Data Processing Agreement

Last updated 20 October 2026 · For business customers. It forms part of the Terms of Service.

1. Parties and scope

This Data Processing Agreement ("DPA") is between:

• you, the business customer that uses Postybuddy under our Terms of Service (the controller); and
• Anthony Somian, a private individual based in Belgium who runs Postybuddy as a free beta ("we", "us", the processor).

It applies when, through Postybuddy, we process personal data on your behalf: mainly personal data contained in the content you upload and publish, and in the social media accounts you connect. It meets the requirements of Article 28 of the EU General Data Protection Regulation ("GDPR").

You accept this DPA by accepting the Terms of Service as a business customer. It forms part of those terms and lasts as long as we process personal data for you.

It does not cover the personal data we process as controller ourselves, such as your account login and support messages. That data is covered by our Privacy Policy.

2. Details of the processing

3. Our obligations

• Your instructions only. We process the personal data only on your documented instructions, including for transfers outside the EEA. Your instructions are the Terms of Service, this DPA, and what you choose in Postybuddy (what to upload, where and when to publish, what to delete). If the law requires us to process it otherwise, we tell you first, unless that law forbids it. If we believe an instruction breaks data protection law, we tell you.
• Confidentiality. Only people who need it to run Postybuddy can access the personal data, and they are bound to confidentiality.
• Security. We protect the personal data with the technical and organisational measures in the Annex, and keep them up to date.
• Helping you with people's rights. If someone asks us to exercise their rights (access, deletion, objection…) over data we process for you, we pass the request on to you and don't answer it ourselves. Postybuddy lets you find, download and delete your content yourself; where that isn't enough, we help you at your request.
• Helping you with your other duties. Taking into account what we know, we help you with security, data breach notifications, data protection impact assessments and consulting a data protection authority.
• Data breaches. If a breach affects the personal data, we tell you without undue delay, and at the latest within 48 hours of becoming aware of it, by email to your account's address. We give you what we know at that time (what happened, what data and how many people are concerned, likely consequences, what we did about it, and a contact person), and the rest as soon as we have it.

4. Sub-processors

You allow us to use the following sub-processors:

Instagram, Facebook (Meta) and TikTok are not our sub-processors: they are the platforms you choose to publish to, and they handle what you send them under their own terms, as independent controllers.

• We bind each sub-processor by contract to the same level of data protection as this DPA, and we remain responsible to you for its work.
• Changes: we tell you by email at least 30 days before adding or replacing a sub-processor. You can object within that time, with reasons related to data protection. If we can't solve your concern, you can stop using Postybuddy and delete your account before the change applies.
• The current list is always on this page.

5. Transfers outside the EEA

We store the personal data in the European Economic Area wherever our providers allow it. Some sub-processors are US companies and may access it from outside the EEA. Such transfers take place only with a safeguard recognised by the GDPR: the provider's certification under the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses, with extra measures where needed (for example encryption).

6. Information and audits

• At your request, we give you the information you need to show that this DPA is respected, such as a description of our security measures and our sub-processors' certifications.
• If that isn't enough, you or an independent auditor bound to confidentiality may audit us, at most once a year (more often after a data breach or when a data protection authority requires it), with at least 30 days' notice, during business hours and without disrupting the service or other customers' data. Each party bears its own costs.

7. Your obligations

As controller, you are responsible for:

• having a legal basis for the personal data in your content, and the agreement of the people shown in it where needed;
• informing those people about the processing, as the GDPR requires;
• giving only lawful instructions, and connecting only accounts you are allowed to manage;
• keeping your Postybuddy login safe, for example with two-step login.

8. End of the service: return and deletion

• Before the end, you can download your data at any time (Account → Download my data).
• When your account is closed, we delete the personal data we process for you within 30 days, including from backups, unless EU or Belgian law requires us to keep it.
• Posts already published stay on the platforms until you delete them there. We can't delete them for you once the account is disconnected.

9. Liability, precedence and law

• Liability under this DPA follows the liability section of the Terms of Service, including its limit for business customers, except where the GDPR does not allow a limit (towards the people whose data is concerned, each party is liable as Article 82 of the GDPR provides).
• Precedence: on personal data, this DPA takes precedence over the Terms of Service.
• Changes to this DPA follow the same rules as changes to the Terms of Service (at least 30 days' notice), unless the law requires a change sooner.
• Law: Belgian law applies, and the competent courts of Belgium have exclusive jurisdiction.
• Contact: privacy@postybuddy.com

Annex: security measures