Data Processing Agreement
Terms governing how MentionFox processes data on your behalf
Last updated: April 2026
1. Scope and Applicability
This Data Processing Agreement ("DPA") forms part of the MentionFox Terms of Service between MentionFox ("Processor") and the customer ("Controller") and applies to any processing of personal data that MentionFox performs on behalf of the customer in providing the MentionFox service.
This DPA applies automatically to all customers. By using MentionFox, you agree to this DPA. Customers requiring a signed DPA may request one at legal@mentionfox.com.
2. Definitions
- "Personal Data" — any information relating to an identified or identifiable natural person, as defined in GDPR Article 4(1).
- "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
- "Controller" — the MentionFox customer who determines the purposes and means of processing Personal Data using MentionFox.
- "Processor" — MentionFox, which processes Personal Data on behalf of the Controller.
- "Sub-processor" — a third party engaged by MentionFox to process Personal Data. See our Sub-processors page.
3. Categories of Data Processed
| Category | Data Types | Data Subjects |
|---|---|---|
| Account Data | Name, email, password hash | Customer users |
| Scan Results | Social media posts, usernames, profile URLs | Third-party social media users |
| Enrichment Data | Names, email addresses, job titles, companies, social profiles | Leads/contacts discovered by the customer |
| Outreach Data | Email addresses, message content, send/delivery status | Recipients of customer outreach |
| Usage Data | Feature usage, timestamps, IP addresses (anonymized) | Customer users |
4. Obligations of the Processor
MentionFox shall:
- Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data outside the EU/EEA.
- Ensure that persons authorized to process Personal Data have committed themselves to confidentiality.
- Take all measures required under GDPR Article 32 regarding security of processing, including encryption at rest (AES-256) and in transit (TLS 1.2+).
- Not engage another processor without prior written authorization of the Controller. The current list of sub-processors is available at /subprocessors.
- Assist the Controller in responding to data subject requests (access, rectification, erasure, portability, restriction, objection) within the timeframes required by GDPR.
- Assist the Controller in ensuring compliance with GDPR Articles 32–36 (security, breach notification, DPIAs, prior consultation).
- At the Controller's choice, delete or return all Personal Data after the end of the service relationship, and delete existing copies unless storage is required by law.
- Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections.
5. Sub-processors
MentionFox uses the sub-processors listed on our Sub-processors page. We will notify customers of any intended changes to sub-processors by updating that page and, for material changes, sending email notification at least 14 days in advance.
If a Controller objects to a new sub-processor, they may terminate their MentionFox subscription without penalty within 30 days of notification.
6. International Transfers
Where Personal Data is transferred outside the EU/EEA, MentionFox relies on Standard Contractual Clauses (SCCs) as adopted by the European Commission. Japan has received an adequacy decision from the European Commission (January 2019). For transfers to the United States (AI processing), we rely on SCCs with supplementary technical measures including encryption and access controls.
7. Data Breach Notification
MentionFox will notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach affecting the Controller's data. Notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.
8. Data Retention and Deletion
MentionFox retains Personal Data for the duration of the customer's subscription. Upon account termination or deletion request, all Personal Data will be permanently deleted within 30 days, except where retention is required by applicable law. Aggregated, anonymized data that cannot be linked to any individual may be retained for analytics purposes.