Data processing agreement

1. Scope

This DPA applies when clients use Kontrol Sentinel services that involve the processing of personal data. The Processor processes personal data solely on behalf of the Controller and in accordance with the Controller’s documented instructions.

2. Nature of processing

Kontrol Sentinel processes personal data only for the purpose of delivering platform functionality, including:

• Account management
• Event participation
• Audience interaction tools
• Campaign communication
• Reputation monitoring alerts

3. Categories of data

Depending on the use of the platform, personal data may include:

• Names
• Email addresses
• Organisation names
• Poll responses
• Submitted questions during events

Sensitive data should not be submitted through the platform unless explicitly authorised by the client.

4. Obligations of the processor

Kontrol Sentinel commits to:

• Processing data only on documented instructions from the Controller
• Implementing appropriate technical and organisational security measures
• Ensuring confidentiality of personnel handling personal data
• Assisting the Controller in fulfilling GDPR obligations

5. Security measures

The Processor maintains security measures including:

• Encrypted communications and data at rest
• Secure infrastructure configurations
• Controlled access management
• Activity monitoring and audit logging

6. Sub-processors

Kontrol Sentinel may engage sub-processors to support the delivery of services. These sub-processors are subject to contractual obligations equivalent to those in this DPA. Clients may request a list of current sub-processors by contacting us at the address in Section 11 below.

7. Data subject requests

The Processor shall assist the Controller in responding to requests from data subjects regarding:

• Access to personal data
• Correction of inaccurate data
• Erasure (“right to be forgotten”)
• Data portability

8. Data breach notification

In the event of a personal data breach, the Processor will notify the Controller without undue delay after becoming aware of the breach, and in any case within the timeframes required by applicable law. Notification will include the nature of the breach and the categories of data affected.

9. Data retention

Personal data will be retained only for the duration necessary to provide services or comply with legal obligations, consistent with the retention principles set out in the Privacy Policy. Upon termination of services, data may be deleted or returned to the Controller upon request.

10. International transfers

Kontrol Sentinel seeks to avoid transfers of personal data outside the EEA. Where transfers are required, appropriate safeguards will be implemented, including standard contractual clauses or equivalent mechanisms as required by applicable law.

11. Audit rights

The Controller may request reasonable documentation demonstrating compliance with this DPA. Requests should be made in writing with reasonable notice.