Data Processing Agreement

This Data Processing Agreement ("DPA") is between you, the customer ("you", the controller), and Taras Shynkarenko, operating as AdaptlyPost, NIP PL 9571091905, Heweliusza 11/811, 80-890 Gdańsk, Poland ("AdaptlyPost", the processor).

It applies when you process personal data through AdaptlyPost (the "Service"), for example data about your clients, team members or audience. It is incorporated by reference into our Terms of Service, and you accept it by using the Service. No signature is needed. If you want a countersigned copy, email contact@adaptlypost.com.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR (Regulation (EU) 2016/679).

"Customer Personal Data" means personal data that AdaptlyPost processes on your behalf when it provides the Service. "Sub-processor" means a third party that AdaptlyPost engages to process Customer Personal Data.

2. Roles

You are the controller of Customer Personal Data and AdaptlyPost is your processor. If you act as a processor for someone else, AdaptlyPost is your sub-processor, and you confirm that your controller has authorized this.

AdaptlyPost is a separate controller for the data it processes for its own purposes, such as your account, billing, security and its website. Our Privacy Policy covers that processing, not this DPA.

3. Subject matter, duration, nature and purpose

• •

  Subject matter: providing the Service under the Terms.

• •

  Duration: for as long as you use the Service, and until the data is deleted or returned under section 13.

• •

  Nature: storing, organizing, transforming, transmitting and deleting data. This includes publishing content to the social networks you connect, generating the AI content you ask for, collecting analytics and sending notifications.

• •

  Purpose: to provide, operate and support the Service as described in the Terms and your instructions. AdaptlyPost does not use Customer Personal Data to train or fine-tune AI models.

4. Types of personal data and data subjects

Depending on how you use the Service, Customer Personal Data can include:

• •

  Your team members and invited users: names, email addresses and roles

• •

  Connected social accounts: account IDs, names, handles, profile pictures and access tokens

• •

  Content: posts, captions, comments, images, videos and documents you create, upload or schedule, and any personal data in them

• •

  Analytics: engagement and audience statistics returned by the social networks

• •

  AI inputs and outputs: prompts, text and images you send to AI features, and the results

• •

  Technical data: IP addresses, device data and logs

Data subjects are your team members and other users you invite, the owners of the accounts you connect, and people who appear in or interact with your content, such as your clients, followers and audience.

The Service is not designed for special categories of personal data (Article 9 GDPR) or data about criminal convictions. Do not upload such data unless you have a legal basis for it.

5. Your instructions and responsibilities

AdaptlyPost processes Customer Personal Data only on your documented instructions, including about transfers outside the European Economic Area (EEA), unless EU or Polish law requires otherwise. In that case AdaptlyPost tells you about that legal requirement before processing, unless the law forbids this on important grounds of public interest.

Your instructions are the Terms, this DPA, and the way you configure and use the Service. AdaptlyPost tells you right away if it believes an instruction infringes the GDPR or other EU or member state data protection law.

You are responsible for having a legal basis for the processing, for the accuracy of the data, and for giving data subjects the information they are entitled to.

6. AdaptlyPost's obligations

As required by Article 28(3) GDPR, AdaptlyPost:

• •

  (a) processes Customer Personal Data only on your documented instructions, as described in section 5;

• •

  (b) makes sure that everyone authorized to process Customer Personal Data has committed to confidentiality or is under a legal duty of confidentiality (section 7);

• •

  (c) takes the security measures required by Article 32 GDPR (section 8);

• •

  (d) engages sub-processors only under the conditions in section 9;

• •

  (e) helps you, through appropriate technical and organizational measures, to respond to requests from data subjects who exercise their rights (section 11);

• •

  (f) helps you meet your obligations under Articles 32 to 36 GDPR on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to it (sections 8, 11 and 12);

• •

  (g) at the end of the Service, deletes or returns Customer Personal Data at your choice, unless EU or Polish law requires it to be stored (section 13);

• •

  (h) makes available all information needed to show compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections (section 14).

7. Confidentiality

AdaptlyPost gives access to Customer Personal Data only to people who need it to provide, maintain or support the Service. Each of them is bound by a duty of confidentiality that continues after their work for AdaptlyPost ends.

8. Security measures

AdaptlyPost takes appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to data subjects. They include:

• •

  Hosting in the EU: application servers and the database run on Hetzner in Helsinki, Finland. Database backups are stored with Hetzner in Falkenstein, Germany. Media files are stored in Cloudflare R2 in the EU.

• •

  Encryption in transit: all connections to the Service use TLS.

• •

  Encrypted credentials: OAuth access and refresh tokens of connected social accounts are encrypted with AES-256.

• •

  Access control: access to production systems is limited to the people who need it, and workspace roles and permissions control what each member of your team can see and do.

• •

  Two-factor sign-in: every user can turn on two-factor authentication with an authenticator app, text message or email codes. Changing a factor or deleting the account then needs a code.

