This Data Processing Agreement (DPA) describes the terms on which Azla Managers LLC, operating as engage insights, processes personal data on behalf of its customers. A countersigned copy is available for signature on request — contact amine@engageinsights.io.
1. Parties & Roles
This DPA forms part of the agreement between the customer (the “Controller”) and Azla Managers LLC operating as engage insights (the “Processor”). The Controller determines the purposes and means of processing personal data; the Processor processes personal data only on the Controller’s documented instructions. This DPA is governed by the laws of the State of Florida, USA, and gives effect to the requirements of the GDPR where applicable.
2. Subject Matter & Duration
The Processor shall process personal data on behalf of the Controller for the duration of the underlying service agreement. Processing shall cease upon termination, subject to any legally required retention periods and the deletion/return obligations set out below.
3. Scope & Purpose of Processing
Personal data is processed to provide stewardship and stakeholder-engagement analytics, including:
- Tracking and analysing stakeholder engagements and proxy-voting activity
- Generating engagement records, reports, and regulatory disclosures
- Providing AI-assisted insights and recommendations to the Controller
4. Categories of Data & Data Subjects
Data subjects. Stakeholders, investee-company representatives, investors, limited partners, and the Controller’s own personnel.
Categories of data. Contact information (name, email, job title, organisation), communication metadata (dates, frequency, channels), and engagement metrics. The Service is not intended for special-category data, and the Controller agrees not to upload such data unless separately agreed.
5. Obligations of the Processor
- Process personal data only on the Controller’s documented instructions
- Ensure that personnel authorised to process data are bound by confidentiality obligations
- Implement and maintain appropriate technical and organisational security measures
- Assist the Controller in responding to data-subject requests
- Notify the Controller without undue delay, and in any event within 72 hours, of any personal-data breach
- Delete or return all personal data on termination, and make available information necessary to demonstrate compliance
6. Sub-processors
The Controller authorises the Processor to engage sub-processors to deliver the Service. A current list is available on request and the Processor will give at least 30 days’ notice of any intended change, giving the Controller the opportunity to object. The Processor remains liable for its sub-processors’ performance and imposes data-protection terms no less protective than this DPA. Current infrastructure sub-processors include:
| Sub-processor | Purpose | Region(s) |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting & storage | EU (Frankfurt) / US |
| Supabase | Managed database & authentication | EU (Frankfurt) |
| Email delivery provider | Transactional & notification email | EU / US |
7. Security Measures
The Processor maintains technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access controls and multi-factor authentication
- Network isolation, logging, and monitoring
- Regular security assessments and vulnerability testing
- Documented incident-response and backup procedures
8. International Transfers
Where personal data is transferred outside the EEA or the UK, the Processor relies on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (SCCs) and, where relevant, the UK International Data Transfer Addendum, together with supplementary technical measures.
9. Data-Subject Requests
Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligation to respond to requests from data subjects exercising their rights under applicable data-protection law.
10. Personal-Data Breach Notification
The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal-data breach, and shall provide sufficient information to allow the Controller to meet its own notification obligations.
11. Audit Rights
The Processor shall make available to the Controller information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice, confidentiality, and during normal business hours.
12. Deletion or Return on Termination
On expiry or termination of the service agreement, the Processor shall, at the Controller’s choice, delete or return all personal data and delete existing copies, unless retention is required by law. The Controller may export Customer Data prior to deletion as described in the Terms of Service.
13. Signature
This DPA is available for signature on request. To execute it, or to request our current sub-processor list and security documentation, contact amine@engageinsights.io.
Questions? Contact amine@engageinsights.io.
engage insights is a brand of Azla Managers LLC, a Florida limited liability company.