Data Processing Addendum (Template)

Last updated: October 27, 2026

Template. This is Monarchy's standard Data Processing Addendum for business clients. It becomes binding only when completed and signed by both parties as part of a services agreement. Fields in [square brackets] are completed for each client. To request a copy for signature, write to legal@monarchy.io.

This Data Processing Addendum ("DPA") forms part of the agreement for services (the "Agreement") between [CLIENT LEGAL NAME], [CLIENT ADDRESS] ("Client"), and Monarchy Media LLC, 650 Cleveland Street #2291, Clearwater, Florida, United States ("Monarchy"). It applies when Monarchy processes Personal Data on behalf of Client in providing the services.

1. Definitions

"Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA"), and other U.S. state privacy laws. "Personal Data", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "processing" have the meanings given in the GDPR (or the equivalent terms under other Data Protection Laws, such as "business", "service provider" and "personal information" under the CCPA). "Sub-processor" means a third party engaged by Monarchy to process Client Personal Data. "Client Personal Data" means Personal Data processed by Monarchy on Client's behalf under the Agreement.

2. Roles and scope

2.1 Client is the Controller (or a Processor acting for its own Controller) and Monarchy is the Processor (and a "service provider" under the CCPA) of Client Personal Data.
2.2 The subject matter, duration, nature and purpose of the processing, and the types of Personal Data and categories of Data Subjects, are described in Annex I.
2.3 Each party will comply with the Data Protection Laws that apply to it. Client is responsible for the lawfulness of the Client Personal Data it provides and of its instructions, including having a valid legal basis and giving any required notices and obtaining any required consents (for example for marketing calls, texts or emails made on Client's behalf).

3. Client instructions

3.1 Monarchy will process Client Personal Data only on Client's documented instructions, including those in the Agreement, this DPA and Client's use of the services, unless required otherwise by law (in which case Monarchy will inform Client before processing, unless the law prohibits it).
3.2 Monarchy will inform Client promptly if, in its opinion, an instruction infringes Data Protection Laws.
3.3 CCPA. Monarchy will not: sell or share Client Personal Data; retain, use or disclose it for any purpose other than the business purposes specified in the Agreement; retain, use or disclose it outside the direct business relationship with Client; or combine it with personal information received from other sources, except as permitted by the CCPA. Monarchy will notify Client if it can no longer meet its CCPA obligations. Monarchy certifies that it understands and will comply with these restrictions.

4. Confidentiality

Monarchy will ensure that people authorized to process Client Personal Data are bound by confidentiality obligations and receive appropriate training.

5. Security

Monarchy will implement appropriate technical and organizational measures to protect Client Personal Data, as described in Annex II, taking into account the state of the art, costs, and the nature, scope, context and purposes of processing and the risks to Data Subjects.

6. Artificial intelligence

6.1 Monarchy may use AI systems (including AI assistants and AI model providers listed in Annex III) to perform the services. Monarchy remains responsible for them as for any Sub-processor.
6.2 Monarchy will not permit AI model providers to use Client Personal Data to train or improve their general-purpose models, where this can be controlled through contract or service settings, unless Client agrees in writing.
6.3 Where the services involve AI-generated or automated communications with Data Subjects on Client's behalf, the parties will agree in the Agreement or a statement of work how those communications are disclosed and how recipients can reach a person and opt out.

7. Sub-processors

7.1 Client gives general authorization for Monarchy to engage Sub-processors. The Sub-processors in use at signature are listed in Annex III.
7.2 Monarchy will notify Client of any intended addition or replacement of a Sub-processor at least [NOTICE PERIOD] days in advance. Client may object on reasonable data protection grounds within that period; the parties will then discuss in good faith, and if no solution is found, Client may terminate the affected services.
7.3 Monarchy will impose data protection obligations on each Sub-processor that are no less protective than this DPA and remains liable for their performance.

8. Data Subject requests

Taking into account the nature of the processing, Monarchy will assist Client by appropriate measures in responding to requests from Data Subjects to exercise their rights. If Monarchy receives a request directly, it will forward it to Client without undue delay and will not respond except on Client's instructions or to confirm the request has been forwarded.

9. Personal Data Breaches

Monarchy will notify Client without undue delay, and in any event within [BREACH NOTICE HOURS] hours, after becoming aware of a Personal Data Breach affecting Client Personal Data, and will provide the information reasonably available to help Client meet its own notification obligations. Monarchy will take reasonable steps to contain and remedy the breach.

10. Assistance

Monarchy will provide reasonable assistance to Client with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and relating to Monarchy's processing.

