GDPR-compliant template. Last updated: 2026-09-24
This Data Processing Agreement (the "DPA") forms an integral part of the Terms of Use of Sentinel Briefing and applies whenever Sentinel Briefing (the "processor") processes personal data on behalf of the Customer (the "controller").
Terms used in this DPA follow the definitions of the General Data Protection Regulation (EU 2016/679, GDPR): "personal data", "processing", "controller", "processor", "data subject", "personal data breach".
The processor processes data to provide the strategic monitoring service: collecting the sources chosen by the Customer, sorting and analysing articles with artificial intelligence, writing and sending briefings, checking the facts they cite, managing users and access, and billing.
| Category | Data | Data subjects |
|---|---|---|
| Identification | first name, last name, email address, internal identifier | the Customer's users |
| Sign-in | authentication logs, IP address, browser, session cookie | the Customer's users |
| Content | watches, sources, briefings, team comments, feedback on briefings | the Customer's users |
| Activity log | actions of the firm's members (sign-ins, invitations, role changes, API keys, exports) | the Customer's users |
| Analysed sources | names, positions, organisations and quotations found in the articles and public registers monitored | people mentioned in the sources |
| Billing | plan, subscription status, Stripe identifiers (no card data) | the Customer's billing contact |
Processing lasts for as long as the Customer's account is open. The end of a paid subscription does not close the account, which returns to the free plan. When the account is closed, the Customer may request an export of its data for 30 days; its data, including personal data, is deleted or anonymised no later than 90 days after closure. Articles collected from public sources are kept for the history of the watches.
The processor uses sub-processors, under a data processing agreement with each of them, in the following categories:
| Category | Location |
|---|---|
| Hosting, backups and email sending | Germany (EU) |
| Artificial intelligence models | EU and United States |
| Web search and fact checking | United States |
| Audio transcription | United States |
| Payment | EU and United States |
| Audience measurement, after consent | EU |
The list of sub-processors by name is annexed to the signed DPA and provided on request at contact@sentinelbriefing.com. For transfers to the United States, safeguards rely on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR) or, where the recipient has joined it, on the EU-US Data Privacy Framework. The Customer is informed in advance of any change to this list and may object within 30 days.
The Customer can exercise its users' GDPR rights directly from the application:
GET /api/me/export returns a complete JSON fileDELETE /api/me anonymises the account immediatelyIn the event of a personal data breach, the processor informs the Customer within 72 hours, in line with Article 33 GDPR, by email to the account's contact address.
On reasonable request and with 30 days' notice, the Customer may ask for a certificate of compliance or an audit limited to the technical and organisational measures applicable to its data.
For any question about data protection: contact@sentinelbriefing.com
A signable version is available on request at the address above. For the Team, Firm and Enterprise plans, a custom DPA can be negotiated.