Data Processing Addendum

"GDPR" means Regulation (EU) 2016/679. "Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meaning given in the GDPR. "US State Privacy Laws" means the California Consumer Privacy Act as amended by the CPRA ("CCPA") and the comparable laws of other US states. "Customer Personal Data" means the personal data described in Annex I that Ampost processes on Customer's behalf. "Standard Contractual Clauses" or "SCCs" means the clauses adopted by Commission Implementing Decision (EU) 2021/914.

Customer is the controller of Customer Personal Data, or a processor acting for its own clients, in which case Ampost is its subprocessor. Ampost is Customer's processor and, under US State Privacy Laws, its service provider or processor.

Ampost is an independent controller of the data it needs to run Customer's account: account and sign-in data, billing records, security and abuse-prevention data, and website analytics. The Privacy Policy covers that processing, not this DPA. Payments are not Customer Personal Data either: paid plans are sold through Link, and Stripe processes payment data as merchant of record and its own controller.

Customer is responsible for having a lawful basis for the processing, for the information it gives to data subjects, and for the content it publishes. Customer will not send special categories of personal data (Art. 9 GDPR) or data about criminal convictions through the Service unless it has a legal basis for doing so and the content is meant to be published.

Ampost will:

• process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA, and what Customer does in the dashboard, the API, MCP and webhooks, unless EU or Polish law requires otherwise (in which case Ampost informs Customer first, unless that law forbids it);
• tell Customer without delay if it believes an instruction infringes data protection law;
• make sure everyone authorized to process Customer Personal Data is bound by confidentiality;
• take the technical and organizational measures in Annex II (Art. 32 GDPR);
• help Customer, taking into account the nature of the processing, to answer data subjects' requests, mainly through the Service's own features (editing and deleting posts, disconnecting accounts, export, account deletion), and pass on to Customer any request it receives directly about Customer Personal Data;
• help Customer with security, breach notification, data protection impact assessments and prior consultation (Art. 32 to 36 GDPR) with the information available to Ampost;
• not use Customer Personal Data for its own purposes, to train AI models, for advertising, or to build profiles.

Customer gives Ampost general authorization to use subprocessors. The current ones are listed in Annex III and on the public subprocessor list. Ampost imposes on each subprocessor, by written contract, data protection obligations at least as protective as this DPA, and remains liable to Customer for their performance.

Ampost announces a new or replaced subprocessor at least 30 days before it processes Customer Personal Data, on the subprocessor list and by email to customers who ask for notice at privacy@ampost.io. Customer may object on reasonable data protection grounds within that period. If the parties can't resolve the objection, Customer may end the affected subscription before the change takes effect and get a pro-rata refund of prepaid fees for the remaining period.

Ampost stores Customer Personal Data in the EU (Frankfurt). A subprocessor may access or process it outside the EEA only under an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or the SCCs (Module 3, processor to processor) in that subprocessor's data processing agreement, with supplementary measures where needed.

Where Customer is outside the EEA and receives Customer Personal Data from Ampost, Module 4 of the SCCs (processor to controller) is incorporated by reference, with these choices: clause 17 and clause 18, Polish law and the courts of Poland. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies; for transfers subject to the Swiss FADP, the SCCs apply with the FDPIC as the competent authority.

Ampost notifies Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, by email to the account's email address. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. Ampost adds information as it becomes available, takes reasonable steps to contain the breach, and helps Customer meet its own notification duties (Art. 33 and 34 GDPR). A notice is not an admission of fault.

Customer can export its posts and data through the API and the dashboard at any time, and ask for a copy at privacy@ampost.io. When Customer deletes its account, or the Terms end, Ampost deletes Customer Personal Data as described in the Privacy Policy ("Data Retention"): immediately from the live database and media storage, and from backups within their rotation period (at most 60 days), unless EU or Polish law requires Ampost to keep it. Posts already published on social platforms stay there until Customer deletes them on the platform.

Ampost makes available the information needed to show compliance with Art. 28 GDPR. Audits take place by information: Ampost answers Customer's written security and privacy questionnaire once a year free of charge, and after a personal data breach that affects Customer. An on-site audit, or one by an independent auditor bound by confidentiality, is possible where a supervisory authority requires it or the questionnaire is not enough to show compliance, with at least 30 days' notice, during business hours, at Customer's cost, and without access to other customers' data.

Where US State Privacy Laws apply, Ampost processes Customer Personal Data as a service provider or processor for the business purpose of providing the Service, and will not:

• sell or share Customer Personal Data (including for cross-context behavioral advertising);
• retain, use or disclose it for any purpose other than the business purposes in the Terms and this DPA, or outside the direct business relationship with Customer;
• combine it with personal data from other sources, except as those laws allow.

Ampost provides the same level of privacy protection the laws require, tells Customer if it can no longer meet these obligations, and lets Customer take reasonable steps to stop and remediate unauthorized use. Ampost certifies that it understands and will comply with these restrictions.

Each party's liability under this DPA is subject to the limits in the Terms, except where the law, or the SCCs towards data subjects, do not allow them. This DPA applies for as long as Ampost processes Customer Personal Data.

• Controller (data exporter): Customer, as identified by its Ampost account. Contact: the account's email address.
• Processor (data importer): Ampost, contact privacy@ampost.io.
• Data subjects: Customer's staff and clients whose social accounts are connected; people named or shown in Customer's posts and media; people whose public interactions appear in analytics counts.
• Personal data: post text, images, videos and their metadata; connected social accounts (platform account id, username, display name, profile picture, granted scopes) and their access tokens, encrypted; analytics (per-post and per-account metrics such as views, likes, comments, shares and follower counts, as aggregates the platforms return); webhook endpoints and the event payloads sent to them; posting queues and schedules.
• Special categories: none intended (see section 2).
• Frequency: continuous, while Customer uses the Service.
• Nature and purpose: storing, scheduling and publishing content to the platforms Customer chooses; reading analytics back from them; delivering webhooks; providing the dashboard, API and MCP server.
• Retention: while the account exists; then as in section 7. Webhook delivery logs are kept for 30 days and analytics for up to 90 days.
• Competent supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), Warsaw, Poland.

• Encryption: TLS for all traffic; database and storage encrypted at rest by the providers; platform tokens, webhook secrets and other stored secrets encrypted with AES-256-GCM under per-record data keys from AWS KMS (Frankfurt), with yearly key rotation.
• Access control: the browser never talks to the database. The server uses a least-privilege database role, and row-level security limits every query to one user's rows. Tokens are readable only by a separate role used by the token store. API keys and OAuth tokens are stored as hashes; keys can be limited by scope and platform set.
• Authentication: passwords of at least 12 characters, Sign in with Google, bot checks (Cloudflare Turnstile) and rate limits on sign-in, sign-up and password reset.
• Data minimization: uploaded images are re-saved without metadata such as GPS location; media files are deleted after publishing (see the Privacy Policy); Stripe event logs keep Stripe ids only.
• Availability: managed database with the provider's backups; monitoring of scheduled jobs with alerts.
• Operations: production access limited to the operator, through accounts on the providers' consoles; secrets kept in the hosting provider's encrypted environment, separate for production and previews; dependency and security updates; a written incident response and breach notification procedure.
• Deletion: account deletion removes Customer's data from the live database at once, revokes Ampost's access at the platforms that support it, and deletes stored media.