1. Parties and scope
Triggerize is the operating trade name and execution label through which WorldEmp Holding B.V., a private company with limited liability established in the Netherlands, provides, manages and operates the Triggerize Studio application.
Triggerize Studio is the software application through which AI-assisted marketing, research, content, analysis, optimisation and related functionality is made available to users.
For the purposes of this DPA:
- “Customer” means the organisation that has entered into an agreement, subscription, Order Form or other commercial arrangement for the use of Triggerize Studio.
- “Controller” has the meaning given to that term under the GDPR.
- “Processor” has the meaning given to that term under the GDPR.
- “Customer Personal Data” means Personal Data contained in Customer Data that WorldEmp Holding B.V. processes on behalf of the Customer.
- “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given to them under Regulation (EU) 2016/679 (“GDPR”).
- “Subprocessor” means a third party engaged by WorldEmp Holding B.V. to process Customer Personal Data on behalf of the Customer.
- “Service” means Triggerize Studio and the related services provided under the applicable Terms of Service, Order Form, subscription or other contractual arrangement.
WorldEmp Holding B.V. remains an independent Controller for Personal Data processed for its own purposes, including account administration, authentication, security, fraud prevention, billing, compliance, customer management, service administration, legal obligations, recordkeeping and legal claims. Such Processing is governed by the applicable Privacy Policy and does not fall within the scope of this DPA.
2. Relationship with other agreements
This DPA forms part of and should be read together with the Triggerize Terms of Service, the applicable Order Form, subscription arrangement and any other written agreement between the parties relating to the Service.
If there is a conflict between this DPA and the Terms of Service concerning the Processing of Customer Personal Data on behalf of the Customer, this DPA prevails.
Any additional or different terms relating to data Processing proposed by the Customer apply only if expressly accepted in writing by WorldEmp Holding B.V.
3. Roles and instructions
Where the Customer determines the purposes and means of Processing Customer Personal Data through Triggerize Studio, the Customer acts as Controller and WorldEmp Holding B.V. as Processor.
Where the Customer itself acts as a Processor for another Controller, WorldEmp Holding B.V. acts as a Subprocessor and the obligations in this DPA apply accordingly.
The Customer’s documented instructions include this DPA, the applicable contractual documents, the configuration and use of Triggerize Studio by authorised users, and any additional written instructions agreed between the parties. WorldEmp Holding B.V. will process Customer Personal Data only in accordance with those instructions, as necessary to provide, operate, secure, support and maintain the Service, or as required by applicable law.
If WorldEmp Holding B.V. considers that an instruction infringes applicable data protection law, it will inform the Customer where legally permitted and may suspend the relevant Processing until the matter has been clarified.
Where WorldEmp Holding B.V. is required by applicable law to process Customer Personal Data other than on the Customer’s instructions, it will inform the Customer of that legal requirement before Processing, unless prohibited by law.
4. Customer responsibilities
The Customer is responsible for ensuring that its Processing of Personal Data through Triggerize Studio complies with applicable data protection law.
The Customer is responsible for determining an appropriate lawful basis; providing required privacy notices; obtaining required consents, permissions or authorisations; ensuring submitted Personal Data is relevant, appropriate and lawful; authorising users; providing lawful Processing instructions; configuring access rights, roles and permissions; and avoiding unnecessary or excessive Personal Data.
The Customer will not instruct WorldEmp Holding B.V. to process Personal Data in a manner that violates applicable law.
5. Processing details
The subject matter, nature, purposes, categories of Personal Data and categories of Data Subjects covered by this DPA are described in Schedule 1.
The Processing continues for the duration of the Customer’s use of the Service and for any additional period during which Customer Personal Data is retained in accordance with the contractual relationship, applicable retention requirements or applicable law.
WorldEmp Holding B.V. will not process Customer Personal Data for unrelated purposes or use Customer Personal Data to train third-party general-purpose foundation models.
6. Confidentiality and authorised personnel
WorldEmp Holding B.V. will ensure that persons authorised to process Customer Personal Data do so only as necessary for their responsibilities, are bound by appropriate confidentiality obligations, receive access only for legitimate operational, support, security, development or compliance purposes, and are subject to appropriate access-control and least-privilege principles.
7. Security
WorldEmp Holding B.V. will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful Processing. The measures are described in Schedule 2 and may be updated as technology, risks, legal requirements and the Service develop, provided that the overall level of protection is not materially reduced.
