Data Processing Addendum

Effective [Effective date to be completed]

This addendum is part of the Terms of Service for business customers. It applies when we process personal data on your behalf and the GDPR or a similar law applies. If the two conflict on the handling of personal data, this addendum wins.

1. Parties

The customer is the business or organization that has an account with PostDelegate ("Controller", "you"). The provider is Nasida Apps LLC, a limited liability company organized in Wyoming, USA, [Registered business address to be completed] ("Processor", "we"). Contact: [email protected].

2. Subject matter and duration

We process personal data to provide PostDelegate to you, as described in the Terms. This addendum lasts as long as you have an account, and for any period after that in which we still hold your data (see section 9).

3. Nature and purpose of processing

We store, transmit and display personal data so you can connect social accounts, draft, schedule and publish posts, read and reply to comments and messages, collaborate with your team and clients, and view analytics and reports. If you use AI features, we send the text you provide to the AI provider you or we use for that feature. We process data only to deliver the service and on your documented instructions: your use of the service, its settings and your written requests.

4. Categories of data and data subjects

• Data subjects: your team members, your clients and their portal users, and people who comment on, message or are mentioned in your connected social accounts.
• Data categories: names, email addresses and account identifiers; profile data and tokens for connected social accounts; post content and media; comments and direct messages; analytics data; usage and log data such as IP address.
• We do not ask you to send special categories of data. Your content may contain them. You are responsible for having a lawful basis for that.

5. Our obligations

We will:

• process personal data only on your documented instructions, unless law requires otherwise (we will tell you first, where allowed);
• make sure everyone who can access the data is bound by confidentiality;
• apply the security measures in section 8;
• help you respond to requests from data subjects, and tell you if one reaches us directly;
• help you with security, breach notification, impact assessments and consultation with authorities, taking into account the information we have;
• tell you if we think an instruction breaks data protection law.

You are responsible for the lawfulness of your instructions and content, and for the permissions you have from the people whose data you load into the service.

6. Subprocessors

You agree that we may use the providers on our Subprocessors page. We will update that page before adding or replacing one. If you object on reasonable data protection grounds, email us within 30 days of the update and we will work with you on an alternative. If we cannot find one, you may end the affected service and we will refund the unused part of any prepaid fees. We stay responsible for our subprocessors and bind them to terms no less protective than these.

7. International transfers

We may transfer personal data to countries outside the European Economic Area, the United Kingdom or Switzerland, including the United States. Where we do, and no adequacy decision applies, the Standard Contractual Clauses approved by the European Commission (Module Two, controller to processor) are incorporated by reference, and so is the UK Addendum where the UK GDPR applies. The details they require are as follows: the parties are those in section 1; the data, subjects and purposes are in sections 3 and 4; the competent supervisory authority is the one for your establishment; the governing law is that of Ireland; and the security measures are in section 8. Our own subprocessors are bound by equivalent terms.

8. Security measures

We keep appropriate technical and organizational measures, described in plain terms on our Security page. They include encryption in transit, encryption of connected-account tokens at rest, hashed passwords, optional two-factor authentication, scoped access tokens, rate limits, and an activity trail for AI agents. We may improve them, but will not materially reduce them.

9. Personal data breaches

We will tell you without undue delay after we become aware of a personal data breach affecting your data. Our target is within 72 hours. The notice will say what we know about the nature of the breach, the data and people affected, likely consequences and what we are doing about it. We will add detail as we learn it.

10. Deletion and return

You can export and delete your data in the service at any time, and delete your account as described on the Data deletion page. When your account ends we delete your personal data as described there, unless law requires us to keep it. Backups roll off on their normal cycle. Ask us by email if you need a copy of your data in another form before it is deleted.

11. Audits

We will give you the information needed to show we follow this addendum. You may audit us, or have a mutually agreed independent auditor do so, once a year, or after a breach, with 30 days' notice, during business hours, and without access to other customers' data. You pay the costs of the audit. We may meet the request first with written answers and relevant documentation.

12. Liability

Each party's liability under this addendum is subject to the limits in the Terms of Service. Nothing here limits liability that cannot be limited by law, or the rights of data subjects under the Standard Contractual Clauses.

13. Changes and contact

We may update this addendum, with notice, to follow changes in law or the service. Questions about it: [email protected].