GDPR Compliance & Data Processing Agreement

1. Our Commitment to GDPR

Engage Insights, an affiliate of Azla Managers LLC, is committed to ensuring compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We act as a Data Processor when processing personal data on behalf of our clients (Data Controllers). This commitment is undertaken under the laws of the State of Florida, USA.

2. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contractual necessity: Processing required to deliver our services
• Legitimate interest: Analytics and platform improvement
• Consent: Marketing communications and cookies
• Legal obligation: Compliance with applicable laws

3. Data Subject Rights

Under the GDPR, individuals have the right to:

• Access: Request a copy of their personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of their personal data ("right to be forgotten")
• Restriction: Restrict processing of their data
• Portability: Receive their data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest

To exercise any of these rights, contact our Data Protection contact at amine@engageinsights.io. We will respond within 30 days.

4. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Data Security Measures

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and multi-factor authentication
• Regular security assessments and penetration testing
• Incident response procedures with 72-hour breach notification

6. Subject Matter & Duration

The Processor shall process personal data on behalf of the Controller for the duration of the service agreement. Processing shall cease upon termination, subject to legally required retention periods.

7. Nature & Purpose of Processing

Personal data is processed to provide stakeholder engagement analytics, including:

• Tracking and analyzing stakeholder communications
• Generating engagement reports and insights
• Providing AI-driven recommendations

8. Categories of Data & Data Subjects

Data subjects: Stakeholders, investors, limited partners, and team members of the Controller.

Data categories: Contact information (name, email, title, organization), communication metadata (dates, frequency, channels), and engagement metrics.

9. Obligations of the Processor

• Process data only on documented instructions from the Controller
• Ensure personnel are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject requests
• Notify the Controller of any personal data breach within 72 hours
• Delete or return all personal data upon termination of services
• Make available all information necessary to demonstrate compliance

10. Sub-processors

The Processor shall not engage sub-processors without prior written authorization from the Controller. A current list of sub-processors is available upon request. The Controller will be notified of any changes with at least 30 days' notice.

11. Audits

The Controller has the right to audit the Processor's compliance with this DPA, subject to reasonable notice and during business hours. The Processor shall cooperate and provide access to relevant facilities and documentation.

12. Contact

For GDPR inquiries or to execute this DPA, contact us at amine@engageinsights.io.

13. Categories of Personal Information Collected

In the preceding 12 months, we may have collected the following categories of personal information:

• Identifiers: Name, email address, IP address, account credentials
• Professional information: Job title, company name, industry
• Internet activity: Browsing history on our platform, interaction data, feature usage
• Geolocation data: Approximate location derived from IP address

14. Your CCPA Rights

As a California resident, you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Delete: Request deletion of your personal information, subject to certain exceptions
• Correct: Request correction of inaccurate personal information
• Opt-out of sale/sharing: We do not sell or share personal information for cross-context behavioral advertising
• Non-discrimination: Exercise your rights without receiving discriminatory treatment

15. Do Not Sell or Share

Engage Insights does not sell personal information and does not share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.

16. How to Submit a Request

California residents may submit a verifiable consumer request by contacting us at amine@engageinsights.io. We will verify your identity and respond within 45 days. You may also designate an authorized agent to submit requests on your behalf.