Data Processing Agreement

For purposes of this DPA:

• “Customer Data” means information submitted, uploaded, transmitted, or otherwise made available to Nurture Engine by or on behalf of Customer.
• “Personal Data” means information relating to an identified or identifiable individual.
• “Processing” means any operation performed on Personal Data, including collection, organization, storage, access, use, transmission, modification, deletion, or destruction.
• “Controller” means the party that determines the purposes and means of processing Personal Data.
• “Processor” means the party that processes Personal Data on behalf of the Controller.
• “Subprocessor” means a third party engaged by Nurture Engine to process Personal Data in connection with providing the services.

Where Nurture Engine processes Personal Data on behalf of Customer:

• Customer acts as the Controller or business responsible for the Personal Data.
• Nurture Engine acts as the Processor or service provider processing Personal Data on Customer's behalf.

Customer determines the purposes for which Customer Data is collected and used.

Nurture Engine processes Customer Data only as necessary to provide the services, follow Customer's lawful instructions, maintain and secure the services, comply with applicable law, and perform other activities permitted under the parties' agreement.

Customer is responsible for ensuring that:

• Customer has the legal right to collect and provide Personal Data to Nurture Engine.
• Customer has provided any legally required privacy notices.
• Customer has obtained any legally required consent.
• Customer's instructions to Nurture Engine comply with applicable law.
• Customer's email and SMS campaigns comply with applicable marketing, telecommunications, privacy, and consumer-protection laws.
• Contact lists supplied to Nurture Engine have been obtained and may be used lawfully.

Customer remains responsible for determining whether its use of Nurture Engine complies with laws applicable to Customer's business, industry, audience, and jurisdiction.

Nurture Engine will:

• Process Personal Data only as necessary to provide the services and according to Customer's documented instructions.
• Use reasonable administrative, technical, and organizational safeguards to protect Personal Data.
• Limit access to Personal Data to personnel and service providers who require access to perform their responsibilities.
• Require persons authorized to process Personal Data to maintain appropriate confidentiality.
• Take reasonable steps to protect Personal Data against unauthorized access, disclosure, alteration, loss, or destruction.
• Assist Customer with certain privacy-related requests where reasonably necessary and technically feasible.

Nurture Engine may process Personal Data for purposes including:

• Customer reactivation campaigns
• Lead nurturing campaigns
• Permitted customer outreach
• Email campaign delivery
• SMS campaign delivery
• Contact list preparation
• Contact verification
• Audience segmentation
• Campaign configuration
• Sequence creation and management
• Campaign monitoring
• Reporting and analytics
• Customer support
• Account management
• Security and fraud prevention
• Deliverability management
• Service improvement

Personal Data processed through Nurture Engine may include:

• Names
• Email addresses
• Phone numbers
• Company names
• Customer or lead status
• Customer relationship information
• Purchase or service history provided by Customer
• Campaign engagement information
• Communication history
• Geographic or service-area information
• Marketing preferences
• Opt-out or suppression information
• Other information submitted by Customer for campaign purposes

Nurture Engine does not require Customers to submit sensitive Personal Data unless expressly necessary and agreed to in writing.

Customers should not upload unnecessary sensitive information.

Personal Data may relate to individuals including:

• Customer's past customers
• Current customers
• Leads
• Prospects
• Business contacts
• Employees or representatives of businesses
• Users of Customer's services
• Users of the Nurture Engine platform

Customer instructs Nurture Engine to process Personal Data as reasonably necessary to:

• Provide the services purchased by Customer
• Operate Customer's campaigns
• Maintain Customer's account
• Provide reporting and support
• Protect the security and integrity of the services

Additional instructions may be provided through Customer's account, onboarding information, communications with Nurture Engine, or other documented requests.

Nurture Engine may decline instructions that it reasonably believes violate applicable law, third-party rights, platform policies, or security requirements.

Nurture Engine will take reasonable measures to ensure that individuals authorized to access Personal Data:

• Have a legitimate need for access
• Are subject to confidentiality obligations
• Process Personal Data only as necessary to perform their responsibilities

Nurture Engine will maintain reasonable safeguards appropriate to the nature of the Personal Data processed.

Security measures may include, where appropriate:

• Access controls
• Authentication protections
• Encryption in transit
• Secure hosting infrastructure
• Monitoring and logging
• Account access restrictions
• Vulnerability management
• Data minimization
• Backup and recovery procedures
• Personnel access controls

No system can guarantee absolute security, but Nurture Engine will maintain safeguards reasonably designed to protect Customer Data.

