Do you offer a Data Processing Agreement?

Yes. A DPA is available on request and included automatically in enterprise and agency agreements. Email support@presscosmos.com for a countersigned copy.

Where is my data stored?

Account data is stored in the United States by default, with an EU-only option for account data and release drafts. Distributed releases are published globally by design.

GDPR and Data Processing

1. Who is the controller

For account and billing data, PressCosmos Media Network is the controller. For release content and any personal data you include in it, you are the controller and PressCosmos acts as your processor. That distinction is what the Data Processing Agreement (DPA) formalises.

2. The Data Processing Agreement

A DPA is available on request and is incorporated into enterprise and agency agreements automatically. It covers subject matter, duration, nature and purpose of processing, categories of data and data subjects, our obligations, and audit rights. Email support@presscosmos.com for a countersigned copy.

3. Subprocessors

The current list, with purpose and location, is maintained on request and updated 30 days before any change is effective, giving you a right to object.

Cloud hosting and CDN — United States and European Union
Payment processing — United States
Transactional email delivery — United States and European Union
Analytics — first-party, European Union
Answer-engine measurement — queries public AI systems only

4. Data residency

EU customers can select EU-only storage for account data and release drafts. Published releases are, by nature, globally distributed — that is the purpose of the service, and it is the customer's decision to publish.

5. DPIAs and consultations

We support your Data Protection Impact Assessment with technical and organisational measures documentation, a description of the processing, and reasonable assistance with supervisory authority consultations at our standard professional rates.

6. Data subject requests

If you receive a request relating to data you hold in PressCosmos, forward it and we will respond within five business days with the information needed to fulfil it. Our own subject request process is described in the privacy policy.

7. Breach notification

We notify affected controllers without undue delay and within 72 hours of becoming aware of a personal data breach, with the information required by Article 33(3).