8. Subprocessors
The Customer provides general written authorisation for WorldEmp Holding B.V. to engage Subprocessors where reasonably necessary to provide, secure, support or operate Triggerize Studio. WorldEmp Holding B.V. will conduct appropriate due diligence, impose data-processing obligations materially consistent with this DPA and remain responsible for Subprocessor performance to the extent required by applicable data protection law. A current list is available on request or through another method made available by Triggerize. Where reasonably practicable, WorldEmp Holding B.V. will notify the Customer of material new Subprocessors. The Customer may object on reasonable and documented data-protection grounds, and the parties will seek a commercially reasonable solution; if none is available, either party may terminate the affected Service in accordance with the applicable contractual arrangements.
9. International transfers
WorldEmp Holding B.V. aims to process and store Triggerize Studio platform data and AI-related data within the European Economic Area where reasonably possible.
Where Customer Personal Data is transferred outside the European Economic Area, WorldEmp Holding B.V. will use an appropriate transfer mechanism required by applicable data protection law, including an adequacy decision, an eligible recognised adequacy framework, the European Commission Standard Contractual Clauses with supplementary safeguards where appropriate, or another lawful mechanism recognised under the GDPR.
10. Data Subject rights
Taking into account the nature of the Processing, WorldEmp Holding B.V. will provide reasonable assistance to the Customer, through appropriate technical and organisational measures where reasonably possible, to enable the Customer to respond to requests from Data Subjects exercising their rights under applicable data protection law.
Such requests may include rights of access, rectification, erasure, restriction, objection, data portability, withdrawal of consent and, where applicable, rights relating to automated decision-making.
If WorldEmp Holding B.V. receives such a request directly, it will normally refer the Data Subject to the Customer or inform the Customer, unless legally required to respond directly. The Customer remains responsible for the response.
11. Personal Data Breaches
WorldEmp Holding B.V. will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data processed under this DPA.
The notification will include available information reasonably necessary to assist the Customer in meeting applicable breach-notification obligations, including the nature of the Personal Data Breach; the categories and approximate numbers of affected Data Subjects and records, where known; the likely consequences; measures taken or proposed to contain, investigate or remediate the breach; and appropriate contact information. Information may be provided in phases where complete information is not immediately available.
Notification of a Personal Data Breach does not constitute an acknowledgement of fault or liability by WorldEmp Holding B.V.
WorldEmp Holding B.V. will take reasonable steps to investigate, contain and remediate Personal Data Breaches within its responsibility.
12. Assistance with compliance
Taking into account the nature of the Processing and the information available to it, WorldEmp Holding B.V. will provide reasonable assistance with security of Processing, Personal Data Breach assessment and notification, data protection impact assessments, prior consultation with Supervisory Authorities where legally required, and Data Subject rights.
The Customer remains responsible for determining whether a data protection impact assessment or consultation is required for its use of Triggerize Studio.
Where assistance requested by the Customer requires substantial work beyond the normal operation of the Service, WorldEmp Holding B.V. may charge reasonable fees for such assistance where permitted by law and agreed with the Customer.
13. Audits and compliance information
WorldEmp Holding B.V. will make available information reasonably necessary to demonstrate compliance, which may include relevant security and compliance documentation, technical and organisational measures, audit or certification information, and responses to reasonable questionnaires. If that information is insufficient for a legitimate regulatory obligation, the Customer may request an audit specific to Processing under this DPA. Audits require reasonable prior notice, will normally occur no more than once in any twelve-month period unless required by a Supervisory Authority or following a material security incident, must take place during normal business hours, minimise disruption, comply with confidentiality and security requirements, and must not expose other customers’ information or compromise platform security. The Customer bears its own audit costs, and reasonable additional costs may be charged where permitted by law.
14. Return and deletion of Customer Personal Data
Upon termination or expiry of the Service, Customer Personal Data may remain available for export for the period specified in the applicable contractual terms or functionality.
Thereafter, WorldEmp Holding B.V. will delete or anonymise Customer Personal Data processed on behalf of the Customer, unless continued retention is required for backup and disaster recovery, legal, accounting, tax or compliance obligations, fraud or security investigations, legal claims or disputes, or technical limitations inherent in secure backup systems. Retained Personal Data will remain protected and will not be used for unrelated purposes. Where reasonably available, the Customer may export or delete Customer Data directly before termination.
15. Records and regulatory cooperation
WorldEmp Holding B.V. will maintain records relating to Processing activities to the extent required by applicable data protection law.
