Data Processing Agreement (DPA)

(1) The Provider processes on behalf of the customer personal data which the customer or persons invited by the customer enter into RYVIO or make available through connected platform accounts. The customer is controller (Art. 4(7) GDPR), the Provider is processor (Art. 4(8) GDPR).

(2) This agreement does not cover processing for which the Provider is itself controller (user account, billing, abuse prevention, security; see privacy policy). The platform operators (Meta, LinkedIn, Pinterest, TikTok, Google) are independently responsible for their services.

(3) If the customer acts as an agency or service provider for its own clients, the customer is a processor and the Provider its sub-processor. The customer ensures that its clients have agreed to the use of the Provider and the sub-processors under section 6.

This agreement also applies during a free test or beta use of the application; Art. 28 GDPR has no remuneration threshold.

Purpose: providing the application — management of company profiles, posts and media, scheduling, approval and publishing on connected platforms, reporting, client portal, inbox, competitor monitoring, notifications. Duration: term of the usage contract and the periods under Terms § 5.

• Data categories: post texts, images and videos (possibly showing identifiable people), usernames and texts of third-party comments (retrieved live, not stored), names and notes of approvers in the client portal, names and email addresses of team members, account name and access tokens of connected platform accounts (encrypted), aggregated reach figures, public metrics of monitored competitor accounts
• Data subjects: employees and team members of the customer, the customer's clients and approvers, people shown in content, commenters and owners of monitored public accounts
• Special categories of personal data (Art. 9 GDPR) must not be entered.

(1) The Provider processes the data only on documented instructions of the customer. The customer's settings and actions in the application and the usage contract constitute instructions.

(2) If the Provider considers an instruction unlawful, it informs the customer without delay and may suspend execution until confirmed or changed.

The Provider obliges all persons with access to the data to confidentiality, unless they are already subject to a statutory duty of secrecy.

The Provider implements the measures required by Art. 32 GDPR, in particular:

• Transport encryption (HTTPS/TLS, HSTS); encryption of access tokens of connected accounts at rest (AES-256-GCM); passwords only as bcrypt hashes; optional two-factor authentication
• Tenant separation: access only to data of one's own workspace; role-based permissions (owner, approver, editor); activity log
• Rate limiting, input and size checks, server-side checking and re-encoding of image uploads, security headers (CSP etc.)
• Availability: operation at hosting and database providers in the Frankfurt am Main region; backups of the database provider
• Recovery and deletion: deletion functions in the account, automatic retention periods (section 10), export of data in a machine-readable format
• Regular review of measures and of dependencies for known vulnerabilities

(1) The customer grants a general authorisation to use the following sub-processors:

• Vercel Inc., Walnut, CA, USA — hosting, serverless execution (Frankfurt am Main region), object storage (Vercel Blob; storage location may be outside the EU); transfer based on the EU standard contractual clauses (and, per the provider's self-declaration, the EU-US Data Privacy Framework)
• Supabase Inc., USA — PostgreSQL database (region eu-central-1, Frankfurt am Main); transfer for possible third-country access based on the EU standard contractual clauses
• Resend, Inc., USA — email delivery (notifications, PDF reports); standard contractual clauses and EU-US Data Privacy Framework (self-declaration)
• GitHub, Inc., USA — scheduled call of the publishing function; no transfer of customer content
• External AI service: currently not in use (Terms § 8a); will be listed here before activation

(2) The Provider announces changes (additions or replacements) at least 30 days in advance in text form. The customer may object within this period for an important data protection reason. If no agreement is reached, either party may terminate the contract when the change takes effect.

(3) The Provider imposes the same data protection obligations on sub-processors and is liable for their compliance under Art. 28(4) GDPR.

Push services of browser and device manufacturers and the operators of platforms from which publicly available preview data (oEmbed) is retrieved at the Customer's instruction are not sub-processors; they are independent controllers.

Transfers to third countries take place only on the basis of Art. 44 et seq. GDPR, currently the EU standard contractual clauses and, where the recipient is certified, the EU-US Data Privacy Framework. If a basis lapses, the Provider informs the customer without delay.

The Provider forwards requests from data subjects that evidently relate to the customer to the customer without delay, usually within five working days, and assists the customer with the application's functions (export, deletion, correction) in fulfilling data subject rights under Chapter III GDPR.

The Provider assists the customer with the obligations under Art. 32 to 36 GDPR. The Provider notifies the customer of a personal data breach without undue delay after becoming aware of it, with the information required for Art. 33(3) GDPR as far as known.

After the end of the contract or the transition period under Terms § 5, the Provider makes the data available for export (at least 30 days) and then deletes it, including backups, within 90 days. Statutory retention obligations remain unaffected. Automatic retention periods during the term: activity log 12 months, stored reach and competitor measurements 24 months.

On request the Provider provides the customer with the information necessary to demonstrate compliance with this agreement (including the record of processing activities as processor, a description of the measures, evidence from sub-processors) and permits reviews on prior notice at reasonable times; the customer bears the resulting costs unless the review reveals material breaches.

(1) The customer ensures that a legal basis exists for all data it enters and that data subjects are informed where required (in particular Art. 13 and 14 GDPR for competitor monitoring, comments and approvers, and consent of people shown in content).

(2) The customer uses the inbox and competitor monitoring only within the platforms' terms of use and applicable law.

(1) The agreement applies for the duration of the processing. (2) Art. 82 GDPR and Terms § 10 apply to liability. (3) Changes are governed by Terms § 12. (4) The agreement is concluded electronically (Art. 28(9) GDPR); the Provider stores the time and version of the confirmation.

Version of this agreement: 2026-10-19.