Data Processing Addendum

1. Definitions

• Data Protection Law means every law that applies to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended (“CCPA”).
• Personal Data, Controller, Processor, Data Subject, Processing and Supervisory Authority have the meanings given in the GDPR; under the CCPA, “Controller” includes a Business and “Processor” includes a Service Provider.
• Customer Personal Data means Personal Data you, your team members or the businesses you represent provide to Marcelo, or that Marcelo collects from accounts and websites you connect, for Processing under the Terms.
• Sub-processor means a third party Marcelo engages to Process Customer Personal Data.
• Standard Contractual Clauses means the clauses approved by European Commission Decision 2021/914, and UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles

For Customer Personal Data, you are the Controller (or a Processor acting for the business you represent, which is the Controller) and Marcelo is your Processor. Where you are yourself a Processor, you warrant that your instructions to Marcelo are authorised by the Controller and that this DPA is consistent with your agreement with them.

Marcelo is an independent Controller of the Personal Data it needs to run its own business — your account details, billing records, usage and security logs, and communications with you — as described in the privacy policy. This DPA does not cover that data.

3. Details of the Processing

• Subject matter and purpose. Providing the Marcelo service to you: analysing websites and marketing accounts, drafting and generating marketing content, building and hosting websites, publishing approved work to connected platforms, and reporting on the results.
• Duration. For as long as the Terms are in force, and until the deletion described in section 10.
• Nature. Collection, storage, organisation, analysis, generation of derived content, transmission to connected platforms and Sub-processors, and deletion.
• Categories of Data Subjects. Your personnel and team members; the owners and personnel of the businesses you represent; those businesses’ customers and prospective customers, insofar as they appear in reviews, enquiries submitted through a hosted website, social media interactions, or photographs; and visitors to websites Marcelo hosts.
• Categories of Personal Data. Names, email addresses, telephone numbers, business and postal addresses; content of reviews, enquiries, comments and messages; photographs that may show people; identifiers and access tokens for connected accounts; aggregate analytics and advertising performance data; and technical data such as IP addresses in hosting logs.
• Special categories. None are intended. You agree not to provide health, biometric, genetic, religious, political, sexual-orientation or criminal data to Marcelo, and to ensure a hosted website does not solicit it.

4. Instructions

Marcelo Processes Customer Personal Data only on your documented instructions. The Terms, this DPA, and your use of the service’s controls — connecting an account, approving a draft, switching on Autopilot for a business, pressing a control that sends or publishes — are those instructions. Marcelo will tell you if, in its opinion, an instruction infringes Data Protection Law, and may suspend the instruction until it is resolved.

Marcelo does not sell Customer Personal Data, does not share it for cross-context behavioural advertising, does not retain, use or disclose it for any purpose other than providing the service, and does not combine it with Personal Data from other sources except as the service requires. Marcelo does not use Customer Personal Data to train AI models, and contracts with its AI Sub-processors on terms that prohibit them from doing so.

5. Confidentiality

Marcelo ensures that every person it authorises to Process Customer Personal Data is bound by a duty of confidentiality and has access only to the data they need. Access to production data is limited to the people who operate the service.

6. Security

Marcelo implements technical and organisational measures appropriate to the risk, and maintains them for the duration of the Processing. They include:

• encryption of data in transit (TLS) and at rest;
• encryption of every stored access token and API key with a key held separately from the database, and no display of a stored secret in full once saved;
• authentication through a dedicated identity provider, with per-person sign-ins;
• role-based access inside each customer workspace, with the irreversible actions — payment, deletion, unattended publishing — restricted to owners;
• isolation of each customer’s data by workspace and business in every query;
• a structural rule that generated content may use only facts a person has confirmed, and that no content is published without either a person’s press or a person’s standing instruction to publish unattended;
• error and availability monitoring, with personal details excluded by default;
• periodic internal security review, with findings tracked to closure.

You are responsible for the security of your own account credentials, of the devices your team uses, and of the accounts and websites you connect.

7. Sub-processors

You authorise Marcelo to engage the Sub-processors listed in the privacy policy under “Who else processes it”, and those a business connects by its own choice. Marcelo imposes data protection obligations on each Sub-processor no less protective than this DPA, and remains responsible for their performance.

Marcelo will give you at least 30 days’ notice by email before adding or replacing a Sub-processor that will Process Customer Personal Data. You may object on reasonable data protection grounds within that period; if the objection cannot be resolved, either side may terminate the affected part of the service, and you will receive a pro-rated refund of any prepaid fees for it.

8. International transfers

Marcelo is established in the United States and Processes Customer Personal Data there and in the countries where its Sub-processors operate. Where Data Protection Law restricts a transfer of Customer Personal Data from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree that:

• the Standard Contractual Clauses are incorporated into this DPA, with Module Two (controller to processor) or Module Three (processor to processor) applying according to your role; Clause 7 (docking) included; option 2 of Clause 9 with the notice period in section 7 above; Clause 11 optional language not included; Clause 17 governed by the law of Ireland; and Clause 18 courts of Ireland; Annex I is completed by sections 2 and 3 of this DPA, Annex II by section 6, and Annex III by the privacy policy’s Sub-processor list;
• for transfers from the UK, the UK Addendum is incorporated and applies to the Standard Contractual Clauses as so completed;
• for transfers from Switzerland, the Standard Contractual Clauses apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner.

Where Marcelo or a Sub-processor is certified under the EU-U.S. Data Privacy Framework, that certification may be relied on in addition to the above.

9. Assistance

Taking into account the nature of the Processing, Marcelo will help you meet your obligations to respond to Data Subjects’ requests, to carry out data protection impact assessments and prior consultations, and to ensure security. The self-service controls described on Deleting your data are the first means of that assistance. If Marcelo receives a request directly from a Data Subject about Customer Personal Data, it will pass the request to you without responding on the substance, unless the law requires otherwise.

10. Personal data breach

Marcelo will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and in any case within 72 hours of becoming aware. The notice will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed, and will be supplemented as more becomes known. Marcelo will cooperate with you in any notification you are required to make.

11. Deletion and return

You may export your data and delete a business or your whole account at any time, as described on Deleting your data. On termination of the Terms, Marcelo deletes Customer Personal Data on the same terms, except for the records the privacy policy identifies as kept, which are retained only as long as the law or the stated purpose requires and remain subject to this DPA.

12. Audit

Marcelo will make available the information reasonably necessary to demonstrate compliance with this DPA: this document, the security description above, the Sub-processor list, summaries of security reviews, and written answers to a reasonable security questionnaire no more than once a year. Where that is not sufficient to meet an obligation under Data Protection Law, you may, at your cost, conduct or commission an audit on 30 days’ notice, no more than once a year, during business hours, under confidentiality, and without disrupting the service or accessing other customers’ data.

13. CCPA

To the extent the CCPA applies, Marcelo acts as a Service Provider. Marcelo certifies that it understands and will comply with the restrictions in section 4; will notify you if it can no longer meet its obligations under the CCPA; will grant you the right to take reasonable steps to stop and remediate unauthorised use of Personal Information; and will comply with the CCPA and provide the same level of privacy protection it requires.

14. Liability and general

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Law does not allow a limitation. This DPA is governed by the law governing the Terms, except where the Standard Contractual Clauses require otherwise. If any part of it is held invalid, the rest remains in force.