Data Processing Addendum (DPA)

Last updated: September 4, 2026

This Data Processing Addendum (“DPA”) is incorporated into and made part of the Cerkl Terms of Service (the “Agreement”) between Cerkl, Inc. (“Cerkl”) and the customer agreeing to the Terms of Service (“Customer”).

This DPA applies to all Plans, including free and paid, and governs Cerkl’s processing of Customer Data on behalf of Customer in providing the Service.

Definitions

  • "Business Purpose" means the limited and specified purposes for which Cerkl processes Personal Data on behalf of Customer as described in this DPA.
  • ‍“Customer Data” means all electronic data or information submitted by Customer to the Service, including data relating to Subscribers and Users.
  • “Personal Data” means any information relating to an identified or identifiable natural person as defined by applicable Data Protection Laws.
  • “Data Protection Laws” means all laws and regulations relating to data protection, privacy, and security, including, but not limited to, the GDPR, UK GDPR, and CCPA.
  • "EU SCCs" means the European Commission's Standard Contractual Clauses for transfers of personal data to third countries adopted pursuant to Commission Implementing Decision (EU) 2021/914, as amended or replaced.
  • "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by Cerkl on behalf of Customer.
  • “Processing” has the meaning given in Data Protection Laws, and “process” will be interpreted accordingly.
  • "Security Incident" means an actual or reasonably suspected unauthorized access to or acquisition, use, disclosure, alteration, or destruction of Customer Data. Security Incident does not include unsuccessful attempts or activities that do not compromise Customer Data, such as unsuccessful login attempts, port scans, denial-of-service attempts that do not result in unauthorized access, or similar events.
  • “Subprocessor” means any third party engaged by Cerkl to process Personal Data on behalf of Customer.
  • “Standard Contractual Clauses (SCCs)” means the EU Commission-approved clauses for international data transfers, as updated from time to time.

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

Roles of the Parties

As between the parties, Customer is the controller or business, as applicable, of Personal Data contained in Customer Data, and Cerkl is the processor, service provider, or contractor, as applicable.

Customer determines the purposes and means of processing Personal Data through the Service. Cerkl will process Personal Data only on behalf of Customer and in accordance with Customer's documented instructions, except where otherwise required by applicable law.

Customer's documented instructions include processing necessary to provide, secure, support, maintain, and improve the Service in accordance with the Agreement and this DPA and any additional documented instructions agreed by the parties.

‍

Scope of Processing

Cerkl processes Personal Data solely for the following limited and specified Business Purposes:

  • hosting, storing, organizing, and securing Customer Data;
  • managing Subscribers, Users, audiences, preferences, and Customer-configured attributes;
  • creating, targeting, transmitting, and delivering communications on behalf of Customer;
  • measuring engagement and providing analytics, reporting, and insights;
  • providing personalization and recommendations requested or configured by Customer;
  • operating integrations and other functionality enabled by Customer;
  • providing customer support, troubleshooting, maintenance, and service administration;
  • detecting, investigating, preventing, and remediating fraud, abuse, security threats, or technical issues; and
  • providing Assistant functionality where Customer enables an Assistant.

The categories of Data Subjects include Subscribers, Users, Customer personnel, and other individuals whose Personal Data Customer submits to the Service.

The categories of Personal Data may include identifiers, contact information, employment or organizational attributes, communication preferences, engagement information, technical and usage information, communications and content, and other Personal Data submitted or configured by Customer.

Processing will continue for the term of the Agreement and any limited retention period permitted under this DPA.

‍

Customer Responsibilities

Customer is responsible for ensuring its instructions to Cerkl comply with Data Protection Laws. Customer is responsible for providing appropriate privacy notices to data subjects and obtaining all necessary consents.

Cerkl Obligations

Cerkl will maintain appropriate administrative, technical, and organizational safeguards designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Cerkl maintains an information security program that includes access controls, authentication controls, vulnerability management, security monitoring, incident response procedures, encryption protections, business continuity measures, and other safeguards appropriate to the nature of the Personal Data processed.

Cerkl will ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations and are permitted to access Personal Data only as necessary to perform their responsibilities.

Cerkl maintains documented procedures designed to identify, investigate, contain, remediate, and document Security Incidents.

Cerkl will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of Customer.

To the extent reasonably available, Cerkl's notification will include information regarding:

  • the nature of the Personal Data Breach;
  • the categories of Personal Data and Data Subjects affected;
  • the likely consequences of the Personal Data Breach;
  • measures taken or proposed to contain or remediate the Personal Data Breach; and
  • other information reasonably necessary for Customer to satisfy its obligations under applicable Data Protection Laws.

Cerkl's notification or response to a Personal Data Breach will not constitute an acknowledgment of fault or liability.

‍

U.S. State Privacy Requirements

To the extent the CCPA or similar U.S. state privacy laws apply to Personal Data processed by Cerkl on behalf of Customer, Cerkl will:

  • not sell or share Personal Data;
  • process Personal Data only for the limited and specified Business Purposes described in this DPA or as otherwise permitted by applicable law;
  • not retain, use, or disclose Personal Data outside the direct business relationship between Cerkl and Customer except as permitted by applicable law;
  • not combine Personal Data received from Customer with Personal Data received from another person or collected from Cerkl's own interactions with a consumer except as permitted by applicable law;
  • provide the same level of privacy protection required of Customer to the extent required by applicable law; and
  • notify Customer if Cerkl determines that it can no longer meet its obligations under applicable Data Protection Laws.

‍

Subprocessors

Customer provides Cerkl with general authorization to engage Subprocessors in connection with the Service.

Cerkl maintains a current list of Subprocessors , including information regarding the services provided by each Subprocessor.

