Encargo detratamiento.

Where you process personal data in your workspace – for example data of your team members, of people who can be seen or heard in your media, data from your connected social media accounts or data of your audience – you are the controller within the meaning of Art. 4(7) GDPR. [Company name] [Legal form (if applicable)] processes this data as a processor exclusively on your behalf and in accordance with your instructions.

For data we process for our own purposes (e.g. contract performance, billing, security and abuse prevention), we are the controller ourselves; see our Privacy Policy.

The subject matter is the provision of the software-as-a-service platform flect in accordance with our Terms. Processing lasts for the term of the main contract and thereafter until the data has been completely deleted or returned after the end of the contract.

• Hosting and operating the application and storing content and media
• Processing of inputs (prompts, media, texts) by AI providers when you start a generation
• Scheduling and publishing posts on connected social media accounts on your behalf, including autopilot within the rules you define
• Retrieving metrics and public profile data via the official platform APIs
• Team collaboration (comments, approvals, tasks, invitations) and support

• Master and contact data of workspace members (name, email address, role)
• Content data: texts, images, videos, audio files, prompts, comments, templates and brand profiles
• Voice data where you use voice cloning (biometric-like data; only with the documented consent of the speaker)
• Data of connected social media accounts: access tokens (encrypted), public profile data, post data and metrics
• Usage and log data (e.g. audit logs including IP addresses)

• Your employees, team members and invited guests
• People who appear in your content and media or whose voice is used
• Your customers and business partners, where contained in content
• Followers and audiences of your connected social media accounts, where contained in metrics or comments

You generally give your instructions by using and configuring the product (e.g. settings, roles, agent rules, publishing schedules). Further instructions must be given in text form and are documented. We will inform you without undue delay if, in our opinion, an instruction infringes data protection law.

All persons with access to your data are bound to confidentiality or are subject to a statutory obligation of secrecy.

• Transport encryption (TLS) for all connections
• Encryption at rest of OAuth access tokens and other secrets using AES-256-GCM
• Passwords stored only as salted scrypt hashes
• Role-based access control (Owner, Admin, Manager, Editor, Viewer) enforced server-side
• Tenant isolation: every database query on workspace data is restricted to the respective workspace
• Audit logging of security-relevant events
• Rate limiting and protection against brute-force login attempts
• Backups according to the respective hosting setup
• Administrative access following the principle of least privilege

These measures are reviewed regularly and adapted to the state of the art. A detailed description is attached to the signed DPA.

We use the following categories of subprocessors – in each case only where configured by the operator and required for the feature used:

We will inform you in advance in text form of any intended changes to subprocessors. You may object to the change on important data protection grounds within a reasonable period; in the case of a justified objection, you may terminate the contract for cause.

Where subprocessors process data in countries outside the EU/EEA (in particular the USA), transfers are based on an adequacy decision, in particular the EU-US Data Privacy Framework for certified providers, or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), with supplementary measures where necessary.

• Assistance in responding to data subject requests (Art. 12–22 GDPR), including through export and deletion functions in the product
• Assistance in complying with the obligations under Art. 32–36 GDPR (security, breach notification, data protection impact assessment, prior consultation)
• Notification of personal data breaches without undue delay after becoming aware of them

Before the end of the contract you can download your data using the export function (Settings → Privacy). After the end of the contract or deletion of the workspace, we delete the data within 30 days unless there is a statutory retention obligation. Copies in backups are overwritten as part of regular rotation.

On request, we provide you with the information necessary to demonstrate compliance with Art. 28 GDPR. Audits, including inspections, are possible after reasonable prior notice, during normal business hours and without disrupting operations.

Please request the signed data processing agreement by email to [Email address], stating your company name and the name of your workspace.