This agreement forms part of the Terms of Service. It applies when the customer, as controller, uploads or publishes personal data through Postemi and Kiss Industries acts as processor.
Contents
1.Subject matter, duration and instructions
The subject matter of the processing is the provision of the Postemi social media management service; its duration is the term of the customer contract and the retention period defined in it. Postemi processes data only on the basis of the customer's documented instructions, the Terms of Service and the operations performed in the product, unless the law provides otherwise.
2.Data and data subjects
The data includes in particular social profile data, access tokens, post, media, comment and analytics data, shared previews and comments on them, as well as instructions given to the AI feature, uploaded documents and generated output. The data subjects may be the customer's employees, followers, clients, preview collaborators and persons appearing in the content. Special categories of data may be uploaded only with an appropriate legal basis and, where necessary, after prior consultation.
3.Security and confidentiality
Postemi applies access control, encrypted data transmission, logging, encrypted backups and an incident handling procedure. Access and refresh tokens are stored with application level encryption (AES-256-GCM); the conversion of records stored before encryption was introduced, which are still unencrypted, is in progress. Only persons bound by confidentiality may access the data, to the extent necessary.
A backup of the database and of the uploaded media files is made daily. The backup is encrypted on the server before upload, stored within the European Union (Hetzner Storage Box), and kept for 30 days.
4.Sub-processors and transfers
The customer gives general authorization to engage the sub-processors listed in the Privacy Policy. We give prior notice of any material new sub-processor; the customer may object on reasonable data protection grounds. A transfer to a third country may take place only on the basis of an applicable adequacy decision or appropriate safeguards.
The current main sub-processors: Hetzner (application, database and storage of the encrypted backups in Germany), Cloudflare (media storage in the EU jurisdiction Cloudflare R2 storage, CDN, DNS and Turnstile), Resend (transactional email), and OpenAI. OpenAI receives data in two places: in an autopost rule created by the customer, if the customer switches on generation in it (in that case the text of the RSS feed or web address the customer specified reaches it), and in the automatic classification of messages received through the customer service form. Postemi's own text and image generation AI feature is switched off, so the posts the customer writes in the editor and the media files it uploads do not reach an AI provider. The connected social platforms may also act as independent controllers under their own terms with respect to the data transmitted to them. If the customer sets up a webhook, or issues its own API key to an application or AI agent of its choice, the recipient it designates is the customer's own processor for the data leaving through these channels, not a sub-processor of Postemi. The analytics and newsletter providers (currently DataFast and Beehiiv) serve Postemi's own purposes as controller and are not sub-processors of the customer's content.
5.Assistance, incidents and audit
Postemi reasonably assists with handling data subject requests, data protection impact assessments and requests from authorities. It notifies the customer without undue delay of any incident affecting the customer's data. Once a year, and where justified after an incident, the customer is entitled to request relevant compliance information; an on site audit may be carried out only where necessary, proportionate and subject to confidentiality.
6.Return and deletion
When the contract ends, we return or delete the data according to the customer's choice and the export, retention and deletion rules of the Terms of Service, except where retention is required by law. Deletion happens immediately in the live systems; copies in backups cease to exist when the 30 day retention period of the backups expires, within 30 days at the latest.
7.Operations as independent controller
Kiss Industries acts as an independent controller with respect to the account, authentication, billing and contractual evidence, security and abuse prevention logs, marketing consent, customer service and its own product analytics. These operations are governed by the Privacy Policy, not by the customer's processing instructions.
8.Precedence and contact
In the event of any conflict, the data processing provisions of this agreement take precedence over the general rules of the Terms of Service. Contact: [email protected].