Data Processing Addendum

Terms that govern our processing of personal data on your behalf under the EU General Data Protection Regulation (GDPR).

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the FactMatters Terms of Service between you ("Customer", acting as the Controller) and Serpact OOD ("FactMatters", acting as the Processor). It applies when FactMatters processes personal data on your behalf in the course of providing the service.

2. Subject matter & duration

FactMatters processes Customer Personal Data for the purpose of operating the fact-checking service, including user authentication, running fact-checks, billing, and customer support. Processing continues for the duration of the service agreement, plus any period required by law for record-keeping.

3. Categories of data & data subjects

  • Categories of data: account identifiers (name, email, Google subject ID), billing identifiers, text content submitted for fact-checking, fact-check results, usage logs.
  • Categories of data subjects: Customer's end users and any individuals referenced in the text content Customer submits.

4. Processor obligations

  • Process Customer Personal Data only on documented instructions from the Customer, including those set out in the Terms of Service and this DPA.
  • Ensure that personnel authorised to process the data are bound by confidentiality.
  • Implement appropriate technical and organisational measures as described on the Security page.
  • Assist the Customer with data subject requests, breach notifications, and DPIAs where applicable.
  • Delete or return Customer Personal Data at the end of the service, except where retention is required by law.

5. Sub-processors

Customer provides general authorisation for FactMatters to engage the sub-processors listed on the Security page. FactMatters will impose obligations on each sub-processor equivalent to those in this DPA and remains liable for the performance of their obligations. We will post notice of any intended change of sub-processors on the Security page so Customer has a reasonable opportunity to object.

6. International transfers

Where personal data is transferred outside the European Economic Area, FactMatters relies on the European Commission's Standard Contractual Clauses (2021/914) or an equivalent lawful transfer mechanism. Details are available on request.

7. Security incidents

FactMatters will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably requested by the Customer to meet its own notification obligations under Article 33 GDPR.

8. Audits

On reasonable prior written notice, FactMatters will make available information necessary to demonstrate compliance with Article 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to confidentiality obligations and reasonable scheduling.

9. Signing the DPA

If your organisation requires a countersigned copy of this DPA, email contact@serpact.com from an authorised account with your company legal name, billing address, and the name and title of the signatory. We will return a signed copy within five business days.