Gain Data Processing Agreement

Big Propeller, LLC d/b/a Gain

Version: 1.0 | Last Updated: October 21, 2026 | Effective: October 21, 2026

This Data Processing Agreement (“DPA”) applies automatically to every customer that uses the Services under Gain’s Terms of Service or any other agreement with Gain. No customer details need to be added for it to take effect. Customers that require a countersigned copy may download the PDF file found at the end of the page, complete the sign block and return it to Gain.

1. Parties and Scope

This DPA forms part of, and is incorporated into, the Gain Terms of Service or other written or electronic agreement between Gain and Customer governing Customer’s use of the Services (the “Agreement”).

Processor: Big Propeller, LLC d/b/a Gain, 1101 Brickell Ave S-800, Miami, FL 33131 (“Gain” or “Processor”).

Controller: The entity that has entered into the Agreement with Gain, as identified in the Agreement, order form, or account registration (“Customer” or “Controller”).

Customer has engaged Gain to provide content approval and collaboration software services (the “Services”). In providing the Services, Gain processes Personal Data on behalf of Customer. This DPA governs that processing and sets out the parties’ obligations under applicable Data Protection Laws. Customer enters into this DPA on behalf of itself and, where required by Data Protection Laws, its Affiliates permitted to use the Services.

2. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

“Data Protection Laws” means all laws applicable to the processing of Personal Data under the Agreement, including: (a) the EU General Data Protection Regulation 2016/679 (“GDPR”); (b) the UK GDPR and the UK Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection (“FADP”); (d) the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”); and (e) other applicable U.S. state privacy laws.

“Personal Data” means any information relating to an identified or identifiable natural person that Gain processes on behalf of Customer in connection with the Services, including “personal information” as defined under the CCPA.

“Processing” means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, storage, use, disclosure, transmission, or deletion.

“Controller” and “Processor” have the meanings given in the GDPR. Controller includes “Business” and Processor includes “Service Provider” as defined under the CCPA.

“Subprocessor” means any third party engaged by Gain to process Personal Data on behalf of Customer.

“Data Subject” means an identified or identifiable natural person to whom Personal Data relates, including a “Consumer” under the CCPA.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed by Gain. It does not include unsuccessful attempts that do not compromise the security of Personal Data, such as failed log-in attempts, pings, or port scans.

“Aggregated Data” has the meaning given in Section 5.8.

“Standard Contractual Clauses” (“SCCs”) means the clauses approved by the European Commission under Implementing Decision (EU) 2021/914, including any successor clauses.

3. Roles and Customer Responsibilities

3.1 Roles. For Personal Data processed under the Agreement, Customer is the Controller (or Business) and Gain is the Processor (or Service Provider). Where Customer acts as a Processor on behalf of a third-party Controller, such as an agency acting for its own clients, Gain acts as Customer’s Subprocessor.

3.2 Customer Responsibilities. Customer is solely responsible for:

• Complying with Data Protection Laws applicable to it, including giving required notices to and obtaining required consents from Data Subjects.
• The accuracy, quality, and legality of Personal Data and the means by which it was acquired.
• Ensuring it has the right to transfer Personal Data to Gain for processing.
• Configuring the Services and using available security features appropriately for the sensitivity of the Personal Data.
• Not uploading special categories of personal data (such as health data) to the Services unless it has a lawful basis and appropriate safeguards in place.

3.3 Duration. This DPA takes effect when Customer accepts the Agreement and continues for as long as Gain processes Personal Data on behalf of Customer.

4. Details of Processing

The subject matter, nature, purpose, duration, types of Personal Data, and categories of Data Subjects are set out in Annex 1.

5. Gain’s Obligations as Processor

5.1 Instructions. Gain shall process Personal Data only on Customer’s documented instructions, including with regard to international transfers, unless required otherwise by applicable law. Customer’s instructions are set out in the Agreement, this DPA (including Section 5.8), and Customer’s use and configuration of the Services. Gain shall inform Customer if it believes an instruction infringes Data Protection Laws.

5.2 Confidentiality. Gain shall ensure that personnel authorized to process Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality.

5.3 Security. Gain shall implement and maintain the technical and organizational measures described in Annex 2. Gain may update these measures from time to time, provided the overall level of security is not materially reduced.

