Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between [COMPANY LEGAL NAME], [REGISTERED ADDRESS] ("Processor") and the customer that owns a Postreo workspace ("Controller") for the Postreo service (the "Agreement").

It applies where the Processor processes personal data on behalf of the Controller in providing the service, and to the extent the EU GDPR, the UK GDPR or other applicable data protection law ("Data Protection Law") applies. If this DPA conflicts with the Agreement, this DPA prevails as to the processing of personal data.

• Subject matter and duration: provision of the service for the term of the Agreement, plus the deletion period in section 10.
• Nature and purpose: storing, scheduling and publishing social media content; managing connected social accounts; collaboration within the workspace; AI-assisted drafting and media generation where the Controller has AI enabled; analytics about published content.
• Categories of data subjects: the Controller's workspace members; individuals who appear in or interact with the Controller's content.
• Categories of personal data: names, email addresses, profile identifiers, content (text, images, video), social account identifiers and access tokens, usage and log data.
• Special categories: none. The Controller must not submit health data, protected health information or other special-category data (see section 4).

The Processor processes personal data only on the Controller's documented instructions — the Agreement, this DPA, and the Controller's use and configuration of the service — unless required otherwise by law, in which case it will inform the Controller first unless the law prohibits it. The Processor will tell the Controller if, in its opinion, an instruction infringes Data Protection Law.

The Controller is responsible for having a lawful basis for the personal data it submits, for the content it publishes, and for not submitting special categories of personal data or protected health information. The Controller can turn off AI features for its workspace, in which case no workspace content is sent to AI providers.

The Processor ensures that personnel authorised to process personal data are bound by confidentiality obligations and access it only as needed to provide and support the service.

The Processor implements appropriate technical and organisational measures, including:

• Encryption in transit (TLS) and encryption at rest of social access tokens, API keys and two-factor secrets with AES-256-GCM; passwords hashed with scrypt.
• Role-based access control within workspaces; two-factor authentication available to all users and required for platform staff.
• Audit logging of security-relevant actions, with tamper-resistant (append-only) storage.
• Rate limiting and brute-force protection on authentication.
• Automated data retention and deletion schedules.
• Payment card data handled exclusively by the payment processor's hosted pages.
• [ADDITIONAL MEASURES — e.g. backups, vulnerability management, access reviews]

The Controller gives general authorisation for the Processor to engage the sub-processors listed at /subprocessors. The Processor will notify the Controller of any intended addition or replacement at least [NOTICE PERIOD] days in advance; the Controller may object on reasonable data protection grounds, and if the parties cannot resolve the objection the Controller may terminate the affected service.

The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains liable for their performance.

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical measures — including in-product export and deletion — in responding to requests to exercise data subject rights. If the Processor receives a request directly, it will forward it to the Controller without undue delay and will not respond except on the Controller's instructions.

The Processor notifies the Controller without undue delay, and in any case within [BREACH NOTICE HOURS] hours, after becoming aware of a personal data breach affecting the Controller's personal data, with the information reasonably available to help the Controller meet its obligations under Articles 33 and 34. The Processor also assists with data protection impact assessments and prior consultations where required.

The Controller can export its data at any time. On termination of the Agreement, or when the Controller deletes its workspace, the Processor deletes the personal data within 30 days (including stored media), except where law requires retention, and backups expire within [BACKUP RETENTION PERIOD].

The Processor makes available the information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, by the Controller or an auditor it mandates, on reasonable notice, no more than once a year unless required by a supervisory authority or following a breach, and subject to confidentiality.

Where processing involves a transfer of personal data to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module Two: controller to processor, and Module Three where applicable) and the UK International Data Transfer Addendum are incorporated by reference, with [GOVERNING LAW / SUPERVISORY AUTHORITY] as the relevant law and authority.

This DPA is governed by the law that governs the Agreement. Liability under this DPA is subject to the limitations in the Agreement except where Data Protection Law does not permit it.

To execute this DPA, contact [PRIVACY CONTACT EMAIL]. Signed for the Processor: [NAME, TITLE, DATE]. Signed for the Controller: [NAME, TITLE, DATE].