Where legally required, WorldEmp Holding B.V. will cooperate with competent Supervisory Authorities in relation to Processing carried out under this DPA.
Nothing in this DPA requires either party to disclose information that is legally privileged, prohibited from disclosure, relates to another customer, or would materially compromise the security of Triggerize Studio or another system.
16. Liability
Liability arising under this DPA is subject to the exclusions, limitations and allocation of liability set out in the Triggerize Terms of Service or applicable contractual arrangement, to the maximum extent permitted by applicable law.
Nothing in this DPA limits any liability or rights that cannot lawfully be excluded or limited under applicable data protection law.
17. Duration and termination
This DPA becomes effective when the Customer becomes bound by the Triggerize Terms of Service, enters into an applicable Order Form or otherwise enters into a contractual relationship under which WorldEmp Holding B.V. processes Customer Personal Data on the Customer’s behalf.
The DPA remains in effect for as long as WorldEmp Holding B.V. processes Customer Personal Data on behalf of the Customer.
Provisions concerning confidentiality, security, deletion, liability and other obligations that by their nature continue after termination remain applicable for as long as relevant Customer Personal Data is retained.
18. Governing law
This DPA is governed by the laws of the Netherlands, unless mandatory applicable data protection law requires otherwise.
Disputes relating to this DPA are subject to the jurisdiction provisions contained in the applicable Triggerize Terms of Service or other governing contractual arrangement.
Nothing in this section limits the powers of a competent Supervisory Authority or mandatory rights available under applicable data protection law.
19. Contact
Triggerize, a trade name and operating label of WorldEmp Holding B.V., the Netherlands. Privacy and data-protection enquiries: info@triggerize.nl.
Schedule 1 — Details of Processing
1. Subject matter
Processing Customer Personal Data as necessary to provide, operate, secure and support Triggerize Studio and Customer-selected functionality.
2. Duration
For the Customer’s subscription or contractual term and any applicable retention, export, backup or deletion period after termination.
3. Nature of Processing
Processing may include collection, transmission, receipt, organisation, structuring, storage, retrieval, consultation, analysis, generation, modification, use, disclosure to authorised Subprocessors, restriction, deletion and anonymisation, depending on the functionality selected and the information submitted by the Customer or its users.
4. Purposes of Processing
Customer Personal Data may be processed to provide Triggerize Studio functionality; perform user-requested research, analysis, content drafting, rewriting and optimisation; conduct keyword, topic and visibility analysis; create personas, recommendations and content plans; support collaboration and workflows; maintain Customer workspaces; provide technical support and troubleshooting; prevent abuse; and operate and improve service performance.
5. Categories of Data Subjects
Depending on Customer use, Data Subjects may include Customer employees, contractors, users and authorised representatives; clients or prospective clients; business contacts; website users or visitors; individuals referred to in Customer content, prompts, documents or other submitted information; and other individuals whose Personal Data the Customer lawfully processes using Triggerize Studio.
6. Categories of Personal Data
Depending on Customer use, Customer Personal Data may include names; business contact information and email addresses; job titles and organisational information; user-provided text, content, prompts and instructions; comments and collaboration data; website or domain information; marketing and audience information; information contained in uploaded or submitted content; AI-generated output that contains or relates to identifiable individuals; and other Personal Data intentionally submitted by authorised users.
Triggerize Studio is not intended for routine Processing of data under Articles 9 or 10 GDPR unless expressly agreed and appropriately assessed.
Schedule 2 — Technical and Organisational Measures
WorldEmp Holding B.V. applies technical and organisational measures appropriate to the nature and risk of the Processing.
Access security
Measures include role-based access control, least-privilege principles, controlled administrative access, multi-factor authentication where appropriate, and authentication and session controls.
Encryption and data protection
Measures include TLS encryption for data in transit, encryption of stored data where appropriate, application-level encryption for sensitive authentication information, and protection of authentication credentials and tokens.
Logging and monitoring
Measures include audit, activity and security logging, authentication attempt records, and pseudonymisation of selected operational log identifiers where appropriate.
Infrastructure security
Measures include controlled cloud infrastructure, access restrictions, separation of customer access through application-level controls, and security configuration and infrastructure access policies.
Organisational measures
Measures include confidentiality obligations for authorised personnel, need-based access restrictions, documented security and data-protection responsibilities, incident-management and escalation processes, and periodic review of relevant security and privacy controls.
The measures may be updated as Triggerize Studio, technology and security risks develop, provided that the overall level of protection is not materially reduced.