BrandBoxy Data Processing Addendum
Effective date: 2026-07-24 · Processor: [legal entity — TBD] · The current published version applies; see Section 15.
1. Definitions and Scope
"Applicable Data Protection Law" means any law applicable to the processing of Customer Personal Data, including applicable data-protection, privacy, and security requirements.
"Customer Personal Data" means personal data processed by BrandBoxy on behalf of the Customer through BrandBoxy.
"Controller", "Processor", "Subprocessor", "Personal Data", "Processing", "Data Subject", and "Supervisory Authority" have the meanings given by Applicable Data Protection Law.
This Addendum applies only to Customer Personal Data. If this Addendum conflicts with the BrandBoxy Terms of Service regarding Customer Personal Data, this Addendum controls.
2. Roles of the Parties
The Customer is the Controller of Customer Personal Data and BrandBoxy is the Processor. If the Customer acts as a Processor for another Controller, BrandBoxy acts as the Customer's Subprocessor.
Each party will comply with the obligations applicable to its role under Applicable Data Protection Law.
3. Processing Instructions
BrandBoxy will process Customer Personal Data only on documented instructions from the Customer, including the BrandBoxy Terms of Service, account settings, actions taken through the service, connected-account permissions, and support requests, unless processing is required by law.
If BrandBoxy reasonably believes an instruction violates Applicable Data Protection Law, BrandBoxy may suspend the affected processing and notify the Customer.
4. Customer Responsibilities
The Customer is responsible for the lawfulness, fairness, accuracy, and transparency of its processing, including lawful grounds, notices, consents, data-subject rights, data minimization, retention instructions, and the legality of transferring Customer Personal Data to BrandBoxy.
The Customer must not submit personal data that is unnecessary for the Customer's use of BrandBoxy. The Customer must not submit children's data, health data, biometric data, government identifiers, full payment-card data, criminal-record data, or other highly sensitive data unless the processing is lawful and expressly supported by BrandBoxy.
5. Confidentiality
BrandBoxy ensures that persons authorized to process Customer Personal Data are bound by confidentiality obligations and may access the data only as necessary for their duties.
6. Security Measures
BrandBoxy maintains appropriate technical and organizational measures designed to protect Customer Personal Data, taking into account the nature, scope, context, and purposes of processing and the risks to individuals.
- Role-based and least-privilege access controls, account security, and access revocation.
- Protection of data in transit and appropriate protection of stored data.
- Logical separation of Customer environments and controls against unauthorized cross-account access.
- Logging and monitoring of administrative and security-relevant activity.
- Secure development, change management, vulnerability management, and protection of credentials and secrets.
- Backup, recovery, service continuity, and incident-response procedures appropriate to the service.
- Vendor review, contractual data-protection obligations, and minimization of data shared with service providers.
- Processes for deletion, anonymization, and expiration of backup data.
BrandBoxy may update its security measures provided that the overall level of protection is not materially reduced.
7. Subprocessors
The Customer gives BrandBoxy general authorization to appoint Subprocessors. BrandBoxy will require each Subprocessor to protect Customer Personal Data through written obligations that are no less protective than the relevant obligations in this Addendum.
BrandBoxy remains responsible for its Subprocessors to the extent required by Applicable Data Protection Law. Current Subprocessors are identified in the BrandBoxy Subprocessors list, and further information may be requested at [email protected].
If the Customer reasonably objects to a new Subprocessor on documented data-protection grounds, the parties will work in good faith to identify a reasonable solution. If no reasonable solution is available, BrandBoxy may discontinue the affected processing and the Customer may stop using the affected part of BrandBoxy.
8. Data Subject Requests
Taking into account the nature of processing, BrandBoxy will provide reasonable assistance to enable the Customer to respond to Data Subject requests. If BrandBoxy receives a request concerning Customer Personal Data, BrandBoxy will direct the requester to the Customer unless prohibited by law.
The Customer remains responsible for deciding how to respond and for the legal content of the response.
9. Personal Data Breaches
BrandBoxy will notify the Customer without undue delay after confirming a Personal Data Breach affecting Customer Personal Data and will provide information reasonably available to BrandBoxy that the Customer needs to meet applicable legal obligations.
BrandBoxy's notification does not constitute an admission of fault or liability. The Customer is responsible for notifications to authorities and individuals unless Applicable Data Protection Law requires BrandBoxy to notify directly.
10. Assistance and Compliance Information
Taking into account the nature of processing and the information available to BrandBoxy, BrandBoxy will provide reasonable assistance with data-protection impact assessments, regulatory consultations, and compliance obligations that relate directly to BrandBoxy processing.
BrandBoxy will provide information reasonably necessary to demonstrate compliance with this Addendum. If that information is insufficient and Applicable Data Protection Law requires an audit, the Customer may conduct an audit no more than once per year, on at least 30 days' notice, during normal business hours, without access to other customers' data, subject to confidentiality, and at the Customer's expense. These limits do not apply following a confirmed material breach or where a competent authority requires otherwise.
11. International Transfers
BrandBoxy may process Customer Personal Data outside the country where it was collected. Where Applicable Data Protection Law requires a transfer safeguard, BrandBoxy will use an approved contractual or legal mechanism and any supplementary measures reasonably required for the transfer.
12. Return and Deletion
After the Customer's subscription ends, the Customer may export available Customer Personal Data for 30 days. After that period, BrandBoxy will delete or anonymize Customer Personal Data from active systems in accordance with its retention cycle, unless retention is required by law.
Customer Personal Data in backups will be deleted through the ordinary backup lifecycle and will remain protected and unavailable for ordinary business use until deletion.
13. Details of Processing
| Item | Description |
|---|---|
| Subject matter | Provision and operation of BrandBoxy under the Customer's instructions. |
| Duration | The subscription period and the 30-day export period, followed by the applicable deletion and backup lifecycle. |
| Nature of processing | Collection, recording, organization, storage, retrieval, use, transformation, transmission, publication at the Customer's direction, restriction, deletion, and other operations initiated by the Customer. |
| Purposes | Providing BrandBoxy, executing Customer instructions, supporting the account, maintaining security, resolving errors, and complying with law. |
| Data subjects | Customer representatives, employees, contractors, customers, leads, website visitors, and other persons whose data the Customer lawfully submits. |
| Data categories | Contact, professional, communication, technical, interaction, content, account, and other ordinary personal data selected by the Customer. |
| Restricted categories | Children's data, health data, biometric data, government identifiers, full payment-card data, criminal-record data, and other highly sensitive data unless expressly supported and lawfully submitted. |
| Frequency | Continuously or when initiated by the Customer during the subscription. |
14. Liability
The liability of each party under this Addendum is subject to the limitations of liability in the BrandBoxy Terms of Service, except to the extent Applicable Data Protection Law requires otherwise.
15. Term
This Addendum remains in effect while BrandBoxy processes Customer Personal Data. Provisions that by their nature must continue after termination remain effective until the relevant obligations have been fulfilled.
16. Governing Law and Courts
This Addendum and any non-contractual obligations arising from it are governed by the laws of the United Arab Emirates. The courts of the United Arab Emirates having competent jurisdiction have exclusive jurisdiction over any dispute arising out of or relating to this Addendum, except where Applicable Data Protection Law requires another mandatory forum or transfer mechanism.
17. Contact
Questions and notices regarding this Addendum must be sent to [email protected].