Data Processing Addendum

1. Definitions

"GDPR" means Regulation (EU) 2016/679; "Data Protection Laws" means the GDPR and any other data protection law applicable to the processing of Customer Personal Data. "Customer Personal Data" means personal data that the Customer or its users submit to the Services, or that PostPulse receives on the Customer's behalf from the platforms the Customer connects, as described in Annex 1. "Sub-processor" means a processor engaged by PostPulse to process Customer Personal Data. "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021. "Controller", "processor", "processing", "data subject" and "personal data breach" have the meanings given in the GDPR.

2. Roles and Scope

2.1. The Customer acts as controller of Customer Personal Data, or as processor on behalf of its own clients; PostPulse acts as processor or, respectively, as sub-processor. Where the Customer acts as processor, it warrants that its controller's instructions, including the engagement of PostPulse, are authorised.

2.2. This DPA does not apply to personal data that PostPulse processes as controller about the Customer and its own users (sign-in, billing, support, product analytics and marketing). That processing is described in the PostPulse Privacy Policy.

2.3. The social networks and messaging platforms to which the Customer publishes receive content as independent controllers under their own terms. The Customer's WhatsApp Business Account is governed by the Customer's own agreement with Meta, which the Customer accepts when it connects the account (including the WhatsApp Business Data Processing Terms); Meta processes WhatsApp messages under that agreement and is not a Sub-processor of PostPulse. PostPulse transmits messages to the WhatsApp Business Platform on the Customer's instruction.

3. Instructions

PostPulse processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers, unless required to do so by applicable law; in that case PostPulse informs the Customer before processing, unless the law prohibits it. The Terms, this DPA and the Customer's configuration and use of the Services, through the web application or the API, constitute the Customer's instructions. PostPulse informs the Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Customer Obligations

4.1. The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis and giving the information required by Data Protection Laws to the data subjects concerned.

4.2. Before adding a phone number to a WhatsApp contact list, the Customer obtains the opt-in required by the WhatsApp Business Messaging Policy, and it respects opt-outs. The Customer complies with the terms of the platforms it connects.

4.3. The Customer does not use the Services to process special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR), and in particular does not place such data in WhatsApp contact names or template values.

5. Confidentiality

PostPulse ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6. Security

PostPulse implements the technical and organisational measures described in Annex 2 and may update them, provided that the overall level of protection is not reduced.

7. Sub-processors

7.1. The Customer gives a general authorisation for the Sub-processors listed in Annex 3. PostPulse informs the Customer of any intended addition or replacement at least thirty (30) days in advance, by updating Annex 3 on this page and by e-mail to the address of the Customer's account, and allows the Customer to object on reasonable data protection grounds. If the objection cannot be resolved, the Customer may terminate the affected Services.

7.2. PostPulse imposes on each Sub-processor, by written contract, data protection obligations no less protective than those of this DPA and remains liable to the Customer for their performance.

8. Data Subject Requests

8.1. PostPulse assists the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights. Any request PostPulse receives directly is forwarded to the Customer without undue delay and is not answered by PostPulse, unless the Customer instructs otherwise.

8.2. The Customer can act on most requests itself: it can view, export (through the API) and delete posts, media and connected accounts, and view, delete and opt out WhatsApp contacts. Deleting a WhatsApp contact does not remove its phone number from the delivery records of past broadcasts; those records are deleted with the post they belong to, or earlier on request to PostPulse.

9. Personal Data Breaches

PostPulse notifies the Customer of any personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, and at the latest within forty-eight (48) hours, providing the information referred to in Article 33(3) GDPR as it becomes available, and assists the Customer in meeting its obligations under Articles 33 and 34 GDPR.

10. Assistance

Taking into account the nature of the processing and the information available to it, PostPulse provides reasonable assistance to the Customer with data protection impact assessments and prior consultations (Articles 35 and 36 GDPR).

11. Deletion and Return

11.1. When the Customer deletes data, disconnects an account or deletes its PostPulse account, the data concerned is deleted from active systems without delay: disconnecting a social media account deletes its posts and connection tokens; disconnecting a WhatsApp Business Account deletes its contact lists, delivery records and opt-out list; deleting the PostPulse account deletes all Customer Personal Data. Residual copies expire as described in Annex 1 (database backups 7 days, technical logs up to 14 days, error reports up to 90 days).

11.2. Before deletion, the Customer can retrieve its data through the API or receive an export on request. Apart from the automatic expiry described in Annex 1, PostPulse does not delete Customer Personal Data on its own initiative without at least thirty (30) days' notice, unless required by law.

12. Audits

PostPulse makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows audits, including inspections, by the Customer or an auditor it mandates. Audits take place no more than once per year, unless following a personal data breach or a request from a supervisory authority, with at least thirty (30) days' written notice and at the Customer's cost. Audits start with a written questionnaire; an on-site audit takes place only if the answers are insufficient, during business hours and subject to confidentiality.

13. International Transfers

13.1. Customer Personal Data is hosted in the European Union (Frankfurt, Germany). PostPulse is established in the United Arab Emirates, a country not covered by an adequacy decision, and its personnel may access the data from outside the European Economic Area. To the extent such access, or a Sub-processor listed in Annex 3, constitutes a transfer of Customer Personal Data subject to the GDPR, the SCCs apply and are incorporated by reference: MODULE 2 (controller to processor) where the Customer is a controller, and MODULE 3 (processor to processor) where the Customer is a processor. The Customer is the data exporter and PostPulse the data importer.

