Data Processing Agreement (DPA)

Preamble

This Data Processing Agreement (the "DPA") is an integral attachment to the Terms of Service of CommentTap and is concluded between the User of the Service who processes personal data of Contacts/Leads through the Service as a controller or as a processor acting on behalf of the relevant controller (e.g. an agency running a client's campaigns) — referred to in this agreement as the "Controller" as the party giving instructions — and the Processor: Michał Kołnierzak conducting business under the name "KOLM MICHAŁ KOŁNIERZAK", ul. Milenijna 43/2, 03-130 Warsaw, Poland, NIP 5361929091, REGON 367735680 (the "Processor", "Operator").

The DPA is concluded upon acceptance of the Terms and starting to use the Service in a way that leads to processing of Contacts' personal data. It implements the requirements of Art. 28 GDPR.

The User may act as a controller or as a processor authorised by the relevant controller to engage a further processor (e.g. an agency running a brand's campaigns). The data controller is set for each connected Instagram profile (by default the workspace's details), and campaigns, campaign pages and privacy notices use the controller of their profile; an agency names the right client for each profile it runs. In the latter case the User ensures it holds such authorisation, gives instructions consistent with it and, on justified request, provides the information needed to meet the obligations under Art. 28 GDPR.

1. Subject matter and scope

• The Controller entrusts the Processor with processing personal data to the extent and for the purpose necessary to provide the Services under the Terms.
• The Processor processes data only on the Controller's documented instructions (which include the use of the Service's features and the Terms), unless required otherwise by EU or Member State law.
• Where processing other than as instructed is required by EU or Member State law, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
• The Processor exports data to an external system indicated by the Controller (webhook, spreadsheet, integration) on the Controller's documented instruction; the Controller determines the basis for the transfer and its relationship with the recipient. The technical execution of an export does not make the recipient a sub-processor of the Processor.

2. Nature, purpose, duration, data and categories of persons

• Purpose: providing SaaS features for running social-media communication campaigns (replies to comments, DMs, keyword triggers, lead collection and management, analytics).
• Nature: operations on data in the IT systems of the Processor and its subprocessors (storage, recording, organising, transmission to Platforms, erasure).
• Duration: from connecting a Platform account to the Service — from then on the Service receives comments and messages sent to that account, including before any campaign is launched — for the term of the agreement for the Services (the Terms), subject to section 7.
• Deleting inactive Contacts: the Processor automatically deletes a Contact with no interaction for 24 months, together with its conversations; by accepting this agreement the Controller gives this documented instruction. The opt-out register is kept as a one-way hash so that the opt-out continues to be respected. An earlier export is possible at any time.
• Types of data: platform identifiers (provider user id, username, display name), email address, content of comments, story replies and messages, tags, notes, custom fields (lead fields), lead status, opt-out status and text, answers to the marketing consent question with its wording, giveaway entries, interaction timestamps, delivery and link-click history, and — to the extent the relevant features are enabled — technical identifiers and event data (tracked links, conversion measurement) and content sent to AI features. The Service does not require or provide for entering special categories of data (Art. 9 GDPR).
• Categories of data subjects: people commenting on and messaging the Controller's profiles on Platforms, visitors to campaign pages and — when the Controller enables measurement — measured pages, people submitting forms, giveaway participants, and people whose data is contained in the entrusted content.

3. Obligations of the Processor

• process data only on the Controller's documented instructions;
• ensure that persons authorised to process data have committed to confidentiality or are under a statutory duty of confidentiality;
• apply technical and organisational measures ensuring security appropriate to the risk (Art. 32 GDPR) — see section 4;
• respect the conditions for engaging subprocessors (section 5);
• assist the Controller, by appropriate measures, in responding to data subjects' requests (Chapter III GDPR);
• assist the Controller in complying with Art. 32–36 GDPR (security, breach notification, impact assessments, prior consultation);
• at the end of the Services, delete or return the data per section 7;
• make available information necessary to demonstrate compliance with Art. 28 GDPR and allow audits (section 6);
• promptly inform the Controller if, in its opinion, an instruction infringes GDPR or other data protection law.

4. Security measures (Art. 32 GDPR)

The Processor applies in particular: encryption in transit (TLS), role-based access control on a need-to-know basis, authentication, password hashing, backups, event logging, environment separation, and processing with providers offering an adequate level of security.

6. Audit

The Processor makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the Controller or an authorised auditor, after agreeing the date and scope, without disrupting the Processor's operations and subject to confidentiality. Routine audits are scheduled no more than once a year; this limit does not apply to justified doubts about compliance, a significant change in processing, a personal data breach or requests from a competent authority. The Processor may first provide reports and certifications (e.g. of infrastructure providers), which does not exclude the right to audit.

7. End of processing and data deletion

After the Services end, the Processor, at the Controller's choice, deletes or returns the personal data and deletes existing copies, unless EU or Member State law requires their storage. After ordinary service ends, we delete the data once the agreed return window has passed, by default 30 days. If the provider-switching procedure under section 12a of the Terms is under way, we apply that procedure's transitional and retrieval periods and do not delete the data before they end, unless we receive an earlier, clear instruction from the authorised Controller after explaining its impact on the migration. Suspension of access is not in itself the end of processing. An earlier deletion instruction is carried out without waiting for that window. Backups expire on their rotation cycle (up to 30 days) and are used only for restoration; after a restore the Processor re-applies deletion instructions.

8. Personal data breaches

The Processor notifies the Controller of any personal data breach without undue delay after becoming aware of it, providing information enabling the Controller to fulfil its obligations under Art. 33–34 GDPR. Contact: security@commenttap.com, privacy@commenttap.com.

9. Transfers outside the EEA

Any transfer of data outside the EEA takes place only with safeguards compliant with Chapter V GDPR (in particular Standard Contractual Clauses — SCC, and/or the DPF), as described in section 8 of the Privacy Policy.

10. Liability and final provisions

• Liability of the parties is governed by GDPR and the Terms.
• Matters not covered are governed by GDPR and Polish law.
• In case of conflict between this DPA and the Terms on data-protection matters, this DPA prevails.