Data Processing Agreement

Version 2.0 · Published 27 October 2026. This agreement forms part of the SirenDM Terms of Service (the "Terms"). The customer accepts it by accepting the Terms. It replaces section 7 of the Terms dated 29 April 2026.

Parties

• SirenDM (the processor).
• Customer: the business that holds a SirenDM CRM account and accepted the Terms (the controller).

1. Definitions

1.1 GDPR means Regulation (EU) 2016/679. UK GDPR means the GDPR as kept in UK law. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have their GDPR meaning.

1.2 Customer Personal Data means the personal data described in Annex 1 that SirenDM processes for the customer when providing SirenDM CRM.

1.3 Fan means a person who chats with one of the customer's agents, on any connected platform, a web chat page or a partner's app.

1.4 Sub-processor means a third party SirenDM engages to process Customer Personal Data.

1.5 SCCs means the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

2.1 The customer is the controller of Customer Personal Data. SirenDM is the processor.

2.2 What this agreement does not cover. SirenDM is a controller, not a processor, for:

1. the customer's own account, login and billing data, and team members' login data;
2. calculating and collecting the fees the customer owes SirenDM, including the fee on sales;
3. detecting and reporting child sexual abuse material and other clearly illegal content, and answering binding orders of courts and authorities;
4. establishing or defending legal claims.

SirenDM's Privacy Policy covers those uses.

2.3 Where the customer is itself a processor. If the customer acts for another controller (for example an agency acting for a creator), the customer confirms that controller has authorised this agreement and SirenDM's sub-processors. SirenDM may treat the customer's instructions as that controller's instructions.

3. Instructions

3.1 SirenDM processes Customer Personal Data only on the customer's documented instructions, including for transfers outside the EEA, unless EU or Czech law requires otherwise. In that case SirenDM tells the customer first, unless that law forbids it (Art. 28(3)(a)).

3.2 The customer's documented instructions are:

1. the Terms and this agreement;
2. the customer's use and configuration of SirenDM CRM: connecting accounts, setting up agents, personas, scripts, media, prices, follow-ups, modes and outreach campaigns;
3. any other written instruction the customer gives and SirenDM accepts;
4. to review agents, media and chats where needed to support the customer, keep the service secure, prevent abuse, and check content for legality and compliance with the Terms, with access limited to what each check needs.

3.3 Unlawful instructions. SirenDM tells the customer if, in its opinion, an instruction breaks the GDPR or other EU or Czech data protection law (Art. 28(3), last paragraph). SirenDM may refuse to carry it out until the customer confirms or changes it in writing. This is not legal advice and does not make SirenDM responsible for the customer's compliance.

3.4 Aggregated statistics. The customer instructs SirenDM to create statistics that combine Customer Personal Data with data of many other customers and that do not identify any fan, customer, agent, script or price list, such as conversion rates by price band or conversation stage across all accounts. SirenDM may use them to improve its products. SirenDM will not try to re-identify anyone from them and will not use them to reveal one customer's scripts, prices, media or results to anyone else.

4. Customer's duties

4.1 The customer must:

1. have a lawful basis for all processing it instructs, and give fans the privacy information the law requires, including that AI is used and which AI providers receive their messages (Annex 3);
2. obtain the explicit consent of fans before the processing of their sex-life data where Art. 9 GDPR requires it;
3. disclose AI to fans as section 6 of the Terms requires (in the bio, and truthfully when a fan asks), and never instruct an agent or a team member to deny being AI;
4. label AI-generated images, video and voice of realistic people that it sends, where Art. 50(4) of the AI Act or a platform's rules require it;
5. only upload content of adults who consented to it, and have written consent from anyone whose voice it uploads;
6. not use SirenDM CRM to chat with anyone it knows or suspects is under 18;
7. have prior consent, or another basis the law allows, before contacting anyone through outreach or mass messages;
8. not instruct SirenDM to collect special-category data it does not need;
9. tell SirenDM without undue delay if it learns of a breach or misuse involving the service.

4.2 The customer is responsible for the accuracy and lawfulness of the data it brings into the service and of its instructions.

5. Confidentiality

5.1 SirenDM ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, by contract or by law (Art. 28(3)(b)). Access is limited to people who need it for their work.

6. Security

6.1 SirenDM takes the technical and organisational measures in Annex 2 (Art. 28(3)(c), Art. 32). The customer has reviewed them and agrees they are appropriate for the risk, taking into account the nature of the data.

