At a glance
- This Data Processing Addendum ("DPA") applies when Postocial processes personal data on your behalf, such as your audience's comments and messages, your contacts, conversations, broadcasts and bookings, and the visitors to your bio pages.
- You're the controller of that data, and we're your processor.
- It's part of our Terms of Service for business customers. You accept it when you accept the terms, and you can ask us for a signed copy.
- It covers the processor terms of Article 28 of the GDPR and the UK GDPR, the Standard Contractual Clauses for international transfers, and the service provider terms of the CCPA.
Parties and scope
This DPA is between you, the customer named on the Postocial account ("you"), and Kokoriko SAS ("Postocial", "we", "us"). It applies to personal data we process on your behalf while providing the service ("customer personal data"), where any of these laws apply ("data protection laws"): the EU General Data Protection Regulation (GDPR); the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection; and the California Consumer Privacy Act (CCPA) and other US state privacy laws.
Words such as "controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR. Words defined in our Terms of Service have the same meaning here.
Roles
- You're the controller of customer personal data. If you process it for your own clients, for example as an agency, you're a processor and we're your sub-processor. You confirm that your clients have authorized you to use us.
- We're the processor of customer personal data.
- We're a separate controller of the data we use to run our business with you, such as your users' account details, billing records, support messages and security logs. Our Privacy Policy covers that data.
Your instructions and responsibilities
- Your instructions are this DPA, our Terms of Service, the settings you choose and the actions you take in the service (such as connecting accounts, scheduling posts, sending messages, building automations, sending broadcasts, setting up AI replies and turning on integrations), and any other written instructions we agree to. We'll tell you if we believe an instruction breaks data protection laws.
- When you connect a third-party service, such as a social network, a messaging provider, a payment provider, an AI provider on your own key or another integration, you instruct us to send it the data it needs. That service acts under its own terms and isn't our sub-processor.
- As the controller, you decide whether the processing is lawful, tell people what you do with their data and collect any consent the law asks for, for example before you send marketing messages or add tracking pixels to a bio page.
- Don't use the service to process special categories of personal data, such as health data, unless you have a lawful basis to do so.
Our obligations
Processing on instructions
We process customer personal data only on your documented instructions, including for international transfers, unless the law requires otherwise. In that case, we'll tell you before we process it, unless the law forbids us to.
Confidentiality
Everyone we authorize to process customer personal data is bound by a duty of confidentiality.
Security
We take appropriate technical and organizational measures to protect customer personal data, as Article 32 of the GDPR requires. Annex 2 describes them.
Help with your obligations
- We help you respond to requests from data subjects, mainly through the features of the service, such as editing and deleting content, exporting, erasing or unsubscribing contacts, and disconnecting accounts, and otherwise by email.
- If a data subject contacts us directly about customer personal data, we pass the request on to you without undue delay, and we don't answer it ourselves unless you ask us to.
- Taking into account the nature of the processing and the information available to us, we help you with security, breach notifications, data protection impact assessments and consultations with authorities.
Deletion and return
Before your account closes, you can retrieve customer personal data through the app and the API. After the service ends, we delete customer personal data, unless the law requires us to keep it. Copies in backups are deleted as the backups are overwritten in the normal cycle. On request, we confirm deletion in writing.
Information and audits
We make available the information you need to show that we meet this DPA, including this document, the security measures in Annex 2, our sub-processor list and any audit reports our providers share with us. If that isn't enough, you may audit our compliance once a year, or more often when an authority requires it or after a personal data breach. You must give us at least 30 days' notice, and the audit must take place during business hours, at your cost, under confidentiality and without disrupting the service or other customers. Audits of our sub-processors follow their own audit terms.
Sub-processors
- You give us general authorization to use sub-processors. Our current sub-processors are listed on our Sub-processors page, which forms Annex 3. The company that provides and operates the application platform Postocial runs on is listed there as our main sub-processor. The application is hosted by Hetzner Online GmbH in Germany.
- We bind each sub-processor by a written agreement to data protection obligations at least as protective as this DPA.
- We give at least 30 days' notice before we add or replace a sub-processor, as the Sub-processors page describes. You may object on reasonable data protection grounds during that period. If we can't resolve your objection, you may end the affected service before the change takes effect.
- We remain responsible to you for how our sub-processors meet their obligations.
Personal data breaches
We notify you without undue delay after we become aware of a personal data breach affecting customer personal data. As information becomes available, we tell you what happened, the categories and approximate number of people and records concerned, the likely consequences, and the steps we've taken or propose to take. We take reasonable steps to contain the breach and limit its effects. Notifying you isn't an admission of fault.
International transfers
- The Postocial application is hosted in Germany. Some sub-processors are based in, or process data in, other countries, including the United States, as Annex 3 shows.
- EU transfers. Where customer personal data is transferred from the EEA to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply: Module Two where you're a controller and Module Three where you're a processor. Clause 7 (docking clause) applies. Under Clause 9, Option 2 (general written authorization) applies, with the notice period in this DPA. The optional wording in Clause 11 doesn't apply. For Clauses 17 and 18, the clauses are governed by French law where it's the law of an EU member state, and otherwise by the law of Ireland, with disputes resolved by the courts of that country. Annexes I, II and III of the clauses are completed by Annexes 1, 2 and 3 of this DPA.
