DPA Annex 1 — Processing Details
Annex 1 — Processing Details
Document ID: HM-LEGAL-003A
Title: DPA Annex 1 — Processing Details
Version: 1.0-draft
Last updated: 2026-06-14
Publisher: Headshot Marketing Private Limited (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/headshotmarketing/HM-LEGAL-003A
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the HeadshotMarketing subgroup at https://burdenoff.com/contracts/headshotmarketing/. Every referenced contract is identified by its Document ID (HM-LEGAL-### / HM-PRICING-###) and incorporated by reference.
A. Subject-matter and duration
- Subject-matter: provision of the HeadshotMarketing marketing platform (campaign management, services marketplace, content management, marketing automation, internal communications, marketing analytics) to Customer.
- Duration: for the duration of the Subscription Term and any retention period under MSA §5.5 / DPA §4.7 (including statutory marketing-consent / tax retention Customer instructs).
B. Nature and purpose of processing
HeadshotMarketing processes Personal Data to:
- authenticate users and manage tenants, roles and access;
- run marketing workflows (campaigns, content, segmentation, automation, landing pages);
- operate the services marketplace (profiles, proposals, contracts, milestones, escrow, payouts, ratings);
- deliver content management (content calendar, authoring, approvals, asset library);
- run marketing automation (contact lifecycle, behavioural triggers, multi-step journeys);
- store and serve documents (IDs, certificates, contracts, creative assets);
- relay campaigns, audiences and messages to ad / social / email / SMS providers Customer connects and store the delivery results Customer commissions;
- provide AI-assisted content generation, optimization support, content summarisation and recommendations (assistive only; no autonomous decisions);
- deliver internal communications, notifications and channel events configured by Customer;
- generate audit logs, usage telemetry and analytics;
- provide customer support and respond to data principal requests;
- detect and prevent fraud, abuse and security incidents;
- comply with legal obligations.
C. Categories of data subjects
- Customer's Authorized Users, administrators (marketing admins, campaign managers, analysts), and managers.
- Marketing contacts and leads captured or imported into Customer's tenant.
- Customers and prospects managed in Customer's CRM / pipelines.
- Influencers tracked in Customer's influencer CRM.
- Freelancers and agencies engaged through the Marketplace.
- Recipients of Customer's email/SMS sends, social posts and ads, to the extent personal data is involved.
D. Categories of Personal Data
| Category | Examples |
|---|---|
| Identification & contact | Name, work and personal email, username, profile photo, phone, address |
| Account & authentication | Password hash (where local auth used), SSO subject ID, MFA factors |
| Authorisation | Roles, tenant memberships, RBAC assignments, manager relationships |
| Marketing contact / lead data | Contact name, email, phone, company, job title, source, consent/subscription status, lead score, lifecycle stage, custom contact fields |
| CRM & pipeline data | Deal records, pipeline stages, deal value, activity history, notes, owner, 360-degree contact timeline |
| Engagement & behavioural data | Email opens/clicks, send/bounce/complaint events, form submissions, page visits, link clicks, automation-trigger events |
| Social data | Connected social handles and tokens, scheduled/published posts, comments/mentions, engagement metrics |
| Ad data | Connected ad-account identifiers, ad campaigns, creatives, audience definitions, ad performance and spend metrics |
| SEO data | Tracked keywords, audited domains/URLs, ranking and audit results |
| Influencer data | Influencer profiles, contact details, relationship history, campaign participation, agreed deliverables |
| Marketplace engagement | Freelancer/agency profiles, proposals, contracts, milestones, work submissions, ratings, escrow/payout records |
| Device & connection | IP address, user agent, OS, geolocation (city-level), device metadata |
| Usage data | Pages visited, features used, navigation, notification interactions, AI-assist metadata |
| Content & creative | Content items, copy, images, video, templates, creative assets, communications |
| Billing | Billing contact, billing address, GSTIN/PAN (Indian customers), VAT ID, tokenised card identifier (actual card data held by payment processor) |
| Support | Support ticket content, screen recordings (only if shared), call transcripts |
E. Sensitive personal data / Special categories
HeadshotMarketing does not require Customer to upload "sensitive personal data or information" under the SPDI Rules or special-category personal data under Article 9 GDPR. Customer shall not upload, and shall instruct Authorized Users not to upload, such categories (health data, biometric IDs, Aadhaar numbers, religion, caste, political opinions, sexual orientation, trade-union membership, or criminal-record data) unless expressly authorised under an Order Form with appropriate additional controls and a lawful basis. Customer is responsible for the lawful basis and the marketing consent (CAN-SPAM, CASL, TCPA, GDPR/ePrivacy, DPDP) for the contacts it loads and the messages it sends, and for honouring unsubscribe/opt-out and suppression requests. Where Customer commissions campaign / message delivery through a connected ad/social/email/SMS provider, the results are processed strictly as Customer instructs.
F. Retention periods
- Account profile data: while account is active + 90 days, unless legal hold.
- Marketing records (contact, lead, CRM, engagement, campaign): for the Subscription Term on Customer's instructions; then export within 30 days and delete, subject to statutory marketing-consent / tax retention Customer directs.
- Documents in the file store: until deleted by Customer or account closure.
- Audit logs: per Plan (default 30 days; longer for Enterprise).
- Analytics events: per Plan; user-level up to 13 months.
- Backups: rolling 30 days hot, 90 days cold (default).
- Support tickets: 24 months after closure unless Customer requests earlier deletion.
- Billing records: 8 years (Indian tax/Companies Act retention).
G. Sub-processing
See Annex 3. Ad / social / email / SMS delivery providers are added only when Customer connects them.
H. Transfer mechanisms
Default storage region(s) as specified on the Order Form (default: AWS ap-south-1, Mumbai, India). International transfers under DPA §7 use SCCs/UK Addendum, DPDP-permitted destinations, and SPDI-equivalent contractual safeguards as applicable. Marketing-data localisation as configured on the Order Form.
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (HM-LEGAL-### or HM-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.