6.2 SirenDM may change the measures, as long as the overall level of protection does not go down.

7. Sub-processors

7.1 General authorisation. The customer gives SirenDM general written authorisation to engage sub-processors (Art. 28(2)). The current list is in Annex 3.

7.2 Changes. SirenDM tells the customer by email before adding or replacing a sub-processor. Where the service needs it (for example a provider failure), SirenDM may switch at once and tell the customer afterwards.

7.3 Objection. The customer may object in writing within 10 days of the notice on reasonable data protection grounds. If SirenDM keeps the sub-processor, the customer's only remedy is to end the contract.

7.4 Flow-down. SirenDM uses sub-processors whose terms give sufficient guarantees of appropriate security measures (Art. 28(4)). Where a sub-processor offers only standard terms, SirenDM relies on those terms.

7.5 Responsibility. SirenDM remains liable to the customer for its sub-processors' performance as Art. 28(4) GDPR requires, within the limits in section 13.

7.6 Platforms are not sub-processors. Telegram, Fanvue, 4Based, f2f.com, Tribute, the payment providers fans use, and the customer's own voice provider are services the customer chose to connect. They act under their own terms as independent controllers or as the customer's own processors. SirenDM does not control them and is not responsible for them.

8. International transfers

8.1 SirenDM transfers Customer Personal Data outside the EEA only:

1. to a country with an EU adequacy decision (including Switzerland, and the United States for companies certified under the EU–US Data Privacy Framework);
2. under the SCCs with the sub-processor; or
3. under another safeguard allowed by Chapter V GDPR.

8.2 Customers outside the EEA. If the customer is established outside the EEA and not covered by an adequacy decision, the SCCs Module 4 (processor to controller) apply between SirenDM (data exporter) and the customer (data importer) and are incorporated by reference, with these choices: Clause 7 (docking) applies; Clause 17 Czech law; Clause 18 the courts of Prague. Annexes 1 and 2 of this agreement fill in Annexes I and II of the SCCs.

8.3 UK. For transfers subject to UK GDPR, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with Table 1 filled from the Parties section, Tables 2 and 3 from this section and the Annexes, and in Table 4 either party may end it.

8.4 If the SCCs and this agreement conflict, the SCCs prevail.

9. Helping the customer

9.1 Rights requests. SirenDM helps the customer, as far as possible and taking into account the nature of the processing, to answer fans' requests to exercise their rights (Art. 28(3)(e)):

1. If a fan writes to SirenDM about the customer's data, SirenDM forwards the request to the customer without undue delay and does not answer it itself, unless the customer asks it to.
2. The customer can delete an agent and its chats in the dashboard. For anything the dashboard cannot do (finding all data of one fan, export, deletion of a single fan), SirenDM does it by hand on the customer's written request, without undue delay, and may charge a reasonable fee for repeated requests.

9.2 Security, breaches, impact assessments, consultation. SirenDM helps the customer meet Art. 32 to 36 GDPR, taking into account the information available to SirenDM (Art. 28(3)(f)). For a data protection impact assessment, SirenDM provides Annexes 1 to 3 and answers reasonable written questions. Help beyond that is charged at a reasonable hourly rate. SirenDM does not charge for help needed because of its own breach of this agreement.

10. Personal data breaches

10.1 SirenDM tells the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data (Art. 33(2)).

10.2 The notice says, as far as known at the time: what happened; the categories and approximate numbers of fans and records involved; the likely consequences; what SirenDM has done and proposes to do; and a contact person. SirenDM sends further information as it learns it.

10.3 The customer decides whether to notify the supervisory authority and fans. SirenDM does not notify them on the customer's behalf unless the customer asks it to or the law requires it.

10.4 Notice of a breach is not an admission of fault or liability.

11. End of the service: return and deletion

11.1 Export. For 30 days after the Terms end, the customer may ask for an export of Customer Personal Data still held. SirenDM provides it in a machine-readable format within 30 days of the request.

11.2 Deletion. After that 30-day window, SirenDM deletes Customer Personal Data (Art. 28(3)(g)), unless EU or Czech law requires SirenDM to keep it. Copies in database backups disappear when the backups expire and are not restored in the meantime except to recover the service.

11.3 During the service. Chat messages are deleted automatically on the schedule in Annex 1, and the customer can delete agents, media and the account at any time.

12. Information and audits

12.1 Information first. SirenDM makes available the information needed to show compliance with Art. 28 (Art. 28(3)(h)). The customer agrees that this is done first by:

1. this agreement and its Annexes;
2. SirenDM's written answers to a reasonable security or data protection questionnaire, at most once in any 12 months;
3. any certificates or reports of SirenDM's sub-processors that SirenDM can share.

