ShadowCMO Legal Documentation
Effective Date: November 13, 2025
Last Updated: November 13, 2025
Parties: - Processor: ISW AI Venture trading as ShadowCMO ("we", "us", "our") - Controller: The individual or organisation using the Services ("you", "Customer")
This Data Processing Agreement ("DPA") forms part of the Terms & Conditions and governs how ShadowCMO processes Personal Data on behalf of the Customer under GDPR, UK-GDPR, and other applicable privacy laws.
By using our Services, you agree to this DPA.
This DPA applies when ShadowCMO processes Personal Data on behalf of the Customer in connection with providing the Services.
The Processor will: - Process Personal Data only on documented instructions from the Controller - Not use Personal Data for its own purposes - Follow applicable Data Protection Laws at all times
Depending on Customer use, this may include: - User account details (name, email, contact information) - Technical identifiers (IP address, device data, browser information) - Instructions, prompts, or content submitted through the platform - Usage analytics and interaction data - Customer-uploaded datasets (content varies by Customer use case)
May include: - Customer personnel and employees - End-users of the Customer - Prospects, leads, or contacts provided by the Customer - Any individuals contained in uploaded datasets
Includes: - Storage and hosting - Transmission and transfer - Structuring, organising, and indexing - Access, retrieval, and consultation - Analysis, transformation, or generation (including AI-based processing) - Deletion, anonymisation, or archival
Duration: Processing occurs during the Subscription Term and for up to 90 days after termination (for backup/recovery purposes), unless longer retention is required by law.
The Controller confirms that: - Personal Data has been collected lawfully - Instructions provided to the Processor comply with Data Protection Laws - Appropriate notices and consents have been obtained where required - Personal Data shared with the Processor does not violate third-party rights
The Controller must not upload: - Special category data (racial/ethnic origin, political opinions, religious beliefs, health data, biometric data, genetic data) unless explicitly permitted - Personal data of children under 16 (or applicable local minimum age) without verified parental consent - Unlawful, harmful, or prohibited content
We shall:
We will process Personal Data only for providing and improving the Services as described in the Documentation. If we believe an instruction violates Data Protection Laws, we will promptly inform you.
All personnel with access to Personal Data are bound by strict confidentiality agreements and receive data protection training.
We shall implement industry-standard technical and organisational measures, including those listed in Annex III (Security Measures).
We may engage Sub-processors for specific functions (e.g., cloud hosting, database services, AI model APIs, email delivery).
If you object and we cannot accommodate a reasonable alternative, either party may terminate the affected Services upon 30 days' written notice.
We will assist you in fulfilling obligations to respond to data subject rights requests, including: - Right of access (GDPR Article 15) - Right to rectification (GDPR Article 16) - Right to erasure ("right to be forgotten") (GDPR Article 17) - Right to restriction of processing (GDPR Article 18) - Right to data portability (GDPR Article 20) - Right to object to processing (GDPR Article 21) - Rights related to automated individual decision-making, including profiling (GDPR Article 22)
Assistance provided: - Technical capability to export Customer Data in machine-readable format (JSON, CSV) - Deletion of specific data upon written request - Restriction or cessation of processing upon objection - Information about automated decision-making logic, significance, and consequences - Response within 10 business days of receiving a documented request
Controller responsibility: - Verifying identity of the Data Subject - Determining legal basis for the request - Assessing validity of objections under Article 21 - Communicating directly with the Data Subject
We will notify you without undue delay and in any event within 72 hours of becoming aware of a Personal Data breach affecting Customer Data.
Notification will include: - Nature and categories of Personal Data affected - Approximate number of Data Subjects and records concerned - Likely consequences of the breach - Measures taken or proposed to address the breach and mitigate harm - Contact point for further information
We will cooperate with you to investigate the breach and comply with applicable breach notification obligations to supervisory authorities and Data Subjects.
We will provide reasonable assistance where required for DPIAs or prior consultations with supervisory authorities, including: - Description of processing operations - Security measures implemented - Technical documentation as reasonably necessary
Personal Data may be transferred outside the European Economic Area (EEA) and United Kingdom to countries that do not provide an adequate level of data protection.
Such transfers will be safeguarded by one or more of the following:
A copy of applicable safeguards is available upon request to dpo@shadowcmo.com
We have conducted a transfer impact assessment and implemented supplementary measures to ensure an essentially equivalent level of protection for Personal Data transferred to third countries.
A complete and current list of Sub-processors, including names, locations, and processing purposes, is available at:
www.shadowcmo.com/subprocessors
Sub-processors provide the following categories of services:
Each Sub-processor must: - Implement appropriate technical and organisational security measures - Follow the principles of GDPR Article 28 - Process Personal Data only as instructed by ShadowCMO - Notify ShadowCMO of any breach affecting Customer data
We remain fully liable to you for the performance of Sub-processors.
