Data Processing Agreement

Last updated: October 2026

This Data Processing Agreement ("DPA") forms part of the Usermaven Terms of Service, or any other written agreement between Usermaven Inc. ("Usermaven") and the Customer that governs the Customer's use of the Service (the "Agreement"). It applies automatically whenever Usermaven processes Customer Personal Data on the Customer's behalf, including during any demo, pilot, or evaluation access. No separate signature is needed. Terms that are capitalized but not defined in this DPA have the meanings given in the Agreement.

1. Definitions

• "Customer" means the person or organization that has entered into the Agreement with Usermaven.
• "Customer Personal Data" means personal data contained in Content (as defined in the Agreement) that Usermaven processes on the Customer's behalf to provide the Service.
• "Data Protection Laws" means the data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Usermaven.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, or any later version).
• "Subprocessor" means a third party engaged by Usermaven to process Customer Personal Data.
• "Controller", "processor", "data subject", "personal data", "processing", "supervisory authority", "business", "service provider", "sell", and "share" have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

2.1 Roles. The Customer is the controller of Customer Personal Data, or a processor acting on behalf of its own clients. Usermaven is the Customer's processor, or subprocessor where the Customer is itself a processor. Under the CCPA, the Customer is the business and Usermaven is its service provider.

2.2 Details of processing. The subject matter, nature, purpose, and duration of the processing, and the types of personal data and categories of data subjects, are described in Annex 1.

2.3 Out of scope. This DPA does not apply to personal data that Usermaven processes as a controller, such as data about Authorized Users, account administration, billing, sales, and our website visitors. That processing is described in our Privacy Policy.

3. The Customer's responsibilities

3.1 Lawful collection. The Customer is responsible for the lawfulness of the Customer Personal Data it collects or sends to the Service. This includes having a valid legal basis, giving all required notices, and obtaining all required consents, including for cookies and similar tracking technologies on its websites and applications.

3.2 Configuration. The Customer is responsible for configuring the Service, its tracking code, and its integrations in a way that meets its obligations under Data Protection Laws.

3.3 Sensitive data. The Customer will not send special categories of personal data or other sensitive personal information to the Service unless Usermaven has agreed to this in writing.

3.4 Lawful instructions. The Customer's instructions to Usermaven must comply with Data Protection Laws.

4. Usermaven's obligations

4.1 Instructions. Usermaven will process Customer Personal Data only on the Customer's documented instructions, unless required to do otherwise by law, in which case Usermaven will inform the Customer before processing unless the law prohibits this. The Agreement, this DPA, and the Customer's use and configuration of the Service are the Customer's complete instructions. Any additional instructions require Usermaven's written agreement and may be subject to additional fees. Usermaven will tell the Customer if, in its opinion, an instruction infringes Data Protection Laws, but it is not obliged to carry out a legal review of the Customer's instructions.

4.2 Confidentiality. Usermaven will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.

4.3 Security. Usermaven will implement the technical and organizational measures described in Annex 2. Usermaven may update these measures from time to time, provided the update does not materially reduce the overall protection of Customer Personal Data.

4.4 Assistance. Taking into account the nature of the processing and the information available to it, Usermaven will provide reasonable assistance to the Customer with responding to data subject requests, carrying out data protection impact assessments, and consulting supervisory authorities where Data Protection Laws require this. Where the Service's own features let the Customer handle a request itself, the Customer will use those features first. Usermaven may charge reasonable fees for assistance that goes beyond what the Service's features provide.

4.5 Data subject requests. If Usermaven receives a request from a data subject relating to Customer Personal Data, it will direct the data subject to the Customer and will not respond to the request itself, unless the law requires it to.

4.6 Personal Data Breach. Usermaven will notify the Customer without undue delay after becoming aware of a Personal Data Breach. Usermaven will provide the information reasonably available to it to help the Customer meet its own notification obligations, and will take reasonable steps to contain the breach. A notification is not an acknowledgment of fault or liability.

4.7 Return and deletion. For 30 days after the Customer's subscription or evaluation access ends, the Customer may ask Usermaven to export Customer Personal Data, as described in the Agreement. After those 30 days, Usermaven will delete Customer Personal Data within 90 days, except where the law requires it to be kept, or where it is held in backups that are deleted in the normal course of backup rotation. The Customer may also ask Usermaven to delete Customer Personal Data sooner, at any time. Any data that is kept remains protected by this DPA.

