GDPR & Data Protection

Last Updated: 9 September 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between iReach Insights Limited (“iReach”, “Processor”, “we”, “us” or “our”) and the organisation using iReach Conversations PRO (“Client” or “Controller”) where iReach processes Personal Data on behalf of the Client.

This DPA supplements the iReach Conversations PRO Terms of Service and any applicable order, proposal, statement of work or other agreement between iReach and the Client relating to Conversations PRO (together, the “Agreement”).

The purpose of this DPA is to set out the parties’ respective obligations in relation to the processing of Personal Data under applicable Data Protection Law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018.

1. Definitions

For the purposes of this DPA:

• “Client Personal Data” means Personal Data processed by iReach on behalf of the Client in connection with Conversations PRO.
• “Data Protection Law” means GDPR, the Data Protection Act 2018 and other applicable Irish or European Union data protection legislation.
• “Data Subject”, “Controller”, “Processor”, “Personal Data”, “Processing”, “Personal Data Breach”, “Special Categories of Personal Data” and “Supervisory Authority” have the meanings given to them under applicable Data Protection Law.
• “Subprocessor” means a third party appointed by or on behalf of iReach to process Client Personal Data in connection with the Services.
• “Services” means the Conversations PRO services provided by iReach under the Agreement.

2. Roles of the Parties

Where the Client uses Conversations PRO to conduct research with its own customers, prospects, members, employees, stakeholders or other research participants, the parties acknowledge that, unless the circumstances require otherwise:

Controller: The Client acts as Data Controller.

Processor: iReach Insights Limited acts as Data Processor.

The Client determines the purposes for which Client Personal Data is processed and is responsible for establishing the appropriate lawful basis for that processing.

iReach processes Client Personal Data on behalf of and in accordance with the documented instructions of the Client, except where otherwise required by applicable law.

Nothing in this DPA is intended to alter the parties' respective statutory responsibilities under Data Protection Law.

3. Documented Instructions

iReach will process Client Personal Data only on documented instructions from the Client, including with regard to transfers of Personal Data to a third country or international organisation, unless processing is required by applicable EU or Irish law.

The Agreement, the Client's configuration and use of Conversations PRO, research projects created or approved by the Client, and other written instructions agreed between the parties will constitute documented instructions.

If iReach reasonably believes that an instruction infringes applicable Data Protection Law, iReach will inform the Client without undue delay and may suspend the relevant processing until the matter has been resolved.

4. Details of Processing

The subject matter, nature, purpose and duration of processing, together with the categories of Data Subjects and Personal Data involved, are described in Schedule 1.

The Client is responsible for ensuring that its instructions accurately reflect the processing it requires iReach to undertake.

5. Client Responsibilities

As Controller, the Client is responsible for ensuring that its collection and use of Client Personal Data complies with applicable Data Protection Law.

The Client's responsibilities include:

• identifying an appropriate lawful basis for processing;
• providing required privacy information to Data Subjects;
• ensuring Personal Data supplied to iReach has been obtained lawfully;
• ensuring research invitations and communications are lawful;
• ensuring its instructions to iReach comply with Data Protection Law;
• responding to Data Subject requests, with assistance from iReach where required;
• determining appropriate retention periods;
• assessing whether a Data Protection Impact Assessment (“DPIA”) is required;
• obtaining consent where consent is the appropriate lawful basis; and
• establishing any additional legal basis required for processing Special Categories of Personal Data.

The Client will not instruct iReach to process Personal Data in a manner that violates applicable Data Protection Law.

6. iReach Obligations as Processor

iReach will:

• process Client Personal Data only on documented instructions from the Client;
• ensure persons authorised to process Client Personal Data are subject to appropriate confidentiality obligations;
• implement appropriate technical and organisational measures designed to protect Client Personal Data;
• comply with applicable requirements relating to the appointment of Subprocessors;
• assist the Client, taking into account the nature of processing, with Data Subject rights requests;
• assist the Client with applicable security, breach notification, DPIA and regulatory consultation obligations;
• delete or return Client Personal Data following completion of the Services where required, subject to applicable legal requirements;
• make available information reasonably necessary to demonstrate compliance with the processor obligations applicable under GDPR; and
• notify the Client if, in iReach's opinion, an instruction infringes applicable Data Protection Law.

