Data Processing Agreement

This Data Processing Agreement ("DPA") is between Pinnacle Partners Alliance Ltd, company no. C26234170, 49 Avenue Belle Rose, Quatre Bornes, Mauritius ("Processor", "we") and each customer that uses Marketiflo to process personal data about other people ("Controller", "you"). It forms part of, and is accepted together with, the Terms & Conditions when you create an account or add a client workspace. It is the written contract required by section 31(4)(b) of the Data Protection Act 2017 (the "Act").

1. Roles and scope

For personal data you put into the Service about your own clients, their customers and audiences, or people who interact with your social media accounts ("Customer Personal Data"), you are the controller and we are the processor. This DPA covers only that data. Data we process for our own purposes (your account, billing, support, security) is covered by our Privacy Policy, where we are the controller.

2. Instructions

We process Customer Personal Data only on your documented instructions. Your instructions are: these Terms and this DPA, your configuration of the Service, and the actions you take in it (for example asking us to publish a post, generate content or read comments). We will not process it for any other purpose, unless the law requires us to, in which case we will tell you first unless the law forbids that. If we believe an instruction breaks the Act or other data protection law, we will tell you promptly.

3. Security (section 31(1))

We implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These are described in Annex 2. We review them regularly and may improve them, but will not reduce the overall level of protection.

4. Confidentiality

Anyone we authorise to access Customer Personal Data is bound by a duty of confidentiality and has access only to the extent needed to provide the Service.

5. Sub-processors

You give general authorisation for us to use the sub-processors listed in Annex 3. We impose on each one, by written contract, data protection obligations at least as protective as this DPA, including acting only on instructions and keeping the data secure. We remain responsible to you for their performance. We will give you at least 14 days' notice (by email or in the app) before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may end the affected part of the Service and we will refund any prepaid fees for the unused period.

6. Transfers outside Mauritius (sections 36 and 35)

Sub-processors may process Customer Personal Data outside Mauritius, in the countries listed in Annex 3. We transfer data only where a condition in section 36 of the Act is met, relying on appropriate safeguards (the sub-processor's data processing agreement, including standard contractual clauses where offered, and its security commitments). Where adequate safeguards cannot be provided, we will not transfer without the Commissioner's prior authorisation under section 35.

7. Helping you with individuals' rights

Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures, to respond to requests from individuals exercising their rights under sections 37 to 41 of the Act (access, rectification, erasure, restriction, objection, and rights about automated decisions). If an individual contacts us directly about Customer Personal Data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to.

8. Impact assessments and prior consultation (sections 34 and 35)

We will give you the information you reasonably need, about our part of the processing, to carry out a data protection impact assessment and any prior consultation with the Commissioner.

9. Personal data breaches (section 25)

We will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data, so that you can meet your own 72-hour duty to notify the Commissioner. We will describe the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed, and send further information as it becomes available. We will not notify the Commissioner or individuals about Customer Personal Data on your behalf unless you ask us to or the law requires it.

10. Records (section 33)

We keep a record of the processing we carry out on behalf of our customers, as required by section 33 of the Act, and will make the relevant part available to you or to the Commissioner on request.

11. Deletion and return at the end

When you close your account or a client workspace, or on your written request, we will delete Customer Personal Data within 30 days, or return it to you in a commonly used format if you ask for that before deletion. Copies in backups are overwritten within a further 30 days. We keep data longer only where the law requires it, and then only for that purpose.

12. Audits and information

We will make available the information reasonably necessary to show that we comply with this DPA and section 31 of the Act, and will cooperate with reasonable audits or inspections by you or an auditor you appoint, on reasonable notice, during business hours, no more than once a year (unless the Commissioner requires it or a breach has occurred), subject to confidentiality and to the security of other customers' data.

13. Your obligations as controller

You confirm that you have a lawful basis under section 28 of the Act for the Customer Personal Data you put into the Service, that you have given the individuals concerned the information section 23 requires, and that your instructions comply with the law. You will not upload special categories of personal data unless you have a lawful basis to do so.

14. General

This DPA lasts as long as we process Customer Personal Data for you. If this DPA conflicts with the Terms on data protection, this DPA prevails. It is governed by the laws of the Republic of Mauritius. Contact for data protection matters: [email protected].

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption of all data in transit (HTTPS/TLS).
• Database row-level security separating each customer's data; ownership checks on every server request.
• Sign-in through an established authentication provider; passwords stored only in hashed form.
• Secret keys held only on our server, never in the browser; restricted administrative access.
• Rate limits, spending limits and abuse controls on AI and publishing features.
• Card payments handled entirely by a PCI-compliant payment provider.
• Regular backups held by our database provider; error monitoring and logs for investigating incidents.
• A breach response procedure consistent with sections 25 and 26 of the Act.

Annex 3: Authorised sub-processors

Meta, TikTok and payment providers are not our sub-processors: data you send to them at your direction is handled under their own terms as independent recipients.