Data Processing Agreement (DPA)
Effective Date: September 14, 2026
This Data Processing Agreement forms part of the agreement between Efficion LLC and Customer governing Efferent where Efficion processes Personal Data on Customer's behalf.
1. Scope and Incorporation
This Data Processing Agreement forms part of the agreement between Efficion LLC and Customer governing Efferent where Efficion Processes Personal Data on Customer's behalf. It applies to Personal Data subject to applicable Data Protection Laws, including GDPR, UK GDPR, CCPA/CPRA, and other applicable U.S. state privacy laws.
2. Roles of the Parties
Customer is the Controller or Business, and Efficion is the Processor or Service Provider/Contractor, except where the parties independently determine purposes and means for a particular processing activity. Each party will comply with obligations applicable to its role.
3. Processing Instructions
Efficion will Process Personal Data only on documented Customer instructions, including instructions inherent in Customer's use and configuration of Efferent, unless processing is required by law. Efficion will notify Customer where legally permitted if it believes an instruction violates applicable Data Protection Law.
4. Processing Details
Subject matter: provision of Efferent. Duration: the term of the Services plus permitted retention. Nature and purpose: hosting, storage, transmission, messaging, social engagement, automation, analytics, support, security, integration, and other functions configured by Customer. Data subjects may include Customer personnel, customers, prospects, recipients, social-media users, contacts, and other individuals whose data Customer submits. Data may include identifiers, contact data, communications, social interactions, account data, metadata, usage information, and other data submitted by Customer.
5. Confidentiality
Efficion will ensure persons authorized to Process Personal Data are subject to appropriate confidentiality obligations and access Personal Data only as necessary for assigned responsibilities.
6. Security Measures
Efficion will implement appropriate technical and organizational measures designed to protect Personal Data, taking into account the state of the art, implementation costs, nature and scope of processing, and risks to individuals. Measures may include access control, authentication, encryption in appropriate contexts, logging, monitoring, vulnerability management, secure development, backups, incident response, and vendor controls.
7. Subprocessors
Customer generally authorizes Efficion to engage subprocessors necessary to provide the Services. Efficion will impose data protection obligations on subprocessors appropriate to the services performed and remain responsible for subprocessor performance to the extent required by law. Efficion will provide a mechanism for Customer to obtain current subprocessor information and, where required, notice of material additions or replacements.
8. Data Subject Requests
Taking into account the nature of processing, Efficion will provide reasonable assistance to Customer in responding to verified requests to exercise data protection rights where Customer cannot reasonably fulfill the request through available functionality. If Efficion receives a request relating to Customer-controlled Personal Data, it may direct the requester to Customer unless prohibited by law.
9. Security Incident Notification
Efficion will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data, to the extent required by applicable law. Notice will include information reasonably available concerning the nature of the incident, affected data, likely consequences, and remediation, recognizing that information may be provided in phases.
10. DPIAs and Regulatory Consultation
Efficion will provide reasonable information and cooperation needed for Customer's data protection impact assessment or prior consultation obligations relating to Efferent, taking into account the nature of processing and information available to Efficion.
11. International Transfers
Where Personal Data is transferred from the EEA, United Kingdom, Switzerland, or another jurisdiction requiring transfer safeguards to a country not recognized as adequate, the parties will use an applicable lawful transfer mechanism, which may include the European Commission Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, or another valid mechanism.
12. CCPA/CPRA Service Provider Terms
For Personal Information subject to CCPA/CPRA where Efficion acts as a Service Provider or Contractor, Efficion will not sell or share such Personal Information, retain, use, or disclose it outside the direct business relationship except as permitted by law, or combine it with Personal Information received from other sources except as permitted. Efficion will Process it for the specific business purposes described in the Agreement and this DPA.
13. U.S. State Privacy Laws
Where analogous U.S. state privacy statutes apply, Efficion will comply with processor or contractor obligations applicable to it, including processing according to Customer instructions, confidentiality, security, assistance with rights requests, and required contractual flow-downs.
14. Return and Deletion
Upon termination and at Customer's choice where legally required, Efficion will delete or return Customer Personal Data within a commercially reasonable period, except to the extent retention is required by law, necessary for security or dispute resolution, or maintained in backups subject to protected lifecycle deletion.
15. Audits and Compliance Information
Efficion will make available information reasonably necessary to demonstrate compliance with this DPA. Where required by law, Customer may conduct an audit subject to reasonable advance notice, confidentiality, security restrictions, frequency limitations, use of independent auditors, and reimbursement of reasonable costs for audits exceeding standard compliance support.
16. Government Requests
Unless legally prohibited, Efficion will notify Customer of binding governmental demands specifically seeking Customer Personal Data and will evaluate the validity and scope of such demands. Efficion will disclose only information legally required.
17. Liability
Liability arising under this DPA is subject to the limitations and exclusions in the governing Agreement unless applicable Data Protection Law prohibits such limitation.
18. Precedence and Changes
If this DPA conflicts with the Agreement regarding processing of Personal Data, this DPA controls. The parties may amend this DPA as reasonably necessary to address changes in applicable Data Protection Law or valid transfer mechanisms.
Schedule A — Processing Description
Services: Efferent customer engagement platform. Purposes include multi-channel messaging, Unified Inbox, social engagement, social listening, automation, analytics, AI-assisted functionality when enabled, APIs, webhooks, security, and support. Frequency may be continuous during Customer's use of the Services.
Schedule B — Technical and Organizational Measures
Measures may include identity and access management; least privilege; credential protection; transport encryption; encryption at rest where appropriate; logging and monitoring; environment separation; secure software development; vulnerability and patch management; incident response; backup and recovery; business continuity; vendor risk management; employee confidentiality; and periodic review of security controls.
Schedule C — Transfer Terms
Where required, the applicable Standard Contractual Clauses and jurisdiction-specific addenda are incorporated by reference or executed as an attachment. The parties will complete required module, exporter/importer, competent authority, and annex information before relying on such mechanism.