GDPR & Data Processing

The General Data Protection Regulation (EU) 2016/679 ("GDPR") and the equivalent UK GDPR set out comprehensive rules for how personal data must be collected, used, stored, and transferred. This page explains how those rules apply to EngageIQ — both as a data controller in our own right and as a data processor acting on behalf of our customers.

This page applies if you are:

• A customer of EngageIQ who is subject to the GDPR or UK GDPR.
• An individual in the EU or UK whose data EngageIQ processes.
• A legal, compliance, or procurement professional evaluating EngageIQ.

“Personal Data”

Any information relating to an identified or identifiable natural person (a 'data subject').

“Processing”

Any operation performed on personal data — including collection, storage, use, disclosure, and deletion.

“Controller”

The entity that determines the purposes and means of processing personal data. Controllers make the key decisions about what is processed, why, and how.

“Processor”

An entity that processes personal data on behalf of and under the instructions of a controller.

“Sub-processor”

A third party engaged by a processor to carry out specific processing activities on behalf of the controller.

“Data Processing Addendum (DPA)”

A contract between a controller and processor that governs the processor's handling of personal data, as required by GDPR Art. 28.

“Standard Contractual Clauses (SCCs)”

Model contract terms approved by the European Commission for lawfully transferring personal data from the EEA to third countries.

“Data Subject”

The identified or identifiable natural person whose personal data is processed.

EngageIQ operates in two distinct roles depending on the category of personal data and the context of processing:

EngageIQ as Data Controller

EngageIQ is the controller for personal data we collect and use for our own purposes, including:

• Account and registration data (name, work email, company, role) of our direct customers and workspace members.
• Billing and payment data required to process subscriptions.
• Usage and log data collected automatically when customers use our platform.
• Support and communications data when customers contact us.

Our Privacy Policy governs this processing. Our lawful bases as a controller are described in §03 below.

EngageIQ as Data Processor

EngageIQ is a processor for the personal data our customers upload, send, or generate through the platform — including contact profiles, end-user event data, and the content of campaigns. In this role:

• The customer is the controller and determines the purpose and means of processing.
• EngageIQ processes data only on documented instructions from the customer.
• Our Data Processing Addendum (DPA) governs this relationship and satisfies GDPR Art. 28.
• We assist customers in meeting their obligations including DSR responses and breach notification.

Where EngageIQ acts as controller, we rely on the following lawful bases under GDPR Art. 6:

Special category data

EngageIQ does not intentionally collect or process special category data (Art. 9) such as health data, biometric data, or data revealing racial or ethnic origin. If a customer's use case involves special category data, the customer as controller is responsible for establishing an appropriate Art. 9 basis and implementing additional safeguards.

The GDPR grants individuals specific rights over their personal data. The table below explains each right and how it applies to EngageIQ's processing activities.

Identity verification

To protect your data, we verify the identity of all requesters before acting on a DSR. For account holders, this typically involves authenticating via the account associated with the request. For non-account holders or third-party requests, additional verification may be required. We will never charge a fee for a first DSR; repeated or manifestly unfounded requests may be subject to a reasonable fee or refusal.

Right to lodge a complaint

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, contact the supervisory authority in your EU member state. For UK residents, contact the Information Commissioner's Office (ICO).

GDPR Art. 28 requires that controllers only use processors who provide sufficient guarantees, and that the relationship is governed by a binding contract — the DPA. Our DPA covers:

• The subject matter, duration, nature, and purpose of the processing.
• The type of personal data processed and categories of data subjects.
• Our obligations and rights as processor, including instructions compliance.
• Confidentiality and access restrictions for EngageIQ personnel.
• Technical and organizational security measures (Article 32).
• Sub-processing arrangements and prior notice obligations.
• Assistance with data subject rights, security breaches, and DPIAs.
• Data deletion or return upon termination of the Services.
• Audit rights and provision of information demonstrating compliance.
• Standard Contractual Clauses for international data transfers.

How to obtain a signed DPA

Email legal@engageiq.com with the subject line "DPA Request" and include your company name, registered address, and the name and title of your authorized signatory. We will send a pre-signed copy within 2 business days. Enterprise customers can negotiate custom DPA terms via their account manager.

EngageIQ's primary infrastructure is located in the United States (AWS us-east-1). When EngageIQ processes personal data from the EEA or UK, this constitutes a transfer of personal data to a third country. We rely on the following transfer mechanisms:

EU Standard Contractual Clauses (SCCs)

Our DPA incorporates the EU SCCs (Commission Implementing Decision (EU) 2021/914 — Module 2: controller to processor) for transfers from the EEA to the United States. These SCCs have been assessed against the legal framework of the United States and include the supplementary measures required by the EDPB following the Schrems II ruling.

UK International Data Transfer Agreement (IDTA)

For transfers from the United Kingdom, our DPA incorporates the UK IDTA (or UK Addendum to EU SCCs) as approved by the Information Commissioner's Office.

Data residency options

Enterprise customers may request data residency in AWS EU regions (eu-west-1 or eu-central-1) to keep personal data within the EEA. This requires a dedicated deployment. Contact sales@engageiq.com to discuss availability and pricing.

As a processor, EngageIQ may engage sub-processors to assist in delivering the Services. We have executed data-processing agreements with all sub-processors and require them to maintain security and privacy standards at least equivalent to our own. Our full sub-processor list is maintained at engageiq.com/subprocessors.

We notify customers of new or changed sub-processors by email and via the subprocessors page at least 30 days before the change takes effect. Customers who have executed a DPA with us may object to a new sub-processor in writing within that 30-day window. If we are unable to accommodate the objection, the customer may terminate the affected Services without penalty.

GDPR Art. 32 requires that processors implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Our TOMs include:

• Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256, AWS KMS).
• Pseudonymization of personal data where technically feasible and appropriate.
• Ongoing confidentiality, integrity, availability, and resilience of processing systems.
• Regular testing and evaluation of technical and organizational security measures.
• Ability to restore availability and access to data following a physical or technical incident.
• Role-based access control (RBAC) with least-privilege principles.
• Multi-factor authentication mandatory for all personnel with system access.
• Annual penetration testing by independent third parties.
• Formal incident response plan with breach notification procedures.

Full details of our security program are available on our Security page. Enterprise customers can request our security questionnaire responses and TOMs annex by contacting security@engageiq.com.

In the event of a personal data breach, EngageIQ will:

• Notify affected customers without undue delay and in any event within 72 hours of becoming aware of the breach (where feasible), so that customers can meet their own GDPR Art. 33 notification obligations to supervisory authorities.
• Provide sufficient information to enable customers to assess the breach — including the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.
• Cooperate fully with customers throughout the investigation and remediation process.
• Maintain a breach register as required by GDPR Art. 33(5).

Customers should designate a primary security contact in their EngageIQ account settings to receive breach notifications. Breach notifications are sent to the account email address and the designated security contact.

We retain personal data only as long as necessary for the purposes described, or as required by law.

EngageIQ has designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and ensuring compliance with the GDPR. Our DPO can be contacted directly for matters relating to personal data processing, supervisory-authority liaison, and GDPR rights.