Data Processing Agreement

GDPR Article 28 compliant · Version 1.0 · Effective 29 March 2026

1. Definitions

In this Agreement: "Controller" means the organisation whose employees use EngageLive; "Processor" means EngageLive / postlister.com; "Personal Data" means any information relating to an identified or identifiable person; "Processing" has the meaning given in GDPR Article 4(2); "GDPR" means Regulation (EU) 2016/679.

2. Subject Matter and Nature of Processing

The Processor provides a real-time audience engagement platform that allows the Controller's employees (hosts) to run interactive sessions with participants. Processing occurs as follows:

3. Controller's Instructions

The Processor shall process Personal Data only on documented instructions from the Controller. The Controller's use of EngageLive constitutes its instructions to process data as described in Section 2. The Controller warrants that its instructions comply with applicable law.

4. Processor's Obligations

1. Confidentiality: The Processor shall ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
2. Security: The Processor shall implement appropriate technical and organisational measures as set out in Section 7.
3. Sub-processors: The Processor shall not engage sub-processors without the Controller's general authorisation. The list of authorised sub-processors is in Section 6.
4. Data subject rights: The Processor shall assist the Controller in responding to requests from data subjects to exercise their rights under GDPR Articles 15–22.
5. Data breach notification: The Processor shall notify the Controller without undue delay (and in any case within 72 hours) of becoming aware of a Personal Data breach.
6. Data Protection Impact Assessments: The Processor shall provide reasonable assistance to the Controller in relation to any DPIAs.
7. Deletion on termination: Upon termination of services, the Processor shall delete or return all Personal Data.
8. Audit rights: The Processor shall make available all information necessary to demonstrate compliance with this Article and allow for audits and inspections by the Controller.

5. International Data Transfers

Personal Data processed through EngageLive may be transferred to the following locations:

6. Authorised Sub-processors

The Processor will notify the Controller of any intended changes to this list with at least 14 days' notice by email, giving the Controller the opportunity to object.

7. Technical and Organisational Security Measures

1. Encryption in transit: All data transmitted between users and servers is encrypted using TLS 1.2 or higher. Firebase connections use WSS (WebSocket Secure).
2. Encryption at rest: Purchase records stored on Hostinger servers are protected by Hostinger's platform-level encryption. Firebase data is encrypted at rest by Google.
3. Minimal data collection: Session response data is never written to Processor application servers. Firebase is used solely for transit, not storage.
4. Access controls: Admin panel access is protected by password authentication. Server access is restricted by SSH key.
5. Automatic deletion: Firebase Realtime Database session data is automatically deleted at session end through Firebase Security Rules with TTL.
6. No tracking: No analytics SDKs, session recording tools, or behavioural tracking are deployed on EngageLive.
7. Vulnerability disclosure: Security vulnerabilities can be reported to security@postlister.com. See our Security Policy.

8. Duration and Termination

This Agreement remains in force for as long as the Controller's employees use EngageLive. Either party may terminate by providing 30 days' written notice. On termination, the Processor shall delete all Personal Data within 30 days.

9. Governing Law

This Agreement is governed by the laws of India, with GDPR Article 28 obligations interpreted in accordance with EU law. For Controllers in the EU/EEA/UK, EU/UK GDPR takes precedence over conflicting provisions of Indian law in respect of data protection obligations only.

10. Standard Contractual Clauses

Where Personal Data of EU/UK data subjects is transferred outside the EEA/UK, the parties agree to be bound by the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor) as published on 4 June 2021 (EU SCCs), which are incorporated into this Agreement by reference.