This text is a draft. The details marked as to be completed have not been filled in yet.

Data processing agreement

Effective 2026-11-06.

1. Parties and scope

This data processing agreement forms part of the terms under which a customer installs and uses ARENA. For each location (sub-account) in which ARENA is installed, the business that holds that location is the customer and the controller. BrandBeat7, of 409, Whitefield Road, Kondapur, Hyderabad, Telangana, India, is the processor. This agreement covers the personal data BrandBeat7 processes for the customer through ARENA. Where the Digital Personal Data Protection Act, 2023 of India applies, the customer is the Data Fiduciary and BrandBeat7 the Data Processor.

2. Subject matter, nature and purpose

BrandBeat7 processes personal data only to provide ARENA to the customer: to run the customer's quizzes, record attempts and results, show them in Studio, send them to the customer's platform account as the customer configures, generate quiz questions from material the customer submits when BrandBeat7 has turned AI-assisted generation on for the customer, and keep the service secure and working. Processing lasts as long as the customer uses ARENA, followed by the deletion periods in section 8.

3. Data subjects and personal data

• Players of the customer's quizzes: answers, response times, scores and results; a name and email address, with the consent text version and time, when the player consents; a shortened hash of the network address and a cookie identifier, each kept 24 hours; attempt identifiers; and the platform contact identifier when a result is linked to a contact.
• The customer's staff who use Studio: the platform user identifier, the location identifier and the role.
• Records of ARENA's writes to the customer's platform account, which can include error text returned by the platform.

ARENA does not ask for special categories of personal data, and the customer must not put them in quizzes or in material submitted for generation. The customer will not run quizzes on ARENA for audiences under 13.

4. BrandBeat7's obligations

BrandBeat7:

• processes the personal data only on the customer's documented instructions, which are this agreement and the customer's configuration of ARENA, and tells the customer if it believes an instruction breaks data protection law;
• ensures that everyone it authorises to process the personal data is bound to confidentiality;
• applies the security measures in section 5;
• uses sub-processors only as section 6 allows;
• helps the customer answer requests from data subjects, by the means ARENA provides and, on request to support@brandbeat7.com, by exporting or deleting a participant's data;
• helps the customer with security, breach notification, impact assessments and prior consultations, taking into account the information available to BrandBeat7;
• tells the customer without undue delay after becoming aware of a personal data breach affecting the customer's data;
• deletes the personal data at the end of the service as section 8 describes;
• makes available the information needed to show compliance with this agreement, and allows for and contributes to audits by the customer or its auditor on reasonable notice.

5. Security measures

• ARENA's links and interfaces use encrypted connections (HTTPS).
• Each customer's data is kept apart by a tenant identifier on every row, enforced by row-level security in the database.
• Platform access tokens are encrypted with a key for each customer.
• Email addresses, phone numbers and tokens are removed from logs and traces before they leave ARENA.
• Only BrandBeat7's operator holds the credential that changes the production database's structure.
• A daily job applies the retention periods in section 8.
• The database can be restored to any point in the last 7 days.

6. Sub-processors

The customer authorises BrandBeat7 to use these sub-processors:

• Cloudflare: hosts ARENA's application, handles every request, and stores queues, files and live sessions; Cloudflare's global network.
• Neon: hosts ARENA's database; United States.
• Uptrace: receives monitoring traces, logs and metrics, with email addresses, phone numbers and tokens removed; in the European Union.
• Anthropic: AI-assisted quiz generation, only when BrandBeat7 has turned it on for the customer (it is off by default); it receives the content the customer submits for generation, and no participant data, except personal data the customer puts into that material.

BrandBeat7 binds each sub-processor to data protection terms of the kind this agreement sets, and remains responsible to the customer for them. BrandBeat7 announces a new sub-processor on this page at least 30 days before it processes the customer's personal data; the customer may object in that time by writing to support@brandbeat7.com, and if the objection cannot be resolved, may stop using ARENA.