5.4 Data Subject Requests. Taking into account the nature of the processing, Gain shall provide reasonable assistance to enable Customer to respond to Data Subject requests to exercise their rights under Data Protection Laws. If Gain receives such a request directly, it shall promptly notify Customer where Customer is identifiable from the request, and shall not respond except to redirect the Data Subject to Customer, unless required by law.

5.5 Compliance Assistance. Taking into account the nature of the processing and the information available to Gain, Gain shall provide reasonable assistance to Customer with data protection impact assessments, prior consultations with supervisory authorities, and Personal Data Breach notifications.

5.6 Retention, Return, and Deletion. Following termination or expiration of the Agreement, Gain may retain Personal Data to allow Customer to reactivate its account, unless Customer instructs otherwise. On Customer’s written request, Gain shall delete or, at Customer’s election, return Personal Data from its production databases, active storage, and Subprocessor systems within thirty (30) days of the request, and shall confirm deletion in writing. Encrypted backups cannot be selectively edited; Personal Data in backups is permanently overwritten as backups rotate out under Gain’s retention schedule, within a maximum of twelve (12) months. Gain may also retain copies where required by law. Retained data remains subject to this DPA until deleted.

5.7 No AI Training. Gain shall not use Personal Data or Customer content to train or improve artificial intelligence models. Where Customer uses AI-assisted features, the text Customer submits is processed by the relevant Subprocessor listed in Annex 3 solely to provide that feature, under terms that prohibit its use for model training.

5.8 Aggregated and De-identified Data. Customer instructs Gain to aggregate and de-identify Personal Data and other data relating to Customer’s use of the Services so that it no longer identifies, and cannot reasonably be used to identify, Customer, its clients or any Data Subject (“Aggregated Data”). Gain may use Aggregated Data to provide and improve the Services and for research, benchmarking and published industry statistics. Aggregated Data is not Personal Data. Gain will not attempt to re-identify Aggregated Data, will not identify Customer or its clients as the source of published Aggregated Data, and will contractually prohibit any recipient of non-public Aggregated Data from attempting to re-identify it. Customer may ask Gain to exclude its data from published benchmarks by writing to privacy@gainapp.com.

6. Subprocessors

6.1 General Authorization. Customer grants Gain general written authorization to engage Subprocessors. The current list is set out in Annex 3.

6.2 Changes. Gain will notify Customer’s account owner at least ten (10) days before engaging a new or replacement Subprocessor. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer’s sole remedy is to terminate the affected Services.

6.3 Subprocessor Obligations. Gain engages each Subprocessor under written terms that include data protection obligations consistent with this DPA. Gain remains liable to Customer for each Subprocessor’s processing of Personal Data on its behalf.

7. Personal Data Breach

Gain shall notify Customer by email to its account owner, and through Gain’s status page, without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer’s Personal Data. To the extent known, the notice shall describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Gain shall provide updates as further information becomes available. Gain shall not identify Customer in any public statement about a Personal Data Breach without Customer’s prior written consent.

8. International Transfers

8.1 General. Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the transfer is governed by the SCCs as set out below.

8.2 EU Transfers. The SCCs (Module Two where Customer is a Controller; Module Three where Customer is a Processor) are incorporated by reference, completed as follows: Clause 7 (docking clause) does not apply; under Clause 9, Option 2 (general authorization) applies with the notice period in Section 6.2; the optional language in Clause 11 does not apply; under Clause 17, the SCCs are governed by the law of Ireland; under Clause 18, disputes are resolved before the courts of Ireland; Annexes I, II, and III are completed by Annexes 1, 2, and 3 of this DPA; and the competent supervisory authority is determined under Clause 13.

8.3 Swiss Transfers. For transfers subject to the FADP, the SCCs apply as in Section 8.2, with references to the GDPR read as references to the FADP, the governing law and courts being those of Switzerland, and the competent authority being the Swiss Federal Data Protection and Information Commissioner.

8.4 UK Transfers. For transfers subject to the UK GDPR, the SCCs apply as in Section 8.2, as amended by the UK International Data Transfer Addendum issued by the Information Commissioner under s.119A of the Data Protection Act 2018. Tables 1 to 3 of the Addendum are completed by Annexes 1 to 3 of this DPA, and “neither party” is selected in Table 4.