Cerkl will enter into a written agreement with each Subprocessor that imposes data protection obligations appropriate to the nature of the processing and, where required by applicable Data Protection Laws, protections no less protective than the relevant obligations imposed on Cerkl under this DPA.

Cerkl will remain responsible for the performance of its Subprocessors to the extent required by applicable Data Protection Laws.

Cerkl will provide notice of a new Subprocessor at least thirty (30) days before that Subprocessor begins processing Personal Data. Customer may object during that period on reasonable grounds relating to the protection of Personal Data.

If Customer raises a reasonable objection, the parties will work in good faith to identify a commercially reasonable resolution. If no reasonable resolution is available, Customer may discontinue use of the affected functionality or terminate the affected Service. This will be Customer's sole remedy arising from Cerkl's appointment of the applicable Subprocessor.

‍

International Transfers

Cerkl and its Subprocessors may process Personal Data in the United States and other jurisdictions identified in Cerkl's Subprocessor List.

Where applicable Data Protection Laws require safeguards for an international transfer of Personal Data, Cerkl will implement an appropriate lawful transfer mechanism.

For transfers of Personal Data subject to the GDPR for which the EU SCCs are required, the EU SCCs are incorporated into this DPA and will apply using the module appropriate to the roles of the parties, including Module Two (Controller to Processor) where Customer acts as controller and Cerkl acts as processor. The information contained in this DPA and its Annexes will be deemed to complete the corresponding Annexes to the EU SCCs.

Where the UK GDPR applies and an appropriate safeguard is required, the applicable EU SCCs will be supplemented by the then-current UK International Data Transfer Addendum issued by the UK Information Commissioner's Office, or another lawful transfer mechanism agreed by the parties.

Where Swiss data protection law applies, the EU SCCs will be interpreted and modified as necessary to provide safeguards required by applicable Swiss law.

‍

Data Retention and Deletion

Cerkl will retain Customer Data for the duration of the Agreement and as otherwise necessary to provide the Service.

Following termination or expiration of the Agreement, Cerkl will delete or return Customer Data from active production systems within thirty (30) days, unless retention is required by applicable law or otherwise agreed in writing.

Residual copies of Customer Data may remain in encrypted backup systems after deletion from active systems until overwritten in accordance with Cerkl's standard backup retention schedule. During such period, backup data will remain protected in accordance with this DPA and will not be accessed except as necessary for disaster recovery, security, or legal compliance.

Following deletion, Cerkl will have no obligation to maintain or recover Customer Data.

‍

Data Subject Rights

Data Subject RightsCerkl will assist Customer in responding to data subject requests under Data Protection Laws (e.g., access, rectification, erasure, portability).

Cerkl shall not respond to such communication directly from Subscribers except as appropriate (for example, to direct the data subject to contact (Customer) or legally required, without Customer’s prior authorization.

Audits and Certifications

Cerkl will make available information reasonably necessary to demonstrate compliance with this DPA, including applicable independent third-party security or compliance reports maintained by Cerkl.

Where available and subject to appropriate confidentiality restrictions, Cerkl may satisfy Customer's audit request by providing a current SOC 2 Type II report, security documentation, or other independent third-party assessment.

If such information is not reasonably sufficient to satisfy Customer's audit rights under applicable Data Protection Laws, Customer may request an additional audit no more than once in any twelve-month period, except where required by a supervisory authority or following a material Personal Data Breach.

Any such audit will be conducted at Customer's expense, during normal business hours, on reasonable advance notice, subject to reasonable confidentiality and security requirements, and in a manner designed to avoid unreasonable disruption to Cerkl's operations or exposure of information relating to other customers.

‍

Liability

The limitations of liability in the Agreement apply to this DPA.

Order of Precedence

In the event of conflict, the following order applies:

  1. SCCs (if applicable),
  2. this DPA,
  3. the Agreement.

Miscellaneous

This DPA is governed by the same law and jurisdiction as the Agreement. This DPA applies to all Customers, regardless of Plan.

Annex I - Details of Processing

Controller (Customer): The entity identified in the Agreement.

Processor (Cerkl): Cerkl, Inc., 11126 Kenwood Road, Suite 201, Blue Ash OH 45242

Data subjects: Subscribers and Users.

Categories of data: Contact details, preferences, engagement history, communications, and other Customer Data.

Processing activities: Hosting, transmitting, analyzing, and generating communications and insights.

Duration: For the term of the Agreement and any applicable retention period.

Annex II - Technical and Organizational Measures

Cerkl maintains technical and organizational measures appropriate to the nature, scope, context, and purposes of processing, including measures in the following areas:

Access Control

  • role-based and least-privilege access controls;
  • authentication controls for administrative systems;
  • periodic review of access permissions;
  • procedures for provisioning and deprovisioning personnel access.

Data Protection

  • encryption of Customer Data in transit using TLS 1.2 or later;
  • encryption of Customer Data at rest using AES-256 or equivalent protections;
  • encrypted backups and recovery procedures.

Infrastructure and Application Security

  • network and infrastructure security controls;
  • vulnerability and dependency scanning;
  • secure software-development practices, including peer review and automated testing;
  • logging and monitoring of material system access and activity.

Personnel and Device Security

  • confidentiality obligations applicable to personnel;
  • centrally managed work devices;
  • endpoint security controls;
  • authentication requirements for internal systems.

Incident Management

  • documented incident detection, escalation, response, remediation, and notification procedures.

Business Continuity

  • backup and recovery processes designed to support restoration of production systems following a material disruption.

Cerkl may update these measures from time to time, provided that such updates do not materially reduce the overall security of the Service during the applicable subscription term.