4.8 Requests from authorities. If Usermaven receives a legally binding request from a public authority for Customer Personal Data, it will notify the Customer before disclosing the data, unless the law prohibits this, and will disclose only the data it is legally required to disclose.

5. Subprocessors

5.1 Authorization. The Customer gives Usermaven general authorization to engage Subprocessors. A list of Usermaven's current Subprocessors is available on request at privacy@usermaven.com.

5.2 Subprocessor terms. Usermaven will engage each Subprocessor under a written agreement that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the services the Subprocessor provides. As required by Data Protection Laws, Usermaven remains responsible to the Customer for the performance of its Subprocessors' data protection obligations.

5.3 Changes. Usermaven will notify the Customer of any intended new Subprocessor at least 14 days before it starts processing Customer Personal Data, by email to the Account owner or by notice in the Service. The Customer may object on reasonable data protection grounds by emailing privacy@usermaven.com within that period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer's sole and exclusive remedy is to terminate the part of the Service that cannot be provided without the new Subprocessor, by written notice to Usermaven.

5.4 Urgent replacements. Except where the SCCs or Data Protection Laws require advance notice, where a Subprocessor must be replaced urgently for security, legal, or service continuity reasons, Usermaven may make the change immediately and will notify the Customer as soon as reasonably possible afterwards. Section 5.3 then applies to any objection.

6. International transfers

6.1 Locations. Usermaven and its Subprocessors may process Customer Personal Data in the United States and in other countries where they operate.

6.2 EU transfers. Where the processing involves a transfer of personal data protected by the GDPR to a country that has no adequacy decision, and no other lawful transfer mechanism applies, the SCCs are incorporated into this DPA as follows:

• Module Two applies where the Customer is a controller, and Module Three applies where the Customer is a processor.
• Clause 7 (docking clause) does not apply.
• In Clause 9, Option 2 (general written authorization) applies, with the notice period set out in section 5.3.
• In Clause 11, the optional language does not apply.
• In Clause 13, the competent supervisory authority is determined in accordance with that clause.
• In Clause 17, Option 1 applies, and the governing law is the law of Ireland.
• In Clause 18, the courts of Ireland have jurisdiction.
• Annexes I.A and I.B are completed with the information in Annex 1 of this DPA, Annex I.C is completed in accordance with Clause 13, and Annex II is completed with the information in Annex 2 of this DPA.

6.3 UK transfers. Where the processing involves a restricted transfer under UK data protection law, the UK Addendum is incorporated into this DPA. Tables 1 to 3 of the UK Addendum are completed with the information in section 6.2 and Annexes 1 and 2 of this DPA. For Table 4, Usermaven, as importer, may end the UK Addendum as set out in its Section 19.

6.4 Swiss transfers. Where the processing involves a transfer of personal data protected by the FADP, the SCCs apply as set out in section 6.2, with these changes: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and data subjects in Switzerland may bring claims in Switzerland.

6.5 Precedence. If there is a conflict between this DPA and the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail.

7. CCPA terms

Where the CCPA applies, Usermaven acts as the Customer's service provider and will:

• not sell or share Customer Personal Data;
• not retain, use, or disclose Customer Personal Data for any purpose other than the business purpose of providing the Service under the Agreement, or as otherwise permitted by the CCPA;
• not retain, use, or disclose Customer Personal Data outside the direct business relationship between Usermaven and the Customer;
• not combine Customer Personal Data with personal information it receives from other sources, except as permitted by the CCPA;
• comply with the obligations that apply to it under the CCPA and provide the level of privacy protection the CCPA requires; and
• notify the Customer if it determines that it can no longer meet these obligations.

The Customer may take reasonable and appropriate steps to ensure that Usermaven uses Customer Personal Data in a manner consistent with the Customer's CCPA obligations, and to stop and remediate any unauthorized use.

8. Audits and information

8.1 Information. On written request, Usermaven will make available the information reasonably necessary to demonstrate its compliance with this DPA. Usermaven may do this by answering a reasonable security or privacy questionnaire, no more than once in any 12-month period, and by providing summaries of relevant policies.

