Data Processing Agreement

Last updated: 2026-10-29

This version applies to customers who accept it from 2026-10-29. For a customer who accepted an earlier version it applies 30 days after we e-mail them notice of the change (Terms, section 13); until then the earlier version, available on request, applies to them.

This DPA forms part of the Terms of Service between Monitelia ("Processor") and the Customer ("Controller") for processing of personal data under GDPR Art. 28.

1. Definitions

"Personal data", "data subject", "processing", "controller", "processor", "sub-processor" have the meanings given in GDPR Art. 4. "Customer Data" means data the Controller (or its end users) submits through the service.

2. Roles

For Customer Data submitted through the service, the Customer is the Controller and Monitelia is the Processor.
For Account Data (the Customer's own email, billing details, audit log) Monitelia is an independent Controller.

3. Subject matter + duration

Monitelia processes Customer Data to provide the monitoring service described in the Terms of Service, for as long as the Customer has an active account plus a 30-day post-termination deletion window.

4. Nature, purpose, and categories

Nature: storage, indexing, aggregation, transformation, export, transmission to sub-processors strictly to deliver service.
Purpose: SEO crawling and rank tracking; monitoring of public mentions, posts and comments about the Controller's brands; automated analysis of that content (tone, topics, aspects, logos and objects in images, never faces); brand protection and takedown notices the Controller approves; reporting.
Categories of data subjects: the Customer's own staff (team members) and end users whose data appears in scraped web/social content the Customer chooses to monitor.
Categories of personal data: for team members, names, email addresses and IP addresses in the audit log of their own actions. For people whose public content is monitored: public names or handles, profile links, the public posts and comments themselves, and aggregate cohorts (gender or age) inferred only from names or self-declared profiles. Never private contact details, and nothing inferred from a face.

5. Processor obligations (GDPR Art. 28(3))

Process only on documented instructions from the Controller (these terms and what the Controller configures in the UI).
Ensure persons authorised to process are under appropriate confidentiality obligations.
Implement the security measures described in Section 8.
Engage sub-processors only on the conditions in Section 6.
Assist the Controller with GDPR Art. 32-36 obligations.
Assist the Controller in responding to data-subject requests (the dashboard provides export + delete; bespoke requests viainfo@monitelia.com).
On termination, delete or return Customer Data, except where retention is required by law.
Make available all info necessary to demonstrate compliance and allow audits — see Section 9.

6. Sub-processors

(a) Authorisation and the List. The Controller gives Monitelia general written authorisation to engage the sub-processors on Monitelia's list of sub-processors in force when the Controller accepts this DPA (the “List”), each within a category published at /legal/subprocessors, and any sub-processor added or substituted later under (b) to which the Controller has not objected under (c). The List gives, for each sub-processor, its name, address, processing location, the processing entrusted to it and the transfer mechanism. Monitelia supplies the List within 5 business days of a written request to info@monitelia.com. Monitelia engages sub-processors only under written terms that impose data protection obligations no less protective than those in this DPA (Art. 28(4)).

(b) Notice of changes. Monitelia informs every Controller by email at least 14 days before adding or replacing a sub-processor. The notice states the category, the processing entrusted, the personal data concerned, the processing location and the transfer mechanism, and offers the sub-processor's name on request. If the Controller requests the name during the notice period, the objection period runs until 14 days after Monitelia supplies it. Monitelia will not engage the new sub-processor before that extended period ends; if it must do so for other customers, the Controller may terminate the affected service under (c) without penalty.

(c) Objection. The Controller may object to a new or replacement sub-processor on reasonable data protection grounds within the objection period. The parties will discuss the objection in good faith; if it cannot be resolved, the Controller may terminate the affected service, proportionate to the impact, without penalty.

(d) Confidentiality. The List and each notice under (b) are Monitelia's Confidential Information. The Controller may use them only to assess and document its own processing (including its records under Art. 30 and its replies to data subjects and supervisory authorities) and may not otherwise disclose them.

7. International transfers

Where personal data is transferred outside the EEA, the parties adopt the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) by reference, with this DPA as the umbrella agreement and Sections 3, 4 and 8 as Annexes I–II and the List under Section 6 (provided on request) as Annex III:

Module Two (controller to processor) between the Customer and Monitelia;
Module Three (processor to processor) for Monitelia's onward transfers to sub-processors, unless the recipient is in a country with an adequacy decision or certified under the EU–US Data Privacy Framework;
Clause 7 (docking) applies; Clause 9(a) Option 2 (general written authorisation), with the List under Section 6 as the agreed list and 14 days' notice under Section 6(b); Clause 13 supervisory authority as determined by the Customer's establishment; Clauses 17 and 18 governed by and resolved in the courts of Ireland;
for transfers subject to UK law, the UK International Data Transfer Addendum to the SCCs;
for data subject to the Law of Ukraine “On Personal Data Protection” No. 2297-VI, transfers follow its Article 29, and these SCCs serve as the contractual safeguards it requires.

For a Customer outside the EEA (for example in the United States), these clauses apply to the extent the processing is subject to the GDPR, such as monitoring the public content of people in the EU; US state privacy laws are addressed in the Terms of Service.

8. Security measures (GDPR Art. 32)

TLS 1.2+ for all data in transit
Encryption at rest
Tenant isolation enforced in the database (row-level security)
Bcrypt password hashing
SHA-256 API token storage
Audit logging of sensitive admin actions
Principle of least privilege for staff access
Sub-processors selected for SOC 2 / ISO 27001 compliance where available
Point-in-time recovery + weekly application-level backups

9. Audits

The Controller (or an independent auditor under NDA) may audit compliance with this DPA up to once per year, on 30 days' notice, during business hours, at the Controller's expense, and without disrupting our operations or other customers' data.

10. Data breach notification

We will notify the Controller without undue delay (and in any case within 72 hours) of becoming aware of a personal data breach affecting Customer Data, with the information required by Art. 33(3).

11. Liability + indemnity

Each party's liability under this DPA is subject to the limits set out in the Terms of Service.

12. Term + termination

This DPA stays in effect for as long as Customer Data is processed. On termination of the service, we delete Customer Data within 30 days unless retention is legally required.

13. Order of precedence

If this DPA conflicts with the Terms of Service for processing of personal data, this DPA prevails. The SCCs (where applicable) prevail over both.

Signature (optional)

By using the service the Controller is deemed to have accepted this DPA. Enterprise customers may also request a signed copy atinfo@monitelia.com.

Legal disclaimer: these documents are starting templates derived from common GDPR / EU and US privacy practice. They are NOT legal advice. Have qualified counsel review before publishing to real customers in your jurisdiction.