Data Processing Agreement
A Data Processing Agreement is a contract required by GDPR whenever one company handles personal data on behalf of another. Here, a business customer (the controller — e.g. an agency or company using ClickCarousel) decides what happens to the data, and ClickCarousel (the processor) only handles it on their instructions. The DPA locks in how we protect that data: security, who our sub-processors are, breach notifications, deletion, and support for data-subject rights. If you're an individual creator on a normal plan, our Privacy Policy already covers you — the DPA matters mainly for business/agency customers.
1. Scope and roles
This DPA forms part of the agreement between the customer ("Controller") and ClickCarousel FZ-LLC, a free zone company registered in Ras Al Khaimah, United Arab Emirates ("ClickCarousel", the "Processor") for use of the Service. It applies where ClickCarousel processes personal data on the Controller's behalf. Where terms conflict, this DPA prevails on data-protection matters.
2. Processing on instructions
ClickCarousel processes personal data only on the Controller's documented instructions (including via the Service's features), except where required by law — in which case we will inform the Controller unless legally prohibited.
Data you must not upload. The Service is not built to hold sensitive personal data, and the Controller must not put it there. That means government identifiers, passport or driving licence numbers, full payment card numbers, financial account details, health or genetic or biometric data, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, criminal records, and account passwords — in other words the special categories of data under applicable data-protection law. ClickCarousel has no liability for sensitive personal data uploaded in breach of this paragraph, including in connection with a personal-data breach, and this DPA does not apply to it.
3. Details of processing (Annex A)
| Subject matter | Creating, scheduling and publishing social content via the Service. |
|---|---|
| Duration | For the term of the agreement, plus deletion/return period. |
| Nature & purpose | Hosting, generating, editing, storing, scheduling and transmitting content to the social platforms the Controller connects. |
| Types of personal data | Account and contact details; social profile identifiers and access tokens; content, captions and comments; usage data. |
| Categories of data subjects | The Controller's users, team members and any individuals referenced in content. |
4. Confidentiality
ClickCarousel ensures that personnel authorised to process personal data are bound by confidentiality obligations and receive appropriate training.
5. Security (Annex B)
ClickCarousel implements appropriate technical and organisational measures, including: encryption in transit; encryption of stored access tokens and secrets; access controls and least-privilege; logging and monitoring; regular backups; and secure software-development practices. Measures may be updated provided the level of protection is not reduced.
6. Sub-processors
The Controller authorises ClickCarousel to engage sub-processors under written terms that impose data-protection obligations equivalent to this DPA. The current list is published on our Third-Party Terms & Sub-processors page. We will give notice of intended changes, allowing the Controller a reasonable opportunity to object on reasonable grounds.
7. Data-subject requests
Taking into account the nature of the processing, ClickCarousel assists the Controller with appropriate measures to respond to data-subject requests (access, rectification, erasure, portability, restriction and objection), and forwards any such requests it receives directly.
8. Personal-data breach
ClickCarousel notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, and provides information reasonably available to help the Controller meet its own notification duties.
9. Return and deletion
On termination, and at the Controller's choice, ClickCarousel deletes or returns the personal data and deletes existing copies, unless retention is required by law.
10. Audits
ClickCarousel makes available the information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections.
How that right is exercised. The Controller may audit once per calendar year, on at least 30 days of written notice, during normal business hours, subject to confidentiality and at its own cost. An audit is satisfied in the first instance by the information, documentation and written answers ClickCarousel provides. An audit must not disrupt the Service or risk the confidentiality of data belonging to another customer.
11. International transfers
Where processing involves transfers of personal data outside the EEA/UK, the parties rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses, which are incorporated by reference.
12. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the main agreement.
13. Governing law
This DPA is governed by the laws of the United Arab Emirates as applied in the Emirate of Ras Al Khaimah, including the regulations of the free zone in which ClickCarousel FZ-LLC is registered — without prejudice to the data-protection law applicable to the Controller, and to the Standard Contractual Clauses, which are governed as provided in those clauses.
14. Contact
Data-protection contact: support@clickcarousel.com. To request a signed DPA, contact legal@clickcarousel.com.
ClickCarousel FZ-LLC, Al Hulaila Free Zone, Ras Al Khaimah, United Arab Emirates. Trade licence no. 47037051.