is governed by the laws of Norway, and the courts named in the Terms have jurisdiction, in each case subject to mandatory data-protection law.

13. Contact

Gain Solutions AS · Solheimsgata 11A · N-2000 Lillestrøm · Norway · privacy@signalbraid.com