Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service or any other agreement between you ("Customer" or "Controller") and MB AJ Ventures, a company registered in Lithuania operating under the name "Content Maker Studio" or "CMS" ("Processor" or "CMS").

1. Definitions

• Applicable Data Protection Law: Includes GDPR, UK GDPR, CCPA, and other relevant laws.
• Personal Data: Any data relating to an identifiable individual submitted by the Customer.
• Processing: Any operation performed on Personal Data.
• Subprocessor: A third party engaged by CMS to Process Personal Data.
• Data Breach: A breach of security leading to accidental or unlawful loss, access, or disclosure.

2. Roles of the Parties

Customer is the Controller, and CMS is the Processor. CMS shall only process Personal Data in accordance with Customer's documented instructions, unless otherwise required by law.

3. Details of Processing

• Subject Matter: CMS provides content and automation tools as per the Principal Agreement.
• Duration: For the term of the Principal Agreement.
• Nature and Purpose: Provide services such as content generation, profile management, billing, analytics.
• Categories of Data: Contact details, chat content, user behavior, subscription data.
• Data Subjects: Customer's team members, clients, or end users.

4. CMS Responsibilities

CMS will:

• Ensure personnel are under confidentiality obligations.
• Implement appropriate security controls (encryption, access control, monitoring, etc.).
• Use only approved Subprocessors under similar data protection obligations.
• Provide notice of new Subprocessors and allow objection on reasonable grounds.
• Cooperate in responding to Data Subject Requests.
• Notify Customer of any Data Breach within 72 hours.
• Delete or return data upon Customer's instruction after termination.

5. Customer Obligations

Customer is responsible for:

• Ensuring lawful data collection and transmission.
• Providing all required notices and obtaining consent.
• Ensuring instructions to CMS are lawful.
• Not submitting special categories of Personal Data unless agreed in writing.

6. Subprocessors

CMS may use the following categories of Subprocessors:

• Infrastructure providers (e.g., AWS, Google Cloud)
• Payment processors (e.g., Stripe)
• AI platform providers (e.g., OpenAI)
• Customer support tools (e.g., Intercom)

7. Data Transfers

CMS may transfer Personal Data outside the EU/EEA:

• Only to countries with adequate data protection laws
• Or using Standard Contractual Clauses or other legal mechanisms

8. Audit Rights

Customer may audit CMS (or appoint a third-party auditor) with reasonable prior notice. CMS shall cooperate and provide all necessary access, subject to confidentiality.

9. Liability and Indemnification

Each party's liability is subject to the limits set in the Principal Agreement. CMS is not liable for breaches caused by Customer's actions or unauthorized submissions.

10. Term and Termination

This DPA is effective for the duration of the Principal Agreement and survives termination as needed for data deletion, compliance, or legal obligations.

11. Contact

All questions related to this DPA should be sent to: hello@contentmakerstudio.com

12. Annexes