12.2 Audits. If the information under 12.1 is not enough to show compliance, the customer, or an independent auditor it appoints who is bound by confidentiality and is not a competitor of SirenDM, may audit SirenDM:

1. at most once in any 12 months, unless there has been a personal data breach affecting the customer or a supervisory authority requires it;
2. on at least 30 days' written notice (7 days after a breach), with an agreed scope;
3. during business hours, remotely where possible, and without unreasonable disruption;
4. at the customer's own cost, including SirenDM's time at a reasonable hourly rate;
5. without access to other customers' data, to sub-processors' premises, or to information SirenDM must keep confidential by law.

12.3 Audits of sub-processors are done through their own reports and audit terms.

12.4 Nothing in this section limits the powers of a supervisory authority.

13. Liability

13.1 Each party's liability under this agreement is subject to the limits and exclusions in the Terms (section 19). Those limits apply to this agreement and the Terms together; they are one cap, not two.

13.2 Those limits do not apply where the law does not allow them, including harm caused intentionally or by gross negligence, and harm to a person's natural rights (Czech Civil Code § 2898).

13.3 Nothing in this agreement limits either party's liability to fans under Art. 82 GDPR. Between the parties, each party bears the share of compensation that matches its part of the responsibility for the harm (Art. 82(5)). If SirenDM pays a fan more than its share, the customer reimburses the difference.

13.4 The customer's indemnity in section 18 of the Terms applies to this agreement, in particular to any breach of section 4.

14. Term, precedence, changes

14.1 This agreement applies as long as SirenDM processes Customer Personal Data. Sections 11, 12, 13 and this section survive until deletion is complete.

14.2 Order of precedence: the SCCs (where they apply), then this agreement, then the Terms. On data protection matters this agreement prevails over the Terms.

14.3 SirenDM may change this agreement under the change procedure in the Terms (section 21 of the Terms). A change required by law or by a supervisory authority may apply sooner. A change may not reduce the protection of Customer Personal Data below what the GDPR requires.

14.4 Governing law and courts are as set out in the Terms (Czech law, courts of Prague), except where the SCCs say otherwise.

Annex 1: Description of the processing

Categories of data subjects: fans of the customer's agents; people the customer contacts through outreach or mass messages; people shown in media the customer uploads; third parties fans mention in chats; the customer's team members, for their work activity.

Categories of personal data:

• Platform identity: platform user ID, name, username, profile photo; for Telegram, the country Telegram reports for the phone number, the account's registration month and groups the fan shares with the agent.
• For outreach targets: public profile details and the group they were found in.
• Messages: text of fan messages and replies, timestamps, platform message IDs.
• Fan media: photos, voice notes and videos fans send, and their transcripts and descriptions.
• Derived data: language, city or region, conversation stage, mood, intent and other labels, notes and memory about the fan and people the fan mentions.
• Purchases: items offered and bought, prices, totals, payment method and references.
• Safety flags: under-18 statements, handover reasons, blocks.
• Customer media, including AI voice notes.
• Team activity: names, shifts, sales credit, dashboard actions.

Special categories of data (Art. 9). Chats are sexual and reveal fans' sex life and sometimes sexual orientation. Fans may mention their health. Safeguards: the customer's explicit-consent duty (section 4.1(b)); automatic deletion of chat messages; access separated by account.

Retention during the service:

Annex 2: Technical and organisational measures

SirenDM is a very small business, and these measures are sized to that.

1. The database, file storage and login run on Supabase, which encrypts stored data at rest and uses TLS for connections.
2. Backend services run on DigitalOcean servers. They are reached through a Cloudflare Tunnel, and the dashboard and APIs are served over HTTPS.
3. Each customer's data is separated by account. Database row-level security limits what each logged-in user can read.
4. Customers control which team members see which agents.
5. Service keys are kept on the server side only.
6. Chat messages are deleted automatically on the schedule in Annex 1, and every deletion run is logged.
7. Fan IP addresses on web chat are used only for rate limiting and are not stored.
8. Fan card details are handled by the payment provider; SirenDM never receives full card numbers.
9. Service errors are reported to SirenDM automatically.
10. Everyone with access is bound by confidentiality.

Annex 3: Sub-processors

Not sub-processors (section 7.6): Telegram, Fanvue, 4Based, f2f.com, Tribute, Telegram Stars, Fish Audio and ElevenLabs (customer's own account).