7. Confidentiality

iReach will ensure that employees, contractors and other persons authorised to process Client Personal Data are subject to appropriate confidentiality obligations.

Access to Client Personal Data will be restricted to individuals who reasonably require such access to provide, support, secure or maintain the Services.

Confidentiality obligations will continue following termination of the relevant individual's employment, engagement or access where appropriate.

8. Security of Processing

Taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, together with the risks to individuals, iReach will implement appropriate technical and organisational measures designed to provide a level of security appropriate to the risk.

Measures may include, where appropriate:

• access controls;
• user authentication;
• role-based access restrictions;
• encryption in transit and/or at rest;
• secure hosting infrastructure;
• logging and monitoring;
• backup and recovery arrangements;
• vulnerability and security management;
• incident response procedures;
• confidentiality obligations;
• access management procedures;
• staff awareness and training; and
• procedures for securely deleting or anonymising Personal Data.

The technical and organisational measures applicable to Conversations PRO are further described in Schedule 2.

9. Subprocessors

The Client provides general authorisation for iReach to appoint Subprocessors where reasonably necessary to provide Conversations PRO.

iReach will ensure that each Subprocessor processing Client Personal Data is subject to written contractual obligations providing an appropriate level of data protection consistent with applicable Data Protection Law.

iReach will remain responsible for the performance of its Subprocessors to the extent required under GDPR.

A list of relevant Subprocessors may be maintained in Schedule 3 or another location notified to Clients.

Where required by applicable law, iReach will provide reasonable notice of intended additions or replacements to Subprocessors so that the Client may raise legitimate data protection objections.

Where a Client raises a reasonable objection, the parties will work in good faith to identify an appropriate solution.

10. AI-Assisted Processing

Conversations PRO may use artificial intelligence technology to assist with research analysis, summarisation, interpretation and reporting.

iReach currently uses technology provided by OpenAI to support certain AI-assisted features.

Where an AI service processes Client Personal Data on behalf of iReach in circumstances where iReach is acting as Processor, the relevant provider will be treated as a Subprocessor where required under applicable Data Protection Law.

AI-assisted processing does not transfer ownership of Client Personal Data or Client research results to iReach or an AI service provider.

iReach will use AI-assisted functionality only for purposes associated with providing the relevant Conversations PRO Services and in accordance with the applicable processing arrangements.

11. Data Minimisation and AI

Clients should avoid submitting directly identifiable Personal Data to AI-assisted functionality where such identification is unnecessary for the research purpose.

Where reasonably practicable, research data used for AI-assisted analysis should be anonymised, pseudonymised, aggregated or otherwise minimised before processing.

iReach may implement technical or operational controls intended to minimise the Personal Data processed through AI functionality.

12. Special Categories of Personal Data

Conversations PRO may be used for legitimate research that involves Special Categories of Personal Data.

These may include information concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or information concerning a person's sex life or sexual orientation.

Where the Client processes such information, the Client is responsible for ensuring that:

• an appropriate Article 6 lawful basis applies;
• an appropriate condition under Article 9 GDPR applies;
• the processing is necessary and proportionate;
• Data Subjects receive appropriate privacy information; and
• appropriate safeguards are implemented.

The Client should inform iReach where proposed research involves particularly sensitive or high-risk processing where this is reasonably necessary for iReach to provide appropriate safeguards.

iReach may require additional controls or decline to process information where it reasonably considers the proposed processing to create unacceptable legal, ethical or security risks.

13. Children's Personal Data

Where a Client proposes to conduct research involving children or young people, the Client is responsible for ensuring that the research complies with applicable legal, ethical and consent requirements.

Appropriate safeguards must be implemented, including parental or guardian involvement where required.

iReach may require additional information, safeguards or review before enabling research involving children.

14. Data Subject Rights

Taking into account the nature of the processing, iReach will provide reasonable assistance to the Client through appropriate technical and organisational measures to enable the Client to respond to requests from Data Subjects exercising their rights under Data Protection Law.

These may include requests relating to:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• portability; and
• applicable rights relating to automated decision-making.

Where iReach receives a request directly from a Data Subject concerning Client Personal Data processed solely on behalf of the Client, iReach will, where appropriate, refer the request to the Client and will not independently respond substantively unless required by law or authorised by the Client.

15. Personal Data Breaches

iReach will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.