9. CCPA Provisions

To the extent Personal Data includes “personal information” under the CCPA, Gain is a Service Provider and shall not: (a) sell or share personal information; (b) retain, use, or disclose it for any purpose other than performing the Services or as permitted by Section 5.8 and the CCPA; (c) retain, use, or disclose it outside the direct business relationship with Customer; or (d) combine it with personal information from other sources, except as permitted by the CCPA. Gain certifies that it understands and will comply with these restrictions. Customer may, on notice, take reasonable steps to stop and remediate any unauthorized use of personal information by Gain.

10. Audits

On Customer’s reasonable request, and no more than once per year, Gain shall make available information reasonably necessary to demonstrate compliance with this DPA, including copies of the security certifications and audit reports of its infrastructure providers and a summary of Gain’s most recent penetration test results. Where that information is insufficient, Customer may, at its own expense, audit Gain’s processing of Personal Data, subject to: at least thirty (30) days’ written notice; a mutually agreed scope and timing; the auditor’s agreement to confidentiality terms reasonably acceptable to Gain; no unreasonable interference with Gain’s operations; and exclusion of other customers’ data and Gain’s trade secrets. The once-per-year limit does not apply following a Personal Data Breach or where a supervisory authority requires an audit.

11. Liability

Each party’s liability arising out of or in connection with this DPA, whether in contract, tort, or any other theory, is subject to and counts toward the limitations and exclusions of liability in the Agreement. The aggregate liability cap in the Agreement applies to all claims under the Agreement and this DPA together and is not multiplied by this DPA. Nothing in this DPA limits liability that cannot be limited under applicable law.

12. General Provisions

12.1 Order of Precedence. If this DPA conflicts with the Agreement, this DPA prevails as to data protection matters. If this DPA conflicts with the SCCs, the SCCs prevail.

12.2 Changes in Law. If a change in Data Protection Laws affects either party’s ability to comply with this DPA, the parties shall work together in good faith to amend it.

12.3 Updates to this DPA. Gain may update this DPA to reflect changes in Data Protection Laws, the Services, or its Subprocessors, provided updates do not materially reduce the protection given to Personal Data. Gain shall give Customer at least thirty (30) days’ notice of material changes. The current version is published at gainapp.com/legal/dpa.

12.4 Severability. If any provision of this DPA is held invalid or unenforceable, the remainder continues in full force and effect.

12.5 Governing Law. This DPA is governed by the laws of the State of Florida, U.S.A., excluding its conflict of law provisions, and disputes are resolved as set out in the Agreement, except where Data Protection Laws or the SCCs require otherwise.

12.6 Execution. This DPA is binding on Customer upon acceptance of the Agreement. Where a signed copy is requested, it may be executed in counterparts and by electronic signature.

Annex 1: Description of Processing

This Annex also completes Annex I of the SCCs and Tables 1 and 3 of the UK Addendum. The data exporter is Customer, as identified in the Agreement; the data importer is Gain.

Categories of Data Subjects

• Customer’s employees, contractors, and agents who use the Services
• Customer’s clients and their representatives invited as approvers, reviewers, or collaborators
• Individuals whose personal data appears in content uploaded to the Services, such as people featured in posts, testimonials, or photographs
• Owners and administrators of social media accounts connected to the Services
• Customer’s billing and account contacts

Types of Personal Data

• Identification and contact data: name, email address, profile image, job title, organization, phone number where provided
• Authentication data: hashed passwords, single sign-on identifiers, multi-factor authentication tokens
• Connected account credentials: OAuth and access tokens for social media platforms connected by Customer
• Content data: personal data within content uploaded for approval, including images, video, text, captions, comments, and metadata, and text submitted to AI-assisted features
• Approval and collaboration data: comments, feedback, decisions, timestamps, version history
• Usage data: IP addresses, browser type, device identifiers, session data, log files, feature usage, approximate location derived from IP address
• Billing data: billing contact name and email, billing address, payment method metadata (full card data is processed by the payment Subprocessor)
• Support communications: support tickets, chat messages, and related correspondence

Special categories of data. Gain does not require or intentionally process special categories of personal data. Customer is responsible for any such data it chooses to upload, as set out in Section 3.2.

Annex 2: Technical and Organizational Measures

This Annex also completes Annex II of the SCCs.