13.2. The following options apply: Clause 7 (docking clause) applies; Clause 9(a): OPTION 2, general written authorisation, with the notice period set out in section 7; the optional language of Clause 11(a) does not apply; Clause 13: the competent supervisory authority is determined in accordance with Clause 13(a); Clause 17: OPTION 1, the law of Spain; Clause 18(b): the courts of Spain. Annexes 1, 2 and 3 of this DPA complete Annexes I, II and III of the SCCs.

13.3. PostPulse notifies the Customer of any request for access to Customer Personal Data from a public authority, where the law allows, within 24 hours, challenges it where there are grounds to do so and discloses only the minimum data required (Clause 15 of the SCCs).

13.4. In the event of a conflict, the SCCs prevail over this DPA, and this DPA prevails over the Terms.

14. Limitation of Use

14.1. PostPulse does not use Customer Personal Data for any purpose other than providing the Services, does not sell it, and does not use it, or allow its Sub-processors to use it, for its own marketing or for the training, development or improvement of artificial intelligence models.

14.2. As the only exception, PostPulse records service usage events – for example, that an account was connected or that a post was scheduled, published or failed – to operate, monitor and improve the Services. These events carry internal pseudonymous identifiers, the platform concerned and, for a failure, the type of error; they contain no content, names, e-mail addresses or phone numbers. PostPulse processes these events as controller, as described in its Privacy Policy, using the analytics provider listed in Annex 3.

15. Liability

Each party is liable for damage caused by processing that infringes this DPA or Data Protection Laws, in accordance with Article 82 GDPR. Except in the event of wilful misconduct, the total liability of PostPulse under this DPA is limited to the fees paid by the Customer to PostPulse for the Services in the twelve (12) months preceding the event giving rise to the claim. This limitation applies only to the extent permitted by the SCCs and Data Protection Laws and does not affect the rights of data subjects under Clause 12 of the SCCs.

16. Term, Changes and Governing Law

This DPA applies for as long as PostPulse processes Customer Personal Data. PostPulse may update this DPA to reflect changes in law or in the Services; material changes are notified by e-mail to the address of the Customer's account at least thirty (30) days in advance and do not reduce the level of protection of Customer Personal Data. Except for the SCCs, which are governed by the law set out in section 13.2, this DPA is governed by the law that governs the Terms.

Annex 1 – Description of the Processing

A. Parties

• Data exporter: the Customer, as identified in its PostPulse account; contact: the e-mail address of the account. Role: controller (MODULE 2) or processor (MODULE 3).
• Data importer: DAO Education and Technologies FZE LLC, trading as PostPulse – License No. 40292, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates – contact: [email protected]. Role: processor (MODULE 2) or sub-processor (MODULE 3).

B. Description

• Data subjects: persons appearing in the content the Customer publishes; owners and managers of the social media accounts and messaging channels the Customer connects, including the Customer's clients; the Customer's end users created through the API; recipients of the Customer's WhatsApp broadcasts and persons who send messages to the Customer's WhatsApp numbers.
• Nature and purpose: storage, scheduling and publication of content to the platforms the Customer connects; sending WhatsApp template messages to the Customer's contact lists, receiving delivery statuses and handling opt-outs; showing the results to the Customer; deletion. The sole purpose is to provide the Services (see also section 14.2 on service usage events).
• Frequency: continuous, for the duration of the Services.
• Sensitive data: none intended (section 4.3).

C. Competent supervisory authority

Determined in accordance with Clause 13 of the SCCs: as a rule, the supervisory authority of the EU Member State in which the Customer is established.

Annex 2 – Technical and Organisational Measures

• Hosting: Amazon Web Services, Frankfurt, Germany (eu-central-1). The database is encrypted at rest, has no public network endpoint and runs in several availability zones; its backups are encrypted and kept for seven (7) days; no backup or replica is kept outside the European Union.
• Media: stored in private, encrypted object storage. Where a platform requires a public link to fetch a file, a temporary public copy is made and deleted after one (1) day.
• Encryption: TLS for data in transit; connection tokens are additionally encrypted at application level, with the key held in AWS (eu-central-1); the cache is encrypted at rest and in transit.
• Access control: each user sees only the data of its own account; every API request is authenticated and checked against the account it concerns. Production access is limited to a small number of named personnel; administrative access is protected by multi-factor authentication.
• Secrets: kept in AWS Systems Manager Parameter Store (encrypted). The two-step verification PIN of WhatsApp numbers is not stored.
• Integrity of incoming events: webhooks from Meta are accepted only with a valid signature.
• Logging and monitoring: application logs (pseudonymous identifiers, may include publication text) kept about 14 days; phone numbers of WhatsApp recipients are not written to application logs; AWS administrative actions are recorded in AWS CloudTrail event history; errors are monitored with Sentry.
• Incident response: documented procedure; personal data breaches notified within 48 hours (section 9).
• Certifications: PostPulse does not hold ISO 27001 or SOC 2 certification; its infrastructure providers hold their own certifications. PostPulse answers security questionnaires on request.
• Artificial intelligence: Customer Personal Data is not sent to AI providers and is not used to train models.

Annex 3 – Sub-processors

Meta Platforms Ireland Ltd. is not a Sub-processor: WhatsApp messages are processed by Meta under the Customer's own agreement with Meta (section 2.3).