Upon termination or expiration of the Services, the Processor will:
Exception: We may retain Personal Data to the extent required by EU or Member State law, in which case we will inform you of such legal requirement unless prohibited by law.
The Processor will make available relevant documentation necessary to demonstrate compliance with GDPR Article 28, including: - This DPA and its annexes - Security policy summaries - Sub-processor agreements and security documentation - Technical safeguards and encryption protocols - Incident response procedures
You have the right to audit our compliance with this DPA. Audits must be: - Pre-scheduled with at least 30 days' notice - Conducted during normal business hours - Limited in scope to what is necessary to verify compliance - Not disruptive to service operations - Conducted at your expense - Subject to confidentiality obligations
We prefer: - Remote audits via video conference and screen sharing - Document-based reviews - Questionnaire-based assessments
In lieu of an on-site audit, ShadowCMO may provide: - Security documentation and policy summaries - Evidence of Sub-processor compliance (e.g., Replit SOC 2, Neon SOC 2, Google Cloud certifications) - Third-party penetration testing reports (when available) - Security Compliance Matrix documenting our technical and organisational measures
We maintain security controls aligned with industry standards including: - ISO 27001 principles (information security management) - SOC 2 Type II principles (security, availability, confidentiality) - NIST Cybersecurity Framework - CIS Controls
Note: While ShadowCMO is not independently certified under SOC 2 or ISO 27001, we leverage the certifications of our Sub-processors and implement equivalent security controls.
Liability under this DPA follows the limitations set out in the Terms & Conditions.
Each party's liability to the other under or in connection with this DPA shall be subject to the exclusions and limitations of liability set out in the Terms.
Nothing in this DPA limits liability where prohibited by law, including: - Death or personal injury caused by negligence - Fraud or fraudulent misrepresentation - Violation of Data Subjects' rights under Data Protection Laws
This DPA remains in effect for the duration of the Subscription Term and will automatically terminate upon termination of the Terms & Conditions.
Survival: Sections related to data deletion, confidentiality, liability, and audit rights survive termination.
This DPA is governed by the laws of The Netherlands.
Disputes shall be resolved exclusively by the courts of Amsterdam, The Netherlands.
Supervisory Authority: For GDPR-related complaints, the competent supervisory authority is:
Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Bezuidenhoutseweg 30
2594 AV, The Hague, The Netherlands
Website: https://autoriteitpersoonsgegevens.nl
For data protection enquiries, contact:
Data Protection Officer
Email: dpo@shadowcmo.com
Website: www.shadowcmo.com
Address: Roosbergsweg 12A, 4854PM Bavel, Netherlands
Purpose: To provide SaaS-based AI-powered marketing campaign creation services, including competitor analysis, content generation, image and video generation, and campaign export functionality.
Nature: Automated processing using cloud infrastructure, AI models, and data storage services.
Active Processing: During the Subscription Term
Post-Termination Retention: Up to 90 days for backup/recovery, then deletion
Legal Retention: As required by applicable law (maximum 12 months)
Where international transfers of Personal Data occur, ShadowCMO incorporates the Standard Contractual Clauses approved by the European Commission under:
Commission Implementing Decision (EU) 2021/914 of 4 June 2021
Module Two: Controller-to-Processor transfers (where applicable)
Module Three: Processor-to-Processor transfers (for Sub-processor arrangements)
Docking Clause: The SCCs are available upon request and form part of this DPA.
UK Transfers: For transfers subject to UK-GDPR, the UK International Data Transfer Addendum (IDTA) to the SCCs applies.
The following security controls are implemented and maintained by ShadowCMO:
All Sub-processors must demonstrate: - SOC 2 Type II, ISO 27001, or equivalent certification (or be in process of obtaining) - GDPR compliance with appropriate technical and organisational measures - Data Processing Agreements incorporating GDPR Article 28 obligations - Security incident notification commitments within 72 hours
ShadowCMO regularly reviews and updates security measures to address: - Emerging threats and vulnerabilities - Changes in Data Protection Laws - Industry best practices and standards - Feedback from security audits and penetration tests
Phase 1 Security Enhancements (Q1 2026): - Rate limiting and API throttling - CSRF token protection - Centralized error logging (Sentry) - Audit log system for sensitive operations - Multi-factor authentication (MFA) for admin accounts
For questions about security measures or to request additional documentation, contact:
Email: dpo@shadowcmo.com
Security Documentation: Available upon request under NDA
END OF DATA PROCESSING AGREEMENT