Legal Documentation
When Ascended Social processes personal information on behalf of a business customer (e.g., team or organisation accounts) we act as a processor / service provider. This Data Processing Addendum ("DPA") sets out the terms governing such processing and supplements the underlying customer agreement.
For consumer accounts, Third Eye Cyborg, LLC is the controller of personal information. For business / team accounts, the customer is the controller and Third Eye Cyborg, LLC is the processor / service provider.
We process personal information only on the documented instructions of the customer, including with regard to transfers, unless required to do otherwise by law (in which case we will notify the customer where legally permitted).
Personnel authorised to process personal information are bound by confidentiality obligations. We maintain appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, audit logging, and a documented incident response programme.
We engage the following categories of sub-processors. The current list is below. We will provide prior notice of new sub-processors and give the customer an opportunity to object on reasonable grounds.
A current dated sub-processor list is available on request to [email protected].
Where personal information is transferred from the EEA, the UK, or Switzerland to a third country without an adequacy decision, the transfer is subject to the Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum or UK IDTA), which are incorporated by reference. Supplementary measures (encryption, access controls, transparency reporting) accompany those clauses.
Our representative in the Union for the purposes of Article 27 GDPR is:
EU and EEA data subjects, supervisory authorities, and customers may address the representative on any matter relating to the processing of their personal information by Third Eye Cyborg, LLC.
We provide reasonable assistance to the customer in responding to requests from data subjects to exercise their rights of access, rectification, erasure, restriction, portability, and objection.
On reasonable notice, and subject to confidentiality, we will provide the customer with information necessary to demonstrate compliance with this DPA, including third-party attestations where available.
We notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal information, with information sufficient to allow the customer to meet its own notification obligations.
On termination of the underlying agreement, at the customer's choice we will delete or return personal information processed on its behalf, subject to applicable retention obligations.
To execute this DPA for a business / team account, email [email protected] with the customer name, signing authority, and the contracting entity. A counter-signed copy will be returned for your records.