7. The customer's platform

The CRM is the platform on which the customer installs ARENA; it is not a sub-processor of BrandBeat7. As the customer configures, ARENA reads from and writes to the customer's CRM account (contacts, custom fields, tags and notes), and the CRM sends ARENA events about that account, such as a deleted contact. The customer's own agreement with its CRM provider governs the data held there, and data ARENA wrote there stays in the customer's account when ARENA is removed.

8. Retention and deletion

The ordinary periods below remain unchanged; participant erasure requests follow them.

A daily job deletes personal data once its period has passed:

• Attempts linked to no identity (no name, email or personal link): 30 days after they end.
• Attempts linked to an identity (a name, an email or a personal link), and live sessions: 24 months after they started.
• The network-address hash and the retake cookie: 24 hours.
• The audit log of writes to the customer's platform account: 90 days.
• Webhook events received from the platform: 30 days.
• Finished result-link deliveries: 30 days after their last update.
• Everything in ARENA's database for the customer, except deletion records that hold identifiers only: 30 days after the customer removes ARENA; reinstalling within those 30 days restores it.

Players' names, emails and consent records are kept while the customer uses ARENA, until that removal; when the customer deletes a contact in the customer's CRM, that contact's name, email and consent records are deleted and its attempts are deleted 30 days later. Uptrace keeps monitoring traces, logs and metrics for 28 days. Deleted data can remain in database backups for up to 7 days.

Participant erasure requests

• An erasure request the customer makes in Studio marks the participant's records as deleted in the same transaction that records the request and revokes the participant's access; from then on the records are excluded from ordinary use, reads, exports and writes, and only tenant-scoped cleanup uses the minimum it needs.
• ARENA then promptly starts removing what it wrote to the customer's platform account for that participant: ARENA's custom fields and tags on the contact and the notes ARENA created. It does not delete the contact or other customer data. A removal counts as done when the platform answers it with an HTTP 2xx status, including 202 and 204, without a further read-back; a recorded success is not sent again, and only failed removals are retried, within bounded retries, and stay visible in Studio for the customer to retry.
• The participant's retained data is physically purged by a scheduled purge once exactly 7 days of 24 hours, counted in UTC, have passed since the logical deletion, never earlier; a repeated request or a retry does not restart that period. A failed removal in the platform account does not extend the retention of answers, consent records or other participant content.
• Before the purge removes the source records, ARENA keeps only the minimum needed to finish outstanding removals and to stop stale processing from recreating the data: internal identifiers, dates, the targets and statuses of removals not yet done, and pseudonymous matching keys derived from the participant's email or contact identifier. If that record cannot be saved, the purge is not reported as done and is retried.
• Studio shows the logical deletion, each removal's progress or failure, the purge due time and the actual purge separately. The target for handling a request stays 30 days from the request, and Studio flags a request that is overdue; the 7-day purge eligibility alone does not complete a request.

9. International transfers

BrandBeat7 operates ARENA from India. ARENA's database is hosted in the United States, and section 6 gives the processing location of each sub-processor where one is stated. Where the customer is subject to the EU General Data Protection Regulation and personal data is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this agreement by reference, with the customer as data exporter and BrandBeat7 as data importer: Clause 7 applies; under Clause 9, option 2 applies with the notice period of section 6; the option in Clause 11 does not apply; and for Clauses 17 and 18, the law and courts of Ireland apply. Where the UK GDPR applies, the International Data Transfer Addendum issued by the UK Information Commissioner is incorporated in the same way. For onward transfers to sub-processors, BrandBeat7 relies on each sub-processor's own transfer terms.

10. Term, liability and law

This agreement lasts as long as BrandBeat7 processes personal data for the customer. Each party's liability under it is subject to the limits in the terms it forms part of. It is governed by the laws of India, except where the Standard Contractual Clauses require otherwise.

11. Contact

Privacy contact: support@brandbeat7.com. Data protection officer: Not appointed. The privacy notice tells players how their data is used.