Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of theTerms of Serviceand applies where Turtle Techsai (“Processor”) processes personal data on behalf of a customer, usually a social media agency (“Controller”), in connection with the TurtleCanvas Service. It takes effect when the customer accepts the Terms; no signature is needed. A countersigned copy is available on request.

Terms used in this DPA have the meanings given in the applicable data protection law, which may include the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India’s Digital Personal Data Protection Act 2023, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law, Singapore’s Personal Data Protection Act 2012, Malaysia’s Personal Data Protection Act 2010, the Philippine Data Privacy Act of 2012, the Australian Privacy Act 1988, and US state consumer privacy laws such as the CCPA. “Personal Data” means any information relating to an identified or identifiable natural person processed through the Service on the Controller’s behalf.

• Subject matter: making, planning, approving and delivering social media content for the Controller’s clients.
• Duration: the term of the Controller’s account, plus up to 30 days for deletion.
• Nature and purpose: storage, AI processing of images and text, generation of designs and captions, hosting of client review pages, delivery exports and reports, and email sent at the Controller’s request.
• Categories of data subjects: the Controller’s staff; the Controller’s clients and their contact people who review posts; people who appear in photos the Controller uploads; contact people at businesses the Controller researches with Find clients.
• Types of personal data: names, business email addresses and phone numbers, approval decisions and comments, photos and any people in them, brand and product information, and usage records. The Service is not designed for special category data, and the Controller should not upload it.

Turtle Techsai shall:

• process personal data only on the Controller’s documented instructions, which are the Terms, this DPA and the Controller’s use of the Service, and tell the Controller if an instruction appears to break the law;
• ensure that people authorised to process personal data are bound by confidentiality;
• implement appropriate technical and organisational measures (section 7);
• engage sub-processors only as described in section 5;
• assist the Controller, taking into account the nature of the processing, in responding to data subject requests and with security, breach notification, impact assessments and prior consultation;
• at the end of the service, delete personal data within 30 days, or return it on request made before then, unless the law requires it to be kept;
• make available the information needed to demonstrate compliance, and allow for audits by answering reasonable written questions once a year, or by an independent auditor at the Controller’s cost on reasonable notice.

The Controller gives general authorisation for the sub-processors listed on ourSubprocessorspage. We will update that page at least 14 days before adding or replacing one; the Controller may object on reasonable data protection grounds, and if we cannot address the objection, may end the affected part of the Service and receive a pro-rata refund of prepaid fees. Each sub-processor is bound by data protection terms no less protective than this DPA.

Personal data is processed in India and the United States, and some AI processing takes place in Europe. For transfers of personal data from the EEA, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), with Clause 7 included, option 2 of Clause 9 (general authorisation, 14 days’ notice), the optional wording in Clause 11 omitted, and Ireland as the governing law and forum under Clauses 17 and 18. For transfers from the United Kingdom, the UK International Data Transfer Addendum issued by the Information Commissioner applies to those clauses; for Switzerland, references to the GDPR are read as references to the Swiss FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority. The details in section 3 and the measures in section 7 complete the annexes. For transfers from other countries, including the UAE, Saudi Arabia, Singapore, Malaysia, the Philippines and Australia, we apply the contractual safeguards those laws require.

• Encryption in transit (TLS) for all traffic, and encryption at rest by our hosting provider.
• Uploaded product photos and invoices in private storage, reached only through short-lived signed links.
• Client review pages reached only through unguessable links that the agency can revoke.
• Hashed passwords; administrative access limited to named staff.
• Every database query scoped to the account that owns the data.
• Logs kept for up to 180 days to investigate incidents.

We will notify the Controller of a personal data breach affecting its data without undue delay, and in any event within 48 hours of becoming aware of it, with the information the Controller needs to meet its own obligations, which may include notifying a regulator within 72 hours.

Where the CCPA or a similar US state law applies, Turtle Techsai acts as a “service provider” or “processor”. We do not sell or share personal information, and we do not retain, use or disclose it outside the direct business relationship with the Controller or for any purpose other than providing the Service.

If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

For DPA-related inquiries, contact us at contact@turtletechsai.com.