1. Access Control

• Access to Personal Data granted on a need-to-know and least-privilege basis, using role-based access control
• Multi-factor authentication enforced for all personnel on systems that hold customer data, including hosting, cloud storage, and source code repositories
• Unique user accounts for personnel with access to Personal Data, wherever technically feasible
• Support personnel access customer accounts only for support and troubleshooting
• Periodic review of access rights
• Prompt revocation of access upon personnel departure or role change

2. Encryption

• In transit: TLS 1.2 or higher for all data, internal and external; SSL v2 and v3 are never used
• At rest: AES-256 or equivalent for all databases, object storage, and backups
• Key management through cloud provider-managed keys
• Passwords stored using PBKDF2 with SHA-256, a unique random salt per password, and tens of thousands of hashing iterations; passwords cannot be viewed or decoded by Gain personnel
• Social media OAuth tokens kept server-side only, never exposed to client applications or stored on employee devices, and viewable by personnel only in specific cases approved by the CTO
• Where a social network supports it, API requests also require a separate application secret held in an encrypted vault apart from the database
• Uploaded media stored in non-public Amazon S3 storage under non-discoverable, randomly generated file keys

3. Infrastructure Security

• Hosting on Heroku and Amazon Web Services, which maintain ISO 27001 and SOC 2 certifications
• Segregation between production, staging, and development environments
• Firewalls and network controls restricting traffic to required ports and sources, managed by Gain’s platform provider
• Intrusion detection and logging on production systems

4. Application Security

• Every code change reviewed by a senior developer before merging, including a check for common vulnerabilities and correct handling of customer data
• Continuous dependency and secrets scanning (GitHub Dependabot and secret scanning), plus dependency audits whenever a third-party library is added
• Critical and high-severity vulnerabilities fixed immediately and never deployed to production
• Automated penetration testing by a third-party platform at least annually, covering anonymous and authenticated users at different permission levels
• Active HackerOne bug bounty program
• Protection against common application vulnerabilities (OWASP Top 10)
• Isolation between customer and client workspaces verified by an automated test suite run on every code branch
• Web application firewall protection where applicable

5. Personnel Security

• Confidentiality obligations for all personnel with access to Personal Data
• Security and data protection training at onboarding and at least annually

6. Business Continuity and Recovery

• Continuous database backups to multi-datacenter storage, allowing point-in-time recovery within the last 7 days
• Encrypted daily full backups, retained daily for 7 days, weekly for 8 weeks, and monthly for 12 months
• Documented business continuity and disaster recovery plans
• Backup integrity testing at least annually

7. Incident Response

• Admin-level and application-level audit logging, excluding sensitive data from logs
• Automated monitoring that alerts Gain personnel to suspicious activity, with logs reviewed at least weekly
• 24/7 monitoring of production systems with an on-call rotation for critical incidents
• Documented incident response plan covering identification, containment, eradication, recovery, and notification
• Customer notification by email and status page, with a post-incident report describing the root cause and remediation

8. Subprocessor Management

• Subprocessors engaged under written terms with data protection obligations consistent with this DPA
• Preference for providers that maintain recognized security certifications such as SOC 2 and ISO 27001

9. Data Minimization and Retention

• Personal Data collected only as necessary to provide the Services
• Deletion and archival processes aligned with Section 5.6
• Security logs retained for security and audit purposes
• Aggregated Data created under Section 5.8 contains no Personal Data and is published only for groups large enough that no single customer can be identified

10. Certifications

Gain relies on the independent certifications of its infrastructure and service providers. Amazon Web Services and Heroku (Salesforce) maintain SOC 2 and ISO 27001 certifications. All payment card data is handled by Stripe, a PCI DSS Level 1 Service Provider, and is never stored on Gain servers; Gain completes an annual PCI self-assessment questionnaire, available on request.

Annex 3: Subprocessors

Customer authorizes the Subprocessors below. Gain notifies Customer of changes under Section 6.2 and publishes the current list at gainapp.com/legal/dpa. This Annex also completes Annex III of the SCCs. The processing location of each Subprocessor is available on request.

Connected social platforms. Meta, TikTok, LinkedIn, X, YouTube, Pinterest, and other platforms Customer connects are not Subprocessors. They are independent controllers under their own terms, and Gain transmits data to them solely on Customer’s instruction.