Data Processing Agreement

1. Definitions

• Controller: The Organization using Community Magazine to collect and publish community content. The Controller determines the purposes and means of processing personal data.
• Processor: Community Magazine (the platform), which processes personal data on behalf of the Controller.
• Data Subject: An identified or identifiable natural person whose personal data is processed.
• Personal Data: Any information relating to a Data Subject, including names, email addresses, submission content, and usage data.
• Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion.
• Sub-processor: A third party engaged by the Processor to process personal data on behalf of the Controller.

2. Scope and Purpose

This Data Processing Agreement ("DPA") applies to the processing of personal data by Community Magazine on behalf of organizations using the platform for community magazine publishing. This DPA supplements and forms part of the Terms of Service and is governed by applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. Processing Details

• Nature of processing: Hosting and displaying community submissions, AI analysis for content grouping and safety, and text-to-speech generation.
• Purpose of processing: To enable community magazine publishing on behalf of the Controller.
• Duration of processing: For the term of the Controller's subscription agreement with Community Magazine.
• Categories of data: Names, email addresses, submission content (text, photos, audio recordings, drawings), and usage data.
• Categories of data subjects: Organization administrators, team members, and community contributors.

4. Controller Obligations

The Controller shall:

• Ensure there is a lawful basis for the processing of personal data in accordance with applicable data protection law.
• Inform data subjects about the processing of their personal data, including by providing a privacy notice that covers the processing carried out by the Processor.
• Cooperate with the Processor in responding to data subject requests and regulatory enquiries.

5. Processor Obligations

The Processor shall:

• Process personal data only on the documented instructions of the Controller, unless required to do so by applicable law.
• Ensure that persons authorised to process personal data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures to protect personal data against unauthorised or unlawful processing and accidental loss, destruction, or damage.
• Assist the Controller in responding to data subject requests, including requests for access, rectification, erasure, and portability.
• Notify the Controller without undue delay upon becoming aware of a personal data breach.
• Delete or return all personal data to the Controller on termination of the agreement, unless retention is required by law.

6. Sub-processors

The Processor engages the following sub-processors to assist in providing the platform. The Controller authorises the use of these sub-processors:

The Processor shall notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

7. Data Subject Rights

The Processor shall assist the Controller in responding to data subject requests, including:

• Right of access
• Right to rectification
• Right to erasure
• Right to data portability
• Right to restriction of processing
• Right to object to processing

The Processor shall respond to the Controller's requests for assistance within 30 days.

8. Security Measures

The Processor implements the following technical and organisational measures to protect personal data:

• TLS/HTTPS encryption for all data in transit
• bcrypt password hashing for stored credentials
• JWT HTTP-only cookies for secure session management
• Rate limiting on sensitive endpoints
• Role-based access control (RBAC) with four permission levels
• Multi-tenant data isolation with organizationId scoping on all queries
• Regular security reviews
• Audit logging of administrative actions

9. Data Breach Notification

The Processor shall notify the Controller within 72 hours of becoming aware of a personal data breach. The notification shall include:

• The nature of the personal data breach
• The categories of data affected
• The approximate number of data subjects affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach

10. International Data Transfers

Where sub-processors are located outside the United Kingdom or the European Economic Area, Standard Contractual Clauses (SCCs) are in place to ensure appropriate safeguards for the transfer of personal data. The Controller may request evidence of appropriate safeguards at any time.

11. Audit Rights

The Controller may audit the Processor's compliance with this DPA once per year with 30 days' written notice. The Processor shall provide the Controller with all information and access necessary to demonstrate compliance with the obligations set out in this agreement.

12. Term and Termination

This DPA is effective for the duration of the Controller's subscription agreement with Community Magazine. On termination of the subscription, the Processor shall delete all personal data within 90 days, unless retention is required by applicable law.