Data Processing Agreement

• Applicable Data Protection Law — the EU GDPR, UK GDPR, Swiss FADP, Ukrainian Law on Personal Data Protection, CCPA/CPRA, and similar.
• Controller / Processor / Personal Data / Data Subject / Processing / Personal Data Breach — as defined in the GDPR.
• Customer Personal Data — Personal Data that PostBolt processes on behalf of the Customer.
• Sub-processor — any processor engaged by PostBolt to process Customer Personal Data.

The Customer is the Controller and PostBolt is the Processor of Customer Personal Data.

Subject matter, nature, and purpose

Provision of the PostBolt cross-platform social media publishing service: storing content, scheduling, publishing to third-party platforms on behalf of the Customer, and reporting on outcomes.

Categories of Data Subjects

End users of the Customer's social-media accounts; the Customer's team members; individuals who appear in or interact with content the Customer publishes.

Categories of Personal Data

Identification data, authentication tokens for connected platforms, content provided by the Customer, engagement metrics, IP addresses, and device data.

PostBolt will process Customer Personal Data only on documented instructions from the Customer, including those set out in the Terms, this DPA, and the configuration choices the Customer makes in the Service. PostBolt will inform the Customer if an instruction infringes Applicable Data Protection Law.

PostBolt ensures that personnel authorised to process Customer Personal Data are bound by confidentiality obligations and trained on data-protection requirements.

PostBolt implements the following technical and organisational measures:

• Encryption. TLS 1.2+ in transit; AES-256 at rest; encryption of OAuth tokens at the application layer.
• Access control. RBAC; least privilege; mandatory MFA; SSO with audit logs.
• Network security. Private networks; firewalls; segmentation of production from staging; DDoS mitigation.
• Application security. Code review, dependency scanning, automated testing, secret scanning in CI, security headers.
• Operational security. Centralised logging, alerting on anomalies, infrastructure as code, change management.
• Backups and recovery. Daily encrypted backups, restore testing, documented disaster-recovery procedures.
• Incident response. Documented plan; on-call rotation; 72-hour breach notification commitment.

The Customer authorises PostBolt to engage the following Sub-processors. We give at least 14 days' advance notice of changes.

Request the current list at any time by emailing support@postbolt.org.

PostBolt will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures in fulfilling the Customer's obligation to respond to Data Subject requests. If a Data Subject contacts PostBolt directly, we will forward the request to the Customer.

PostBolt will notify the Customer without undue delay and in any case within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably necessary to enable the Customer to meet its own notification obligations.

On termination or expiry of the Service, PostBolt will, at the Customer's choice, delete or return all Customer Personal Data within 30 days, except for backups, which are deleted on the standard backup-rotation schedule (up to 35 days), or where retention is required by law.

PostBolt will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits no more than once per year, subject to reasonable confidentiality and security restrictions.

Where PostBolt transfers Customer Personal Data outside the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module Two or Three, as applicable) apply, supplemented by the UK Addendum where relevant.

In the event of a conflict between this DPA and the Terms, this DPA prevails with respect to the processing of Customer Personal Data. Liability under this DPA is subject to the limitations set out in the Terms of Service.

DPA questions or requests? support@postbolt.org.