Data processing agreement

1. Scope

This DPA applies when Birch processes personal data on behalf of Controller in the hosted product (account users, content tied to projects, and integration metadata). It does not replace the Privacy policy for how we act as a controller of our own business data (for example, billing contacts we hold as a business).

2. Roles

• Controller: the customer organization using Birch
• Processor: Birch AI
• Subprocessors: vendors listed on Subprocessors

3. Processing details

• Subject matter: providing Birch AI CMO features
• Duration: for the term of the subscription and any retention period required to wind down or meet legal duties
• Nature: storage, hosting, transmission, analysis, and generation of marketing drafts using subprocessors
• Types of data: account identifiers, user content, site content submitted for processing, optional integration tokens and metadata
• Data subjects: Controller's users and, where present in site content, individuals referenced on Controller's properties

4. Processor obligations

Processor will:

• Process personal data only on documented instructions from Controller, including these Terms and product configuration
• Ensure persons authorized to process data are bound by confidentiality
• Implement appropriate technical and organizational measures (see Security)
• Assist Controller with reasonable requests related to data subject rights, taking into account the nature of processing
• Delete or return personal data after end of service, subject to legal retention
• Make available information reasonably necessary to demonstrate compliance with this DPA

5. Subprocessors

Controller authorizes Processor to use the subprocessors listed at /subprocessors. Processor will impose data protection terms on subprocessors no less protective than this DPA in material respects. Material changes to the list will be reflected on that page. Continued use of the service after an update constitutes acceptance unless Controller objects in writing within 30 days and terminates the affected subscription if no resolution is reached.

6. International transfers

Where personal data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties will rely on standard contractual clauses or another lawful transfer mechanism. On request, Processor will provide the form of SCCs it uses with relevant subprocessors, subject to confidentiality.

7. Security incidents

Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's personal data, and will provide information reasonably available to help Controller meet notification duties.

8. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms of service, except where prohibited. If there is a conflict between this DPA and the Terms on data protection, this DPA controls for that topic.

9. Governing law

This DPA is governed by the laws applicable where Birch AI maintains its principal place of business.

10. Contact

Birch AI
Available on request via support@birch.so
support@birch.so