Data Processing Agreement

Parties and effect

Controller: you, the client. You decide why and how the data of your customers, leads and staff is processed.

Processor: SocialNow, Amstelstraat 43G, 1017 DA Amsterdam, the Netherlands, Chamber of Commerce 90877179. We process that data solely for you.

This agreement takes effect when you create an account in SocialNow OS or give us an assignment in which we process personal data on your behalf, and lasts as long as that processing lasts. Where it conflicts with the terms of service on the subject of personal data, this agreement prevails.

Where this agreement refers to the GDPR we mean Regulation (EU) 2016/679, and where it refers to the supervisory authority we mean the Dutch Data Protection Authority, or the authority of the country where you are established.

1. Subject matter, nature, purpose and duration

The subject matter is the provision of SocialNow OS and the services around it: a workspace in which you manage your website, customers, content and advertising, connected to the sources you attach yourself.

The nature of the processing is storing, organising, consulting, altering, combining, displaying, transmitting and erasing data, and having it processed by the models and services in Annex C, all to the extent needed to run the OS for you.

The purpose is solely the performance of the agreement with you. We do not determine any purpose of our own for your data.

The duration equals the term of your account or assignment. After that, clause 8 applies.

The types of personal data and categories of data subjects are set out in Annex A.

2. Only on your instruction

We process personal data only on your documented instruction. The following count as instructions: this agreement, the terms of service, the actions you and your team perform in the OS, and requests you send us by e-mail.

We do not process the data for our own purposes, do not sell it, do not share it with other clients, and do not use it for third-party advertising or for profiling outside your workspace.

If we consider an instruction to infringe the GDPR or other data protection law, we tell you before carrying it out, and we may suspend performance until you amend or confirm it.

If Union or Member State law requires us to process beyond your instruction, we inform you before processing, unless that law prohibits it on important grounds of public interest.

Note the distinction with clause 17 of the terms of service: there you, as our client, allow us to view data in your workspace internally in order to improve the product. That permission is an arrangement between you and us about your own use. For personal data of third parties in your workspace it applies only to the extent that you, as controller, have a lawful basis for it, and always within the limits of this agreement: internal, under confidentiality, without profiling and without disclosure to third parties.

3. Confidentiality

Everyone at our end with access to your data is bound to confidentiality, in writing or by law. This covers staff, engaged specialists and the administrators of our systems.

Access is granted only to those who need it for their work, and withdrawn as soon as that is no longer the case. Administrator access to a client environment runs through a short-lived, logged session; that access is recorded in an audit trail we retain.

Confidentiality survives the end of this agreement and the end of any employment or engagement.

4. Security

We take appropriate technical and organisational measures within the meaning of Article 32 GDPR, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to data subjects.

The measures currently in place are described in Annex B. That annex is a snapshot: we may replace a measure with one that is at least as protective, and will not lower the level of protection.

You are responsible for security on your side: strong passwords or passkeys, two-step verification where available, timely withdrawal of access for departed team members, and careful handling of the keys you enter in the OS.

5. Sub-processors

You give us general authorisation to engage sub-processors. The sub-processors we currently use are listed in Annex C, with what we use each of them for and where the data sits.

We impose on each sub-processor the same obligations we owe you, by written contract. If a sub-processor fails to meet them, we remain fully liable to you.

If we wish to add or replace a sub-processor we announce it at least thirty days in advance by e-mail and on socialnow.nl/verwerkersovereenkomst. If within that period you raise a reasonable objection concerning the protection of personal data, we look for a solution together; if we cannot find one, you may terminate the service concerned without termination costs, against refund of the prepaid portion.

Parties you connect yourself — your own Odoo, your own Meta account, your own Google property, your own social channels — are not our sub-processors. You have your own relationship with them; we only read and write there with the key you give us, and only within your workspace.

6. Data subject rights

If a data subject sends us a request that is really meant for you — access, rectification, erasure, restriction, portability or objection — we do not act on it ourselves. We forward it to you and tell the data subject we have done so.

We assist you in answering such requests, by appropriate technical and organisational measures and insofar as reasonably possible. In the OS you can view, amend, export and delete data yourself; where that is not possible, we do it at your request.

We do not charge for this assistance, unless requests are repetitive or excessive and require substantial work; in that case we tell you the cost in advance.

7. Data breaches, DPIA and prior consultation

If we discover a personal data breach, we notify you without undue delay and in any case within 24 hours of discovery, so that you can make your own assessment within the 72 hours of Article 33 GDPR. We never notify the supervisory authority on your behalf unless you ask us in writing.

Our notification contains, as far as known: what happened and when, which categories and approximately how many data subjects and records are likely affected, the likely consequences, the measures we have taken or propose, and a contact point. Anything not yet known at that moment follows as soon as we know it.

We keep an internal register of breaches, including those that did not have to be notified, recording the facts, the effects and the remedial action taken.

If you have to carry out a data protection impact assessment or consult the supervisory authority in advance, we provide the information about our processing that you need for it.

8. On termination: return or erasure

When your account or assignment ends, you choose what happens to the data: return in a common file format, or erasure. If you tell us nothing within thirty days of the end, we erase.

Erasure means: out of the active systems within thirty days, and out of backups as those expire on their own cycle, at the latest after ninety days. While a record is still in a backup it is no longer used and no longer shown.

What the law requires us to keep, we keep. In practice that is the invoice administration, seven years under Dutch tax law. That data is then used for that purpose only.

On request we confirm erasure in writing.

9. Information and audit

We make available all information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, by you or an auditor mandated by you.

