Data Processing Agreement
The Article 28 agreement covering the personal data Encore processes on a publisher's instructions, including the Standard Contractual Clauses and the UK Addendum for transfers to the United States.
Version 1.0 · Effective 20 August 2026
This applies to every publisher
The DPA is incorporated into the Encore terms of service and applies automatically. It does not need to be requested, and there is no separate tier of customer who does or does not get one.
Article 28(3) requires a contract wherever a processor handles personal data on a controller's behalf. Whether a given publisher has users in the EU, EEA or UK is not something either party reliably knows in advance, so applying it to everyone is the only version that is not missing where it matters. Publishers who need a countersigned copy can request one.
The complete executable text, including the Standard Contractual Clauses, the UK Addendum and all exhibits.
Why the full text is a document rather than a page
The agreement carries the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. The wording of those instruments is prescribed by law and cannot be paraphrased or restructured without changing what they mean. Retyping them into a web page would introduce a risk with no corresponding benefit, so the authoritative copy is the document, and this page states what it covers.
The Joint Controller Arrangement is different: it is Encore's own drafting rather than a prescribed form, and Article 26(2) requires its essence to be available to data subjects. That one is published in full.
What it covers
Encore’s role
Processor, acting on the Publisher's documented instructions, for entitlement delivery — granting a reward back into the Publisher's application. This arises in the churn-intervention use case and is not part of every integration.
What it does not cover
Offer serving, where Encore is a joint controller rather than a processor. That is governed by the Joint Controller Arrangement.
Transfers
Personal data is processed in the United States. The agreement incorporates the European Commission's Standard Contractual Clauses (Modules 1, 2 and 3), the UK International Data Transfer Addendum, and a Swiss FADP annex.
Retention
Application data for the life of the account plus 30 days, enforced by a scheduled job. Analytics records under a 25-month expiry. Database backups are deleted after 30 days, which is the binding constraint on how quickly an erasure becomes complete everywhere. The credential audit log is retained for 400 days.
Credentials
Stored platform credentials — Google Play service account JSON and Apple App Store Connect.p8 keys — are encrypted at rest with AES-256-GCM under domain-separated master keys, and are reached only through a single audited chokepoint that records every decryption.
Subprocessors
Listed and kept current on the subprocessors page, with notice of changes.
Special category data
Customers are prohibited from sending it. Encore solicits no health, biometric, political, religious or sexual-orientation data, and no field in its contract asks for any.
Where this summary and the agreement differ, the agreement governs.
The two instruments together
Encore's relationship with a publisher has two halves, and they need different instruments because the roles genuinely differ.
This agreement · Article 28
Encore as processor
Delivering the entitlement a user earned, on the publisher's instruction, to fulfil the publisher's own promise.
Separate · Article 26
Joint controllers
Choosing and serving the offer. Encore determines the catalogue, the eligibility rules and the ranking, so it is not acting solely on instructions.
Questions and requests
Write to admin@encorekit.com for a countersigned copy, a data subject request, or anything else under this agreement. Publishers setting up for the first time should start with the publisher guide.