- UK transfers. For transfers from the UK, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner, applies and is completed with the details in this DPA.
- Swiss transfers. For transfers from Switzerland, the Standard Contractual Clauses apply with the changes Swiss law requires: the Swiss Federal Data Protection and Information Commissioner is the competent authority, and references to the GDPR include the Swiss Federal Act on Data Protection.
- Onward transfers. When we transfer customer personal data to a sub-processor outside the EEA, the UK or Switzerland, we put the Standard Contractual Clauses or another lawful safeguard in place, such as an adequacy decision or the provider's certification under the EU-U.S. Data Privacy Framework.
US state privacy laws
Where the CCPA or another US state privacy law applies, we act as your service provider or processor, and we:
- don't sell or share customer personal data, as those laws define selling and sharing;
- don't keep, use or disclose it for any purpose other than the business purposes in Annex 1, or outside our direct business relationship with you;
- don't combine it with personal data we get from other sources, except as those laws allow;
- comply with those laws and give customer personal data the level of protection they require;
- help you respond to consumer requests;
- tell you if we can no longer meet our obligations under those laws.
You may take reasonable steps to make sure we use customer personal data in line with these laws, and to stop and fix any use that isn't. We certify that we understand these restrictions and will comply with them.
Platform data commitments
- Meta. We keep each customer's data from Meta separate, process it only on your instructions, and delete it when you ask, when you disconnect the account or close your Postocial account, or when Meta requires it. We don't use it for any purpose the Meta Platform Terms forbid.
- Google and YouTube. We use data from Google APIs only to provide user-facing features, in line with the Google API Services User Data Policy, including its Limited Use requirements, and with the YouTube API Services policies, including their rules on refreshing and deleting data.
- TikTok. We don't use data from TikTok to build profiles or databases about TikTok users.
- WhatsApp. We use WhatsApp messages and contact details only to provide the conversations, automations and broadcasts your workspace sets up with that contact, and we follow the WhatsApp Business Terms for that data.
Liability and precedence
- Each party's liability under this DPA is subject to the limits in our Terms of Service, except where data protection laws or the Standard Contractual Clauses don't allow those limits.
- If documents conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of Service on matters of data protection.
Term
This DPA applies for as long as we process customer personal data for you, and ends when that data has been deleted.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing the Postocial service under our Terms of Service. |
| Duration | For the term of your subscription, and until customer personal data is deleted as this DPA describes. |
| Nature of processing | Collecting, storing, organizing, retrieving, analyzing, transmitting (including publishing to the networks you choose and sending the automated messages and broadcasts you set up), generating content with AI on request, sending the data an AI reply needs to the AI provider you connect, and deleting. |
| Purpose | To provide scheduling and publishing, the unified inbox and messaging channels, chatbots and automations, broadcasts, contacts and pipeline, bookings, payment links and store sync, analytics, link-in-bio pages, short links, QR codes and forms, AI features, the API, webhooks and the MCP server, as you instruct. |
| Data subjects | Your authorized users, such as team members and invited clients; people who interact with your social accounts, such as commenters, people who send direct messages and reviewers; your contacts on WhatsApp, Telegram, SMS and live chat, including visitors who chat with you on your website; people who book meetings with you; store customers whose orders you sync; visitors to your bio pages, short links and QR codes, and people who fill in your forms; and people who appear in content you upload. |
| Types of personal data | Names, usernames, profile images and identifiers; contact details such as email addresses and phone numbers; the content of posts, comments, messages, reviews, form submissions and answers given in chats; images, videos, voice notes and files; tags, custom fields, pipeline stages, and consent and opt-out status; booking details; order and payment status synced from your own store or payment provider, never full card numbers; ad referral data Meta passes with a conversation, such as the ad ID, headline and click ID; engagement and analytics data; technical data about bio-page visitors, such as device type and referrer; and internal notes. |
| Special categories | Not intended. They may appear in messages or content you receive or upload. |
| Frequency | Continuous, while you use the service. |
| Retention | As you decide in the service, and until deletion after the service ends. Archived conversations are deleted automatically 30 days after they're archived, and deleted contacts can be restored for 30 days before they're erased. |
Annex 2: Security measures
- Encryption in transit: connections to the app use HTTPS.
- Access control: roles in each workspace (admin, member and viewer), custom team roles that can limit people to some messaging channels, two-factor authentication, client invite links that expire and can be protected with a password, and API keys with fine-grained permissions.
- Audit log: an append-only record of admin and destructive actions in each workspace, with who acted and from which IP address.
- Separation: each workspace's data is kept separate from other workspaces.
- Staff access: [To be confirmed with the platform provider]
- Availability: [Backup and monitoring commitments, to be confirmed]
- Hosting: application servers in Germany.
- Integrations: signed webhooks, and a rate limit of 60 requests per minute per API key.
- Incidents: breach handling and notification as described in Personal data breaches.
We can share more detail about these measures on request.
Annex 3: Sub-processors
Our current sub-processors, what they do and where they process data are listed on our Sub-processors page.
Contact and signed copies
To request a countersigned copy of this DPA, or to ask about it, email hello@postocial.com. Notices under this DPA can also be sent by mail to Kokoriko SAS, 6 rue d'Armaille, 75017 Paris, France.