Data processing agreement

Last updated October 18, 2026

This data processing agreement ("DPA") forms part of the agreement between Alopay Inc., a Delaware corporation doing business as Passionfruit ("Passionfruit", "we" or "us"), and the client named in the applicable master services agreement, statement of work or order form ("Client" or "you"). That agreement, including this DPA, is the "Agreement". This DPA applies whenever Passionfruit processes Client Personal Data while providing the services. If this DPA and the rest of the Agreement conflict on a data protection matter, this DPA controls. If this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses control.

Definitions

• Data Protection Laws means all laws that apply to the processing of Client Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR") and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and other US state privacy laws.
• Client Personal Data means personal data that Passionfruit processes on behalf of Client under the Agreement.
• Subprocessor means a third party that Passionfruit engages to process Client Personal Data.
• Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Client Personal Data.
• Standard Contractual Clauses or SCCs means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
• Terms such as "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in Data Protection Laws. "Controller" includes "business", and "processor" includes "service provider", as those terms are used in the CCPA.

Scope and roles

Roles of the parties

Client is the controller and Passionfruit is the processor of Client Personal Data. If Client is itself a processor acting for a third party, Passionfruit is a subprocessor, and Client confirms that the relevant controller has authorized Client's instructions, including the appointment of Passionfruit.

Subject matter and duration

Passionfruit processes Client Personal Data to deliver the search and AI search services described in the Agreement. Passionfruit's platform analyzes data from the tools Client connects and produces action items and reports. Passionfruit's team then carries out the work inside Client's own systems, such as its content management system, Google Search Console and Google Analytics 4. Processing continues for the term of the Agreement and for the period needed to return or delete data under this DPA.

Nature and purpose of processing

Processing includes connecting to Client systems that Client authorizes; collecting, storing, analyzing and reporting on data from those systems in Passionfruit's platform; making changes inside those systems on Client's instructions; providing platform accounts to Client personnel; and communicating with Client personnel about the services.

Categories of data subjects

• Client's employees and contractors who use the platform or communicate with Passionfruit.
• Visitors to Client's websites and users of Client's products, to the extent their data appears in the systems Client connects.

Categories of personal data

• Work email addresses and names of Client personnel, used to create and secure their platform logins.
• Website analytics and search data from connected tools, which may include online identifiers, approximate location, device and browser information, and usage data.
• Content in Client's content management system, which may include the names of authors or other individuals.
• Communications between the parties.

Sensitive data

Passionfruit does not process special categories of personal data, sensitive personal information, or data relating to criminal convictions. Client will not provide such data or connect systems that expose it to Passionfruit.

No AI training on Client data

Passionfruit does not use Client Personal Data, or any other data Client provides or connects, to train, fine-tune or otherwise improve any artificial intelligence or machine learning model, whether Passionfruit's own or a third party's.

Passionfruit uses AI model providers only under commercial API or enterprise terms that prohibit the provider from using Passionfruit's inputs and outputs to train or improve its models. Passionfruit does not enable any setting that would allow such use, and will not engage an AI model provider whose terms permit it.

These commitments survive termination of the Agreement and apply to every Subprocessor.

Processing instructions

• Passionfruit will process Client Personal Data only on Client's documented instructions, including with regard to international transfers, unless applicable law requires otherwise. In that case, Passionfruit will tell Client about the legal requirement before processing, unless the law prohibits this.
• The Agreement, this DPA and Client's use and configuration of the services are Client's complete instructions. Additional instructions require written agreement between the parties.
• Passionfruit will promptly tell Client if, in its opinion, an instruction infringes Data Protection Laws.
• Passionfruit will not sell or share Client Personal Data, as those terms are defined in the CCPA. It will not retain, use or disclose Client Personal Data for any purpose other than performing the services, outside the direct business relationship between the parties, or combine it with personal data from other sources, except as Data Protection Laws permit. Passionfruit certifies that it understands and will comply with these restrictions.
• Client is responsible for the lawfulness of its instructions, and for having a lawful basis and giving any notices and obtaining any consents needed for Passionfruit to process Client Personal Data, including when Client grants access to connected tools.

Confidentiality

Passionfruit will ensure that personnel authorized to process Client Personal Data are bound by written confidentiality obligations, are trained on handling personal data, and access that data only as needed to deliver the services.

Security measures

Passionfruit will implement and maintain the technical and organizational measures described in Annex II. These take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals. Passionfruit may update these measures, provided that updates do not reduce the overall level of protection.

Security incidents

Passionfruit will notify Client without undue delay, and in any case within seven (7) days, after becoming aware of a Security Incident. The notice will be sent to Client's main contact and will include, as far as it is then known, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Passionfruit will provide further information as it becomes available, take reasonable steps to contain and remedy the incident, and cooperate with Client in meeting its own notification obligations. Notifying Client of a Security Incident is not an admission of fault or liability.

Subprocessors

General authorization

Client gives Passionfruit general authorization to engage Subprocessors. The current list is published at getpassionfruit.com/subprocessors.

Subprocessor obligations

Passionfruit will review each Subprocessor's security and privacy practices before engaging it, and will impose data protection terms on it that are no less protective than those in this DPA, including the restrictions on AI training. Passionfruit remains responsible for the acts and omissions of its Subprocessors as if they were its own.