11. Return and deletion

At the end of the services, or on Client's written request, Monarchy will, at Client's choice, return or delete Client Personal Data within [DELETION PERIOD] days, and delete existing copies, unless retention is required by law (in which case it will remain protected by this DPA).

12. Audits

Monarchy will make available to Client the information reasonably necessary to demonstrate compliance with this DPA. Client may, at its own cost and no more than once in any 12-month period (unless required by a supervisory authority or after a Personal Data Breach), audit Monarchy's compliance on at least [AUDIT NOTICE] days' written notice, during business hours, subject to confidentiality and without access to other clients' data. Monarchy may satisfy audit requests first by providing relevant documentation and third-party certifications or reports where available.

13. International transfers

13.1 Client acknowledges that Monarchy is located in the United States and that Client Personal Data may be processed in the United States and other countries where Monarchy's Sub-processors operate.
13.2 Where Client Personal Data subject to the GDPR, UK GDPR or Swiss law is transferred to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 apply, Module Two (controller to processor) or Module Three (processor to processor) as applicable, incorporated by reference, with: Clause 7 (docking) included; Clause 9 option 2 (general authorization) with the notice period in section 7.2; Clause 11 optional language excluded; Clauses 17 and 18 governed by and subject to the courts of [EU MEMBER STATE]; Annexes completed by Annexes I to III of this DPA. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the necessary adaptations apply (FDPIC as competent authority, Swiss law references). Where a recipient is certified under the EU-U.S. Data Privacy Framework (or its UK or Swiss extensions), that framework may be relied on instead.

14. Health information

This DPA does not by itself authorize Monarchy to receive protected health information under HIPAA. If the services involve such information, the parties will sign a separate Business Associate Agreement, which prevails for that information.

15. Liability, term and precedence

15.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, to the extent permitted by Data Protection Laws.
15.2 This DPA lasts as long as Monarchy processes Client Personal Data.
15.3 In case of conflict, the following order applies: the Standard Contractual Clauses (where applicable), then this DPA, then the Agreement.
15.4 Except where Data Protection Laws or the Standard Contractual Clauses require otherwise, this DPA is governed by the laws of the State of Florida, and the courts located in the State of Florida have jurisdiction.

Annex I: Description of processing

Controller / data exporter: [CLIENT LEGAL NAME], contact [CLIENT PRIVACY CONTACT].
Processor / data importer: Monarchy Media LLC, 650 Cleveland Street #2291, Clearwater, Florida, United States; contact legal@monarchy.io.
Services: [DESCRIBE SERVICES, e.g. call center / appointment setting, advertising and lead generation, technology and AI desk setup, creative production, events].
Categories of Data Subjects: [e.g. Client's customers and prospects, leads, event attendees, Client personnel].
Categories of Personal Data: [e.g. name, email, phone number, appointment details, communication content and recordings, campaign and tracking data].
Sensitive data: [None / describe and the additional safeguards].
Nature and purpose of processing: performing the services under the Agreement, including collection, storage, organization, communication with Data Subjects on Client's behalf (which may be automated or AI-assisted), analysis and reporting.
Frequency: continuous for the duration of the services.
Duration and retention: term of the Agreement plus the return/deletion period in section 11.

Annex II: Technical and organizational measures

Encryption in transit (TLS) for data exchanged with Monarchy systems; encryption at rest as provided by our hosting and SaaS providers.
Role-based, least-privilege access; individual accounts; multi-factor authentication where supported; prompt removal of access when no longer needed.
Scoped API keys and secrets stored in managed secret stores, never in code; key rotation after suspected exposure.
Reputable providers with recognized security certifications, selected and reviewed for data protection.
Logging of administrative access where supported; monitoring for abuse and anomalies.
Data minimization: only the Personal Data needed for the services; test data instead of real data where practical.
Confidentiality commitments and data protection training for personnel and contractors.
Incident response process with notification to Client as in section 9.
Backups and recovery as provided by our providers.
Controls on AI use: no training of general models on Client Personal Data where controllable; human oversight of AI systems; disclosure of AI use in communications as agreed.

Annex III: Sub-processors (at signature)

Sub-processor	Purpose	Location
HighLevel, Inc. (LeadConnector)	CRM, email, telephony and messaging platform	United States
Cloudflare, Inc.	Hosting, content delivery, security, serverless functions and storage	Global network; United States
Google LLC (Google Workspace)	Email, documents and collaboration	United States and global
[AI MODEL PROVIDER(S)]	AI-assisted drafting, AI assistants	[LOCATION]
[OTHER SUB-PROCESSORS FOR THE SPECIFIC SERVICES]	[PURPOSE]	[LOCATION]

Signatures
Client: [NAME, TITLE, DATE]
Monarchy Media LLC: [NAME, TITLE, DATE]