Data processing agreement (DPA)

Last updated: November 4, 2026. Version 1 of this document.

This agreement governs how we process, on behalf of each customer company, the personal data it stores or generates in Talent360Marketing, in accordance with Article 28 GDPR.

1. Parties and acceptance

Controller: the customer company that creates an account in Talent360Marketing (the «Customer»). Processor: TALENT360HUB LLC, a Bulgarian company operating the Talent360Marketing brand, with registered and tax address at 10 Stefan Verkovich, Plovdiv 4000 (Bulgaria) and EIK/VAT number BG208378160. Its head office is at the European Trade Center, Building D, 1F, 115 M Tsarigradsko Shose Blvd., Sofia 1784 (Bulgaria), and its Western Europe office at Nevelgaarde 8, 3436 ZZ Nieuwegein (Netherlands) («we»).

The person who signs the company up accepts this agreement on its behalf when creating the account; we record the date and the accepted version. It forms part of the terms of use and, in case of conflict regarding personal data, this agreement prevails.

2. Subject matter, duration, nature and purpose

Subject matter: hosting, storing, organizing, consulting, generating with AI, publishing, analyzing and erasing the data the Customer stores in the application or obtains through its integrations.
Purpose: providing the Talent360Marketing service and the features and integrations the Customer enables.
Duration: while the Customer has an account, plus the deletion period set out in «End of processing».

3. Data and data subjects

Data subjects: the Customer's users; people who appear in its content, images, campaigns and reports; and followers, contacts or audiences of the networks and services it connects, to the extent their data reaches the application (for example, in metrics or synced lists).
Data: identification and contact data, images, texts, profile data and aggregated metrics of social networks and campaigns, and any other data the Customer chooses to upload or include in its instructions to the AI.
The Customer must not store special categories of data (Art. 9 GDPR) or children's data unless it has a legal basis to do so and does it with appropriate safeguards.

4. Customer's instructions

We process the data only on the Customer's documented instructions, which are this agreement and the Customer's configuration and use of the application. We do not use it for our own purposes. If an instruction seems to infringe the law, we will say so. If the law requires us to process data otherwise, we will inform the Customer beforehand, unless the law prohibits it.

5. Confidentiality

People authorized to process the data are bound by confidentiality and only access it when necessary to provide the service, give support requested by the Customer or resolve incidents.

6. Security measures (Art. 32 GDPR)

Encryption in transit (HTTPS) and integration credentials encrypted at rest.
Isolation of each account's data in every query, and role-based access control within it.
Passwords hashed with bcrypt, sign-in attempt limits, sessions ended on password change or deactivation, and a second factor for system administrators.
Private files served through signed links that expire, in storage separated by account.
Verified signatures on the payment notifications we receive, and database backups.

7. Sub-processors

The Customer gives us general authorization to engage the sub-processors listed in the privacy policy. We bind them by contract to data protection obligations equivalent to those in this agreement and remain liable for their compliance.

We will give 30 days' notice of any new or replaced sub-processor in the application or by email. If the Customer objects on reasonable data protection grounds and no solution is found, it may close its account without penalty.

Services the Customer connects on its own (for example, its social network, Google, Mailchimp, HubSpot or CMS accounts) are not our sub-processors: the Customer chooses and contracts them.

8. Assistance to the Customer

The application lets the Customer view, correct and delete its data to handle data subjects' rights. If a request reaches us directly, we will forward it to the Customer without answering it ourselves.
We will help the Customer, with the information available to us, with its impact assessments and consultations with the supervisory authority.

9. Security breaches

We will notify the Customer of any security breach affecting its data without undue delay and, where possible, within 48 hours of becoming aware of it, with the information available so it can meet its own notification obligations.

10. International transfers

Transfers made by our sub-processors outside the EEA rely on an adequacy decision (including the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

11. End of processing

When the account is closed, we delete the Customer's data and files; backups are overwritten within the period stated in the privacy policy. Before closing, the Customer can ask us for a copy of its data. We will only keep what the law requires us to keep, such as billing.

12. Information and audits

We will make available to the Customer the information needed to demonstrate compliance with this agreement. The Customer can request it at privacy@talent360hub.com and, if it is not enough, carry out an audit once a year, with 30 days' notice, at its own cost and without access to other customers' data.