In practice we answer questionnaires and provide, on request, an overview of our measures, our sub-processor register and our audit trails. For an on-site audit or one by an external party, you announce it at least thirty days in advance, it takes place during office hours, it does not disrupt our service, and the auditor is bound to confidentiality. At most one audit per calendar year is at our expense; a further audit in the same year, or one that finds no shortcoming, is at your expense at our usual hourly rate.

During an audit we never show other clients' data. Wherever possible we work with anonymised or aggregated evidence.

10. Transfers outside the EEA

We prefer to store and process your data within the European Economic Area. Regions differ by service. PostHog uses the EU region; the current Vercel app functions run in the United States. Our service is therefore not EU-only.

Where a transfer to a third country is unavoidable — which is the case for a number of US providers of models and infrastructure — we do so only on the basis of a valid mechanism under Chapter V GDPR: an adequacy decision of the European Commission, or the standard contractual clauses (Implementing Decision (EU) 2021/914), supplemented by an assessment of the circumstances in that country and by additional measures where needed, such as encryption in transit and at rest and keeping what is sent as small as possible.

Annex C states, per sub-processor, where the data sits and which mechanism applies. If that changes, we update the annex in line with clause 5.

11. Liability

The liability regime of the terms of service applies here too, with one exception: that limitation does not apply to fines and claims arising directly from our intent or wilful recklessness, and not where the law prohibits a limitation.

Article 82 GDPR continues to apply in full between us and data subjects. How we bear liability between ourselves is determined in proportion to each party's share in the damage.

12. Final provisions

Dutch law applies to this agreement. Disputes are submitted to the competent court in the district of our place of business.

If we amend this agreement we announce it at least thirty days in advance by e-mail and publish the new version on socialnow.nl/verwerkersovereenkomst. If the change is to your detriment and you do not accept it, you may terminate within those thirty days against refund of the prepaid portion.

Questions about this agreement, a data breach or a data subject request: privacy@socialnow.nl.

Annex A: data and data subjects

Categories of data subjects whose data we process on your behalf:

• your team members and the users of your workspace
• your customers, leads and contacts, as held in your Odoo or in the CRM
• people who respond to your posts, ads or forms
• visitors to the websites we build or manage for you, insofar as you collect data there

Types of personal data:

• name, role, company, e-mail address, telephone number and address
• correspondence: messages, replies, e-mails and call notes you put into the OS or receive there
• commercial data: quotes, orders, invoices, amounts and statuses from your Odoo
• account data: login name, role, language, timestamps of use
• technical data: IP address, device and browser, insofar as recorded with an action
• images and text you supply or have created in which people may be recognisable

Special categories of personal data within the meaning of Article 9 GDPR and criminal conviction data within the meaning of Article 10 do not belong in SocialNow OS. If you put them in anyway, you do so at your own responsibility and outside the intent of this agreement; we take no additional measures for such data because we do not expect it to be there.

Annex B: security measures

Access and identity:

• signing in to your account runs through an identity provider with two-step verification; SocialNow administrator access runs through a passkey and a time-based code
• administrator access to a client environment runs through a token valid for two minutes that opens that one system only; the token itself is never logged, its issuance is
• rights are granted per workspace and withdrawn on departure

Encryption and keys:

• all traffic runs over TLS; HTTP traffic is redirected to HTTPS
• data is stored encrypted at our providers
• keys you enter for Odoo, Meta, Google or your social channels are stored encrypted, never shown back and never written to log lines
• secrets live only in the hosting provider's environment, not in source code

Separation and shielding:

• every client has its own workspace; each request is checked against workspace and role
• clients with their own system run in their own environment with their own secrets, separate from the others
• the administration environment is not publicly reachable and is set to noindex
• a strict Content Security Policy limits which scripts, styles and connections a page may use

Logging and detection:

• consequential actions — granting access, opening a system, changing a key — are recorded in an audit trail with who, what and when
• errors and warnings are collected centrally; personal data is not written into them
• the reachability and login protection of every client system is checked automatically and continuously

Continuity:

• storage and recovery follow the capabilities of each provider; frequency, retention and restorability are documented per data source
• code is under version control; every deployment traces back to a commit and can be rolled back
• an automated test suite runs before deployment; a failing suite means no deployment

Organisation:

• the group with access is small and known, all under confidentiality
• new providers are assessed on where they store data and on what terms
• there is a fixed route for reporting vulnerabilities: security@socialnow.nl

This list describes what is in place on 19 September 2026. We replace a measure only with one that is at least as protective.

Annex C: sub-processors

Infrastructure and storage:

• Vercel Inc. (United States; region varies by service, app functions currently US): hosting of the OS and the API
• Google Ireland Limited / Google LLC: Firebase for storage of workspaces and accounts
• Hostinger International Ltd (Lithuania): hosting of websites, domains and e-mail

Identity and communication:

• Google Ireland Limited: signing in with a Google account
• Hostinger International Ltd: sending e-mail from the OS, including sign-in codes

Measurement:

• PostHog Inc., EU data centre in Frankfurt: measuring use of the OS, only after the user's consent, without session recordings

Models for text and image, only for what you have created:

• Google Ireland Limited / Google LLC: Gemini for text and image
• OpenAI Ireland Ltd: models for text and image
• Anthropic PBC (United States): models for text
• Higgsfield: image and film
• With all of these parties it is contractually excluded that your input is used to train their models.

Publishing to social channels:

• Zernio: connecting to and publishing on your own social channels, with the key you attach yourself

We have a data processing agreement or equivalent terms with each of these parties. For parties outside the EEA, transfers rest on the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

This list is valid on 19 September 2026. Changes are announced thirty days in advance in line with clause 5.