Terms of Use Privacy Policy Cookie Policy Data Processing Agreement Security Accessibility

Data Processing Agreement

GDPR Article 28 compliant · Version 1.0 · Effective 29 March 2026

Need a signed DPA for your organisation?

Complete the form at the bottom of this page. We will email a countersigned PDF DPA within 2 business days. This DPA is suitable for GDPR, UK GDPR, and Indian DPDP Act compliance. No legal negotiation required for standard terms — enterprise custom DPAs available on request.

Request Signed DPA → Email legal@postlister.com
Who needs a DPA? Any organisation in the EU, UK, or operating under GDPR whose employees use EngageLive as part of their work. Under GDPR Article 28, your organisation (the data controller) must have a written agreement with EngageLive (the data processor) before processing personal data. This page constitutes that agreement when countersigned.

1. Definitions

In this Agreement: "Controller" means the organisation whose employees use EngageLive; "Processor" means EngageLive / postlister.com; "Personal Data" means any information relating to an identified or identifiable person; "Processing" has the meaning given in GDPR Article 4(2); "GDPR" means Regulation (EU) 2016/679.

2. Subject Matter and Nature of Processing

The Processor provides a real-time audience engagement platform that allows the Controller's employees (hosts) to run interactive sessions with participants. Processing occurs as follows:

Data ElementSubjectsPurposeRetention
Host account data (email, name, organisation)Host/Controller staffAuthentication, plan management, session logging, purchase receipts, organisation featuresStored on Processor's encrypted MySQL server (Hostinger EU). Retained for lifetime of account. Deleted within 30 days of account deletion request.
Session activity data (poll responses, quiz answers, Q&A submissions)Session participantsReal-time display to host and participants during session; post-session analytics for hostFlows through Firebase Realtime Database for real-time delivery during session. Aggregated results archived on Processor's encrypted MySQL server per plan retention schedule (30 days Free; 180 days Starter; unlimited Pro/Business). Individual response data minimised — only aggregates stored long-term. Firebase real-time copy deleted at session end.
Participant names and emails (optional, if enabled by host)Session participantsIdentify participants on leaderboard/responses; enable host follow-up if host enables email collectionParticipant names associated with responses retained on Processor's encrypted server per plan retention schedule (same as response data above). Participant emails, if collected by host, are included in host's exportable session data and deleted after retention period. Participants can request deletion via the host or directly at support@postlister.com.
Purchase recordsEmployees of the Controller who purchase plansVerify active plan, apply participant limit increaseRetained for 13 months from purchase date for accounting purposes, then deleted.

3. Controller's Instructions

The Processor shall process Personal Data only on documented instructions from the Controller. The Controller's use of EngageLive constitutes its instructions to process data as described in Section 2. The Controller warrants that its instructions comply with applicable law.

4. Processor's Obligations

  1. Confidentiality: The Processor shall ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
  2. Security: The Processor shall implement appropriate technical and organisational measures as set out in Section 7.
  3. Sub-processors: The Processor shall not engage sub-processors without the Controller's general authorisation. The list of authorised sub-processors is in Section 6.
  4. Data subject rights: The Processor shall assist the Controller in responding to requests from data subjects to exercise their rights under GDPR Articles 15–22.
  5. Data breach notification: The Processor shall notify the Controller without undue delay (and in any case within 72 hours) of becoming aware of a Personal Data breach.
  6. Data Protection Impact Assessments: The Processor shall provide reasonable assistance to the Controller in relation to any DPIAs.
  7. Deletion on termination: Upon termination of services, the Processor shall delete or return all Personal Data.
  8. Audit rights: The Processor shall make available all information necessary to demonstrate compliance with this Article and allow for audits and inspections by the Controller.

5. International Data Transfers

Personal Data processed through EngageLive may be transferred to the following locations:

Data TypeLocationTransfer Mechanism
Session real-time messages (Firebase)Google Firebase — asia-southeast1 (Singapore)Google Cloud Standard Contractual Clauses; Firebase Data Processing Terms
Purchase recordsHostinger servers (EU — Lithuania)GDPR Art. 3 — data processed within EU/EEA
Payment dataPayPal (USA/Luxembourg); PayU (India)PayPal Standard Contractual Clauses; PayU DPDP compliance

6. Authorised Sub-processors

Sub-processorPurposeLocationPrivacy Policy
Google LLC (Firebase)Real-time database for session messagingSingapore (asia-southeast1)policies.google.com/privacy
Hostinger International LtdWeb hosting and file storageLithuania, EUhostinger.com/privacy-policy
PayPal Holdings IncPayment processing (optional)USA / Luxembourgpaypal.com
PayU Payments Pvt LtdPayment processing — India (optional)Indiapayu.in
Cloudflare IncCDN, DDoS protection, SSL terminationUSA (with EU servers)cloudflare.com

The Processor will notify the Controller of any intended changes to this list with at least 14 days' notice by email, giving the Controller the opportunity to object.

7. Technical and Organisational Security Measures

  1. Encryption in transit: All data transmitted between users and servers is encrypted using TLS 1.2 or higher. Firebase connections use WSS (WebSocket Secure).
  2. Encryption at rest: Purchase records stored on Hostinger servers are protected by Hostinger's platform-level encryption. Firebase data is encrypted at rest by Google.
  3. Minimal data retention: Only aggregated session results are archived on Processor application servers. Individual participant PII is not retained beyond session end. Firebase is used for real-time transit during the session.
  4. Access controls: Admin panel access is protected by password authentication. Server access is restricted by SSH key.
  5. Tiered retention and deletion: Firebase Realtime Database session data is automatically cleared at session end. Archived aggregated results are automatically purged after the plan's retention period (30/180 days or unlimited). Hosts can request immediate deletion of their session data via account settings or support@postlister.com.
  6. No tracking: No analytics SDKs, session recording tools, or behavioural tracking are deployed on EngageLive.
  7. Vulnerability disclosure: Security vulnerabilities can be reported to security@postlister.com. See our Security Policy.

8. Duration and Termination

This Agreement remains in force for as long as the Controller's employees use EngageLive. Either party may terminate by providing 30 days' written notice. On termination, the Processor shall delete all Personal Data within 30 days.

9. Governing Law

This Agreement is governed by the laws of India, with GDPR Article 28 obligations interpreted in accordance with EU law. For Controllers in the EU/EEA/UK, EU/UK GDPR takes precedence over conflicting provisions of Indian law in respect of data protection obligations only.

10. Standard Contractual Clauses

Where Personal Data of EU/UK data subjects is transferred outside the EEA/UK, the parties agree to be bound by the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor) as published on 4 June 2021 (EU SCCs), which are incorporated into this Agreement by reference.

Request a Countersigned DPA

Email us directly at legal@postlister.com with the following details and we will send a countersigned PDF DPA within 2 business days:

Include in your email
  • 1.Organisation name and registered country
  • 2.Contact name and job title (e.g. Data Protection Officer, Legal Counsel)
  • 3.Reply-to email address for the signed PDF
  • 4.Approximate number of users (for our records)
  • 5.Any special requirements — e.g. UK GDPR addendum, specific governing law, custom clauses (optional)
✉️ Email legal@postlister.com →

We respond to all DPA requests within 2 business days. For urgent requests or custom enterprise DPAs, contact legal@postlister.com directly with "URGENT DPA" in the subject line. We do not share your details with any third party.