Data processing agreement (brands)

Draft for legal review. Version 2026-10-draft-1, effective 19 October 2026. Template for brands acting as controller; download the standalone file to countersign. The Standard Contractual Clauses annex is a placeholder until executed with counsel.

Data processing agreement

between the Brand identified in its ProvenReel organization settings ("Controller") and Start Learn LLC, 3402, 1603 Capitol Avenue, Suite 413A, Cheyenne, WY 82001, United States of America, trading as ProvenReel ("Processor"). This agreement forms part of the terms of service for brands and applies whenever the Processor processes personal data on behalf of the Controller through the platform.

1. Subject matter, duration, nature and purpose

1.1 Subject matter: personal data the Controller enters, imports or generates in its workspace about creators, contacts and its own members — CRM contacts, shortlist notes, relationship sources, brand-kit approvals, campaign applications it reviews, messages it sends, review comments and publication evidence.

1.2 Duration: the term of the Controller's use of the platform, plus the retention period applying to each record.

1.3 Nature and purpose: hosting, storage, display, search, matching, notification, export and deletion of the data as instructed through the platform's features.

1.4 Data subjects: creators and their representatives, the Controller's members and the people it records as contacts. Categories: identification and contact data, professional and channel data, communication content, relationship notes, verification outcomes. No special categories are expected; the Controller must not enter them.

2. Controller's instructions and responsibilities

The Controller instructs the Processor through its use of the platform and in writing for anything else. The Controller is responsible for the lawfulness of the data it enters (including a lawful basis for imported contacts and for outreach), for the accuracy of its instructions and for informing data subjects.

3. Processor's obligations (Art. 28(3) GDPR)

The Processor shall:

• process personal data only on documented instructions, including regarding international transfers, unless required by law (in which case it informs the Controller unless prohibited);
• ensure persons authorised to process the data are bound by confidentiality;
• implement the technical and organisational measures in Annex 2;
• respect the conditions in section 4 for engaging sub-processors;
• assist the Controller, by appropriate technical measures, in responding to data-subject requests (the platform's export, correction and erasure functions, and the privacy mailbox);
• assist with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to it;
• at the Controller's choice, delete or return the data at the end of the service and delete existing copies, except where retention is required by law (financial and contractual records, listed in the privacy policy);
• make available the information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by it, at most once a year on reasonable notice unless a breach or an authority requires otherwise.

4. Sub-processors

The Controller gives general authorisation to the sub-processors in Annex 3 (the processor register published in the privacy policy). The Processor informs the Controller at least 30 days before adding or replacing a sub-processor; the Controller may object on reasonable data-protection grounds, in which case the parties seek a solution and, failing one, the Controller may terminate the affected service. The Processor imposes the same obligations on each sub-processor and remains liable for their performance.

5. International transfers

The Processor processes data in the United States. For data subjects in the EU/EEA, the UK and Switzerland the parties rely on the Standard Contractual Clauses (Module 2, controller to processor) in Annex 4 — placeholder: to be executed with counsel — together with the Processor's transfer impact assessment and supplementary measures (encryption at rest and in transit, access logging, data minimisation).

6. Personal data breaches

The Processor notifies the Controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information available at that time, and documents breaches as required by Article 33(5) GDPR.

7. Liability

Each party is liable as provided in Article 82 GDPR and in the terms of service. Limitation of liability — to be aligned with the approved terms.

8. Term and termination

This agreement lasts as long as the terms of service. On termination the Processor deletes or returns the data per section 3, within 30 days, and confirms deletion on request.

9. Governing law

[Governing law — to be confirmed by the founder]; the GDPR-mandated provisions prevail for data of EU data subjects.

Annex 1 — Processing details

See section 1. The Controller can list additional details in its organization settings.

Annex 2 — Technical and organisational measures

• Encryption in transit (TLS) and at rest; application-level encryption for credentials and product-access instructions.
• Role-based access with workspace isolation enforced by policies and tests; operator access requires two-factor authentication and is time-limited and audited.
• Logging with redaction of emails and secrets; correlation ids; rate limiting on sensitive endpoints.
• Malware scanning of uploads; signed, expiring download links.
• Nightly database backups with restore rehearsal; incident runbook with named owners.
• Deletion through anonymisation with documented lawful exceptions; export in a machine-readable format.

Annex 3 — Sub-processors

Sub-processor	Purpose	Data	Location	Transfer safeguard	Status
Laravel Cloud (Laravel LLC) on Amazon Web Services	Hosting and infrastructure	all platform data	United States (region to confirm at deployment, D20)	EU Standard Contractual Clauses (to be executed — placeholder)	In use
Postmark (ActiveCampaign, LLC)	Transactional email	email address, name, message content	United States	EU Standard Contractual Clauses (to be executed — placeholder)	In use
Stripe, Inc.	Payments and payouts	payment and payout details, identity data collected by Stripe	United States / EU (Stripe Payments Europe Ltd)	EU Standard Contractual Clauses (to be executed — placeholder)	In use
PayPal (placeholder — not integrated)	Payments and payouts	payout details	United States / Luxembourg	EU Standard Contractual Clauses (to be executed — placeholder)	Not in use
Shopify Inc. (optional, per brand connection)	Commerce connector (per brand)	order and refund events of the connected store	Canada / United States	EU adequacy decision (Canada)	Not in use
Anthropic, PBC (only when AI assistance is enabled)	AI drafting assistance	text of briefs, messages and profiles sent for drafting	United States	EU Standard Contractual Clauses (to be executed — placeholder)	Not in use
Postmark (ActiveCampaign, LLC) — broadcast message stream	Marketing e-mail (newsletters and e-mail series, consent-based)	email address, first name, language, delivery/bounce/complaint events (open/click only if tracking is enabled)	United States	EU Standard Contractual Clauses (to be executed — placeholder)	In use
Founder CRM (Brevo — to confirm)	Customer relationship management	contact name, email, relationship notes	European Union	Processing in the EU	Not in use

Annex 4 — Standard Contractual Clauses

Placeholder. The Commission Implementing Decision (EU) 2021/914 clauses, Module 2, with the Processor's details and the annexes above, will be attached once executed.

Signatures

Controller: ______________________ (name, role, date)

Processor: Start Learn LLC — ______________________ (name, role, date)