Customer authorizes Nurture Engine to engage Subprocessors where reasonably necessary to provide the services.

Subprocessors may provide services including:

• Cloud hosting
• Email delivery
• SMS delivery
• Payment processing
• Authentication
• Analytics
• Contact verification
• Security
• Customer support
• Infrastructure and communications

Nurture Engine will require Subprocessors that process Personal Data on its behalf to maintain appropriate privacy, confidentiality, and security obligations.

Nurture Engine remains responsible for managing its Subprocessor relationships as required by applicable law.

Because Nurture Engine manages email and SMS campaigns, Customer Data may be transmitted to email delivery providers, telecommunications providers, messaging carriers, or related infrastructure providers when necessary to deliver requested communications.

Those providers may process limited Personal Data as required to provide their services, prevent abuse, comply with law, and maintain telecommunications or messaging systems.

If Nurture Engine receives a request from an individual relating to Personal Data processed on behalf of Customer, Nurture Engine may direct the individual to Customer where appropriate.

Where reasonably necessary and technically feasible, Nurture Engine will assist Customer with responding to valid requests relating to:

• Access
• Correction
• Deletion
• Restriction
• Portability
• Objection

Customer remains responsible for determining whether and how to respond to such requests.

If Nurture Engine becomes aware of unauthorized access to Personal Data processed on behalf of Customer that requires notification under applicable law, Nurture Engine will notify affected Customers without undue delay.

Notifications may include information reasonably available regarding:

• The nature of the incident
• Categories of information involved
• Known or reasonably anticipated impact
• Measures taken or planned in response

Nurture Engine's notification of an incident does not constitute an admission of fault or liability.

Nurture Engine may retain Customer Data for as long as reasonably necessary to:

• Provide the services
• Maintain Customer's account
• Fulfill contractual obligations
• Maintain appropriate business records
• Resolve disputes
• Prevent fraud or abuse
• Comply with law

Following termination of the services, Nurture Engine may delete or anonymize Customer Data according to its normal retention procedures unless continued retention is required by law or otherwise agreed.

Customer should maintain its own copies of important business records.

Where technically feasible and reasonably requested before deletion, Nurture Engine may provide Customer with access to or an export of certain Customer Data.

The available format may depend on the systems used to process the data.

Customer acknowledges that Nurture Engine and its service providers may process Personal Data in the United States and other countries where Nurture Engine or its service providers operate.

Where required by applicable law, the parties will use appropriate mechanisms for lawful international transfers of Personal Data.

Taking into account the nature of the processing and information available to Nurture Engine, Nurture Engine will provide reasonable assistance to Customer regarding applicable data-protection obligations when required by law.

Any assistance that requires substantial custom work may be subject to reasonable additional fees unless prohibited by applicable law.

Upon reasonable written request, Nurture Engine may provide information reasonably necessary to demonstrate compliance with its obligations under this DPA.

Any audit or inspection request must:

• Be reasonable in scope
• Protect Nurture Engine's confidential information
• Avoid unreasonable disruption of Nurture Engine's operations
• Comply with applicable confidentiality and security requirements

Where appropriate, Nurture Engine may satisfy audit requests through documentation, security assessments, certifications, questionnaires, or similar materials.

Nurture Engine does not sell Customer-uploaded Personal Data for its own independent commercial purposes.

Nurture Engine will not use Customer contact lists to independently market unrelated products or services to Customer's contacts.

If there is a conflict between this DPA and another agreement between Customer and Nurture Engine regarding the processing of Personal Data, this DPA will control with respect to the specific data-processing issue unless otherwise agreed in writing.

Nurture Engine may update this DPA periodically to reflect changes in its services, legal requirements, or privacy and security practices.

The latest revision date will be displayed at the top of this page.

Questions relating to this Data Processing Agreement or Nurture Engine's privacy practices may be sent to:

Nurture Engine

privacy@nurtureengine.io

Subject Matter: Provision of Nurture Engine's managed email, SMS, customer reactivation, lead nurturing, and outreach services.

Duration: For the duration of Customer's use of Nurture Engine and any applicable retention period.

Nature of Processing: Collection, organization, verification, storage, segmentation, transmission, analysis, communication, reporting, deletion, and other processing required to provide the services.

Purpose: To operate campaigns and services requested by Customer.

Types of Personal Data: Names, email addresses, phone numbers, company information, customer relationship information, lead information, marketing preferences, campaign activity, engagement information, and other information supplied by Customer.

Categories of Data Subjects: Customers, former customers, leads, prospects, business contacts, and other individuals contained in Customer-provided datasets.