Data processing agreement

Draft — to be reviewed by a lawyer before launch. Effective 1 December 2026.

1. Parties and roles. The customer (controller) and Example Company Ltd, 1 Sample Street, 10115 Berlin, Germany (processor).
2. Subject and duration. Providing Postastory for the length of the subscription plus the 60-day retention.
3. Nature and purpose. Storing brand information, generating content with AI, scheduling and publishing it.
4. Data. Whatever personal data customers put in brand profiles, posts and images; team members’ names and emails. Data subjects: customer staff, and people mentioned in customer content.
5. Processor duties. Process only on documented instructions; confidentiality; security measures (annex); help with data-subject requests and breaches; breach notice within 48 hours; delete or return data at the end.
6. Sub-processors. The list in the privacy policy; 30 days’ notice of changes with the right to object.
7. International transfers. Based on the EU Standard Contractual Clauses and, where it applies, the EU–US Data Privacy Framework.
8. Audits. Information on request, and an audit once a year at the customer’s cost with 30 days’ notice.