8.2 Audits. If the information in section 8.1 is not sufficient to demonstrate compliance, or a supervisory authority requires it, the Customer may carry out an audit, including under the SCCs where they apply, subject to these conditions, unless the SCCs or Data Protection Laws require otherwise:

• no more than once in any 12-month period, unless a supervisory authority requires otherwise or following a Personal Data Breach;
• on at least 30 days' written notice, with the scope agreed in advance;
• during normal business hours, without unreasonable disruption to Usermaven's operations, and without access to other customers' data;
• carried out by the Customer or an independent auditor bound by confidentiality obligations; and
• at the Customer's cost.

8.3 Confidentiality. Information provided and audit results are Usermaven's Confidential Information.

9. Liability

Each party's liability arising from or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent that Data Protection Laws or the SCCs do not permit such limitations.

10. General terms

10.1 Duration. This DPA applies for as long as Usermaven processes Customer Personal Data.

10.2 Order of precedence. If there is a conflict, this order applies: (1) the SCCs or the UK Addendum, where they apply; (2) an Order Form that expressly varies this DPA; (3) this DPA; and (4) the rest of the Agreement. A data processing agreement that the Customer and Usermaven have both signed prevails over this DPA where they conflict.

10.3 Changes. Usermaven may update this DPA from time to time, including to reflect changes in Data Protection Laws or in the Service, provided the update does not materially reduce the overall protection of Customer Personal Data. We will update the "Last updated" date above and notify Account owners of material changes.

10.4 Governing law. This DPA is governed by the law that governs the Agreement, except where Data Protection Laws or the SCCs require otherwise.

10.5 Countersigned copies. If the Customer needs a countersigned copy of this DPA, it may request one by emailing privacy@usermaven.com.

Annex 1: Details of processing

Data exporter: the Customer, as identified in the Order Form or Account. Role: controller, or processor on behalf of its own clients.

Data importer: Usermaven Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA. Contact: privacy@usermaven.com. Role: processor, or subprocessor.

Categories of data subjects: visitors to and users of the Customer's websites and applications, and the Customer's leads, prospects, customers, and other contacts whose data the Customer sends to the Service, for example through CRM or advertising platform integrations.

Categories of personal data: online identifiers (such as cookie, device, and anonymous IDs), IP addresses and approximate location derived from them, device and browser information, page views, events and interactions, referral and campaign data (such as UTM parameters and ad click IDs), and any other identifiers or attributes the Customer chooses to send, such as names, email addresses, company names, user IDs, CRM and deal data, and advertising platform data.

Sensitive data: none intended. The Customer must not send sensitive data unless Usermaven has agreed in writing.

Frequency of transfer: continuous, for as long as the Customer uses the Service.

Nature of processing: collection, storage, organization, analysis, attribution modeling, reporting, export, and deletion, as needed to provide the Service.

Purpose of processing: to provide the Service under the Agreement, including analytics, attribution, reporting, AI-assisted features, support, and security.

Duration and retention: for the term of the Agreement and as set out in section 4.7. Retention within the Service depends on the Customer's plan or Order Form and its settings.

Transfers to Subprocessors: for the same subject matter, nature, and duration as above, to the extent needed for the services each Subprocessor provides.

Competent supervisory authority: determined in accordance with Clause 13 of the SCCs.

Annex 2: Technical and organizational measures

Usermaven maintains measures designed to protect Customer Personal Data, including:

• Access control: access to systems that hold Customer Personal Data is limited to authorized personnel who need it, using role-based permissions.
• Authentication: individual user accounts and authentication controls for access to those systems.
• Encryption: encryption of data in transit over public networks, and encryption at rest where supported by our hosting providers.
• Infrastructure: use of established cloud hosting providers that operate their own physical and environmental security controls.
• Monitoring and logging: logging and monitoring designed to detect and respond to unauthorized access.
• Backup and recovery: backup and recovery procedures designed to restore availability after an incident.
• Personnel: confidentiality obligations for staff and contractors who have access to Customer Personal Data.
• Vendor management: review of Subprocessors' security and data protection practices before engaging them.
• Incident response: procedures to investigate and respond to security incidents and to notify Customers as this DPA requires.
• Customer controls: Service features and support processes that help Customers manage, export, and delete their data.

Annex 3: Subprocessors

Usermaven's current list of Subprocessors, including the function and location of each, is available on request by emailing privacy@usermaven.com.