• •

  Backups: hourly database backups, kept for 3 days, then one backup per day for up to 14 days, with point-in-time restore.

• •

  Logging and monitoring: application logs and traces to detect errors, abuse and security incidents, kept for up to 90 days.

AdaptlyPost may update these measures over time, as long as the overall level of protection does not go down.

9. Sub-processors

You give AdaptlyPost general authorization to engage sub-processors. The current list is on our Sub-processors page.

AdaptlyPost informs you of any intended addition or replacement of a sub-processor by updating that page at least 30 days before the new sub-processor starts processing Customer Personal Data. To get these notices by email, write to contact@adaptlypost.com.

You may object to a new sub-processor on reasonable data protection grounds by emailing contact@adaptlypost.com within that 30-day period. AdaptlyPost will then work with you in good faith to find a solution. If none is found, you may stop using the Service before the new sub-processor starts processing your data.

AdaptlyPost imposes on each sub-processor, by contract, data protection obligations that give the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organizational measures. AdaptlyPost remains fully liable to you for the performance of each sub-processor's obligations.

10. International transfers

AdaptlyPost hosts the Service in the EU. Some sub-processors process data outside the EEA, as shown on the Sub-processors page.

AdaptlyPost transfers Customer Personal Data outside the EEA only with a valid safeguard under Chapter V GDPR: an adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified under it, or otherwise the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, using Module 2 (controller to processor) or Module 3 (processor to processor), whichever fits the roles of the parties.

11. Help with data subject requests and assessments

Taking into account the nature of the processing, AdaptlyPost helps you respond to requests from data subjects, such as requests for access, correction, deletion, restriction, portability or objection. You can handle many requests yourself in the Service: you can edit and delete posts, workspaces and connected accounts, export analytics as CSV, XLSX or PDF, and read posts and drafts through the REST API. For anything else, email contact@adaptlypost.com.

If AdaptlyPost receives a request about Customer Personal Data directly from a data subject, it forwards the request to you and does not answer it on its own, unless you tell it to or the law requires it.

AdaptlyPost also gives you the information you reasonably need to carry out a data protection impact assessment, or a prior consultation with a supervisory authority, where the law requires one.

12. Personal data breaches

AdaptlyPost notifies you of a personal data breach affecting Customer Personal Data without undue delay, and in any case within 48 hours of becoming aware of it. It sends the notice to the email address of your account owner.

The notice describes, as far as the information is available: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to deal with the breach and limit its effects; and a contact point for more information. Where not all of this is known at once, AdaptlyPost provides it in phases without further undue delay.

AdaptlyPost helps you meet your own obligations to notify the supervisory authority and data subjects. A notice is not an admission of fault or liability.

13. Deletion and return of data

At the end of the Service you choose whether AdaptlyPost deletes or returns Customer Personal Data. You can export your data yourself first (section 11), or ask for a return or a full export by emailing contact@adaptlypost.com. AdaptlyPost answers such requests within 30 days.

You can delete your account in Settings. If you own an organization that has other members, transfer ownership or remove them first. Deleting your account deletes all of your AI history and the organizations where you are the only member, with their workspaces, connected accounts and posts, and cancels an active subscription. Deletion takes effect immediately. You can also ask us to delete your data by emailing contact@adaptlypost.com, and we delete it within 30 days.

Deleted data leaves our backups within 21 days. Until then, backups stay protected under this DPA and are not used for any other purpose. AdaptlyPost keeps Customer Personal Data longer only where EU or Polish law requires it, and only for that purpose.

14. Audits

AdaptlyPost makes available to you all information needed to show compliance with Article 28 GDPR. On request, it first answers written questions and provides documentation, such as this DPA, the sub-processor list and a description of its security measures.

If that information is not enough to show compliance, or a supervisory authority requires it, you may audit AdaptlyPost, including by an on-site inspection, yourself or through an independent auditor bound by confidentiality. You must give reasonable advance written notice, carry out the audit during normal business hours without unreasonable disruption, and bear its costs.

15. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. This does not limit either party's liability to data subjects under Article 82 GDPR, or any liability that cannot be limited by law.

16. Term, precedence and changes

This DPA applies for as long as AdaptlyPost processes Customer Personal Data for you. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

AdaptlyPost may update this DPA to reflect changes in the law or in the Service. It posts the new version on this page and updates the date above. An update will not lower the protection of Customer Personal Data.

17. Governing law

This DPA is governed by Polish law. The courts of Gdańsk, Poland have jurisdiction, as set out in the Terms. This does not affect the rights of data subjects or the powers of supervisory authorities.

18. Contact

For anything about this DPA, including a countersigned copy, email contact@adaptlypost.com.

Taras Shynkarenko (operating as AdaptlyPost), NIP PL 9571091905, Heweliusza 11/811, 80-890 Gdańsk, Poland.