Data processing agreement

Press Hub is a controller and a processor at the same time, for different data.

It is the controller of the media corpus it assembles for its own purposes. It is much closer to a processor when a workspace sends a campaign. Getting that split right is the whole document, and it is not yet done.

Updated 31 August 2026

Draft status. A review draft: not indexed, and not final until checked by qualified counsel.

Where does the line fall?

Controller — the media corpus: which outlets and journalists are held, from which sources, and on what basis. No customer instructs any of that.
Processor, most likely — a workspace’s own content: its lists, pipeline notes, release copy, campaign text and the recipient log a send produces.
Unsettled — the send itself, where Press Hub supplies the audience from its own corpus and transmits on the customer’s behalf. Whether that makes the two joint controllers, independent controllers, or controller-and-processor is a legal analysis, not a product decision, and it has not been made.

Is a DPA available for acceptance?

Not yet. One party is settled — the processor would be Entro314 Labs SINGLE MEMBER P.C. (Entro314 Labs), Γ.Ε.ΜΗ. 193782603000 — but the role analysis above, the customer contracting model and a versioned acceptance mechanism are not. Presenting it as click-to-accept while the scope is undefined would create a contract nobody could perform.

What must the final DPA contain?

Subject matter, duration, nature and purpose of processing.
Data categories and groups of data subjects, separated by the split above.
Documented-instruction, confidentiality, security and assistance terms.
Deletion or return, audit, incident and rights-request procedures.
Verified subprocessors, authorisation model and international-transfer terms.
An explicit statement of what happens to suppression records on termination, since those are deliberately retained.

What applies in the meantime?

The terms of use, the privacy notice and the sending policy. A customer that needs a signed DPA before using the product should write to hello@pressdb.co rather than rely on this page.