Changes to Subprocessors

Passionfruit will give notice of any new or replacement Subprocessor by updating the subprocessors page at least thirty (30) days before that Subprocessor processes Client Personal Data. Client is responsible for checking that page for updates. Client may object on reasonable data protection grounds by writing to privacy@getpassionfruit.com within that period. The parties will discuss any objection in good faith. If they cannot resolve it, Client may terminate the affected services by written notice and receive a refund of any prepaid fees for the period after termination.

International transfers

Passionfruit is based in the United States, and all Client Personal Data is stored in the United States. Passionfruit and its Subprocessors process Client Personal Data in the United States, as listed on the subprocessors page.

Transfers from the EEA

For transfers of Client Personal Data from the European Economic Area to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference, and are completed as follows:

• Module Two (controller to processor) applies where Client is a controller, and Module Three (processor to processor) applies where Client is a processor.
• Clause 7 (docking clause) applies.
• Under Clause 9, Option 2 (general written authorization) applies, with the notice period set out in "Changes to Subprocessors" above.
• The optional wording in Clause 11 does not apply.
• Under Clause 13, the competent supervisory authority is the one determined by Client's establishment or representative in the EEA.
• Under Clauses 17 and 18, the SCCs are governed by the laws of Ireland, and disputes are resolved by the courts of Ireland.
• Annexes I, II and III of the SCCs are completed with the information in the Annexes to this DPA.

Transfers from the United Kingdom

For transfers from the United Kingdom, the UK Addendum is incorporated into this DPA by reference. Tables 1 to 3 are completed with the information in this DPA and its Annexes, and either party may end the UK Addendum as set out in Section 19 of it.

Transfers from Switzerland

For transfers from Switzerland, the SCCs apply as set out above, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

Assistance and audits

Requests from individuals

Taking into account the nature of the processing, Passionfruit will assist Client with appropriate measures in responding to requests from individuals exercising their rights under Data Protection Laws. If Passionfruit receives such a request directly, it will forward it to Client and will not respond other than to direct the individual to Client, unless the law requires otherwise.

Other assistance

Passionfruit will give Client reasonable assistance with data protection impact assessments and prior consultations with regulators, where Data Protection Laws require them and they relate to Passionfruit's processing.

Audits

Passionfruit will make available to Client the information reasonably needed to demonstrate compliance with this DPA, including written responses to reasonable security questionnaires. If that information is not sufficient, Client may audit Passionfruit's compliance no more than once in any 12-month period, or more often if a regulator requires it or following a Security Incident. Client must give at least thirty (30) days' written notice. Audits take place during normal business hours, under confidentiality obligations, and in a way that does not unreasonably disrupt Passionfruit's business or compromise the data of other clients. Each party bears its own costs of an audit.

Deletion and return of data

When the services end, Passionfruit will stop using its access to Client's connected tools and, at Client's choice, return or delete Client Personal Data within thirty (30) days, unless the law requires Passionfruit to keep it. Copies in backups are deleted in the normal backup cycle and remain protected under this DPA until then. On request, Passionfruit will confirm deletion in writing. Client should also revoke the access it granted to Passionfruit in its own tools.

General terms

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow this. This DPA ends when Passionfruit no longer processes any Client Personal Data. This DPA is governed by the laws of the State of Delaware, except where the SCCs or the UK Addendum require otherwise.

Annex I: Details of processing

List of parties

• Data exporter: Client, as identified in the Agreement. Role: controller (or processor, where Client acts for a third party). Contact: as set out in the Agreement.
• Data importer: Alopay Inc. (doing business as Passionfruit), 169 Madison Avenue, New York, NY 10016, United States. Role: processor. Contact: privacy@getpassionfruit.com.

Description of the transfer

• Data subjects, personal data and sensitive data: as described in "Scope and roles" above. No sensitive data is transferred.
• Frequency: continuous, for the term of the Agreement.
• Nature and purpose: as described in "Scope and roles" above.
• Retention: for the term of the Agreement, then deleted within thirty (30) days as described in "Deletion and return of data".
• Transfers to Subprocessors: for the subject matter, nature and duration described on the subprocessors page.

Annex II: Technical and organizational measures

• Access control: access to Client Personal Data is limited to personnel who need it to deliver the services, on a least-privilege basis.
• Authentication: single sign-on and multi-factor authentication on the systems that hold Client Personal Data.
• Client system access: Passionfruit requests only the access the work needs, uses scoped credentials such as OAuth with read-only permissions where the tool supports it, and removes its access when an engagement ends.
• Encryption: data is encrypted in transit using TLS and at rest by Passionfruit's cloud infrastructure provider.
• Separation: each client's data is logically separated in Passionfruit's platform.
• Personnel: personnel sign confidentiality agreements, and their access is removed promptly when they leave or change roles.
• Vendor management: every vendor that processes Client Personal Data is reviewed before use and bound by written data protection terms.
• AI providers: AI model providers are used only under terms that prohibit training on Passionfruit's inputs and outputs.
• Incident response: Passionfruit maintains a process for detecting, investigating and responding to Security Incidents, including notifying clients as set out in this DPA.
• Review: these measures are reviewed regularly and updated as risks change.

Annex III: Subprocessors

The list of Subprocessors, with their purpose and location, is published at getpassionfruit.com/subprocessors.

Contact

Questions about this DPA can be sent to privacy@getpassionfruit.com. Security matters can be reported to security@getpassionfruit.com. Alopay Inc., 169 Madison Avenue, New York, NY 10016, United States.