Where reasonably available, the notification will include information necessary to assist the Client in meeting its obligations under applicable Data Protection Law, including:

• the nature of the breach;
• categories of Data Subjects affected;
• categories of Personal Data affected;
• likely consequences of the breach;
• measures taken or proposed to address the breach; and
• relevant contact information.

Where all information is not immediately available, iReach may provide information in phases as it becomes available.

iReach will take reasonable steps to contain, investigate and mitigate a Personal Data Breach within its control.

Notification by iReach does not constitute an admission of fault or liability.

16. DPIAs and Regulatory Consultation

Taking into account the nature of processing and information reasonably available to iReach, iReach will provide reasonable assistance to the Client with Data Protection Impact Assessments and prior consultation with a Supervisory Authority where such assistance is required by GDPR in relation to processing undertaken by iReach on behalf of the Client.

Additional assistance beyond the normal operation of Conversations PRO may be subject to reasonable professional fees where appropriate and agreed in advance.

17. International Data Transfers

The core Conversations PRO hosting environment is located in the European Union.

Where iReach or an authorised Subprocessor transfers Client Personal Data outside the European Economic Area, iReach will ensure that an appropriate transfer mechanism is in place where required under Data Protection Law.

Such mechanisms may include:

• an adequacy decision adopted by the European Commission;
• European Commission Standard Contractual Clauses;
• another legally recognised transfer mechanism; or
• another applicable derogation where lawfully available.

iReach will implement supplementary safeguards where required following an assessment of the relevant transfer.

18. Return and Deletion of Client Personal Data

At the end of the provision of Services involving Client Personal Data, iReach will, at the Client's choice and subject to the functionality of the Services, delete or return Client Personal Data and delete remaining copies, unless applicable law requires continued retention.

Data may remain temporarily within secure backup systems following deletion from active systems until those backups are overwritten or securely deleted in accordance with established retention procedures.

19. Data Retention

The Client determines the appropriate retention period for Client Personal Data where iReach processes such information on its behalf.

iReach will retain Client Personal Data only for as long as necessary to provide the Services, comply with documented Client instructions or satisfy applicable legal obligations.

Specific Platform retention settings and deletion procedures may be documented separately.

20. Audits and Compliance Information

iReach will make available to the Client information reasonably necessary to demonstrate compliance with its obligations as Processor under applicable Data Protection Law.

Where reasonably required, iReach will allow for and contribute to audits or inspections relating to processing carried out on behalf of the Client.

Audits should:

• be requested with reasonable advance notice;
• normally occur no more than once in any twelve-month period unless required following a security incident, regulatory requirement or reasonable evidence of non-compliance;
• take place during normal business hours;
• avoid unreasonable disruption to iReach's operations;
• protect confidential information relating to other Clients and iReach systems; and
• where appropriate, make reasonable use of existing security documentation, independent assessments or compliance information before requiring an on-site audit.

21. iReach Acting as Independent Controller

The parties acknowledge that iReach may process certain Personal Data as an independent Data Controller rather than as Processor.

This may include processing necessary for:

• managing Conversations PRO user accounts;
• billing and financial administration;
• fraud prevention;
• information security;
• legal and regulatory compliance;
• managing its business relationship with the Client;
• maintaining business records; and
• administering iReach's own Research Panels.

Such processing is outside the scope of iReach's Processor obligations under this DPA and is governed by applicable Data Protection Law and the relevant iReach privacy information.

22. iReach Research Panels

Where a Client conducts research using an iReach Research Panel, the respective Controller and Processor roles may differ from research involving the Client's own audience.

iReach may act as an independent Controller in relation to the recruitment, administration, profiling, incentives, communications and management of its own panel members.

The parties will determine any additional data protection arrangements required for particular panel research activities.

23. Records and Regulatory Cooperation

iReach will maintain records relating to processing activities where required under applicable Data Protection Law.

iReach will cooperate with the Irish Data Protection Commission or another competent Supervisory Authority where required by applicable law.

24. Liability

The liability of each party arising from this DPA will be subject to the liability provisions of the applicable Conversations PRO Terms of Service or other commercial agreement between the parties, except to the extent that liability cannot lawfully be limited.

Nothing in this DPA relieves either party of its own responsibilities or liabilities under applicable Data Protection Law.

25. Duration and Termination

This DPA will remain in effect for as long as iReach processes Client Personal Data on behalf of the Client.

Termination of the main Agreement will not affect provisions of this DPA that are intended to survive termination, including confidentiality, deletion/return requirements and other continuing data protection obligations.

26. Order of Precedence

If there is a conflict between this DPA and the Conversations PRO Terms of Service concerning the processing and protection of Client Personal Data, this DPA will take precedence in relation to that processing.

Where the parties have entered into another signed agreement containing specific data protection provisions, the order of precedence will be determined by that agreement.

27. Governing Law

This DPA will be governed by the laws of Ireland.

The courts of Ireland will have jurisdiction in relation to disputes arising from this DPA, subject to applicable rights and powers of the Irish Data Protection Commission and other competent Supervisory Authorities.

28. Contact Details

Processor:

iReach Insights Limited
Ireland
Privacy/Data Protection Contact: --
Email: info@ireachconversations.com
Registered Office: --
Company Registration Number: --

Controller:

The organisation identified as the Client in the applicable Conversations PRO account, order, proposal, statement of work or other Agreement.

Schedule 1 - Details of Processing

Subject Matter

Processing of Personal Data necessary to provide Conversations PRO and associated research services to the Client.

Nature and Purpose

• collection;
• receipt;
• storage;
• organisation;
• hosting;
• retrieval;
• consultation;
• survey distribution;
• research response collection;
• analysis;
• aggregation;
• reporting;
• AI-assisted analysis;
• transmission where authorised;
• deletion; and
• other processing required to provide the Services on the Client's documented instructions.

Duration

For the duration of the relevant Conversations PRO Services and any additional period required by the Client's documented instructions, agreed retention arrangements or applicable law.

Categories of Data Subjects

• customers;
• prospective customers;
• members;
• employees;
• stakeholders;
• partners;
• research participants;
• contacts supplied by the Client; and
• other individuals identified by the Client for legitimate research purposes.

Categories of Personal Data

• name;
• email address;
• telephone number;
• customer/member/reference identifiers;
• demographic information;
• employment information;
• membership information;
• survey responses;
• opinions;
• attitudes;
• behaviours;
• preferences;
• research responses;
• technical information associated with participation; and
• other information specified by the Client in the relevant research project.

Special Categories

Special Category Personal Data may be processed where required for legitimate research and where the Client has established the necessary lawful basis, Article 9 condition and safeguards. The specific categories will depend upon the research project.

Frequency

As required by the Client's use of Conversations PRO.

Schedule 2 - Technical and Organisational Measures

The following represents the intended security framework for Conversations PRO and must be confirmed against the production environment before this DPA is finalised.

1. Access Control

• authorised access only;
• individual user accounts;
• appropriate authentication controls;
• role-based or permission-based access where applicable;
• access revocation procedures.

2. Infrastructure Security

• core hosting within the European Union;
• appropriately secured production infrastructure;
• network and system security controls;
• security updates and patch management.

3. Encryption

• appropriate encryption for data transmitted over public networks;
• encryption of stored Personal Data where appropriate to the risk.

4. Availability and Resilience

• backup arrangements;
• service monitoring;
• recovery procedures;
• measures designed to maintain availability and integrity.

5. Personnel

• access limited according to business need;
• confidentiality obligations;
• appropriate security and data protection awareness.

6. Incident Management

• procedures for identifying and managing security incidents;
• escalation processes;
• investigation and mitigation;
• Client notification where required.

7. Data Management

• data minimisation;
• retention controls;
• secure deletion or anonymisation;
• appropriate separation of Client information.

8. Subprocessor Management

• due diligence where appropriate;
• contractual data protection requirements;
• monitoring of relevant processing arrangements.

9. AI Processing

• controlled use of approved AI providers;
• minimisation of Personal Data sent for AI analysis where reasonably practicable;
• appropriate contractual safeguards;
• review of international transfer arrangements where applicable.

Schedule 3 - Subprocessors

The final production Subprocessor register should identify at least:

Schedule 4 - International Transfers

Where Client Personal Data is transferred outside the EEA and no European Commission adequacy decision applies, the parties will ensure that an appropriate GDPR transfer mechanism is implemented.

Where required, this may include the applicable European Commission Standard Contractual Clauses together with any necessary supplementary measures.

Details of relevant transfers should be maintained within the Subprocessor register or associated data protection documentation.