Data processing agreement

Between the client agency and service owner pending, owner of Tintaki (Article 28 of Regulation (EU) 2016/679, GDPR, and Article 33 of Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, LOPDGDD).

Parties

Of the one part, "the Agency": the company that signs up to Tintaki and accepts this agreement, with the details recorded in its account.

Of the other part, "the Processor": service owner pending, with tax ID (NIF) tax ID (NIF) pending and address at registered address pending, owner of the Tintaki service.

1. Subject matter

1.1. This agreement governs the processing of personal data that the Processor carries out on behalf of the Agency when providing it with the Tintaki service, described in the terms of service.

1.2. It does not cover the data that the Processor processes as controller (that of the Agency's Users for managing their account and billing data), which is governed by the privacy policy.

2. Role of each party

2.1. The Agency acts as controller or, where it processes the data on behalf of its own clients (the brands), as processor for those clients.

2.2. In the latter case, the Processor acts as sub-processor of the Agency, and:

• the Agency warrants that its contract with each brand allows it to engage Tintaki and the sub-processors listed in Annex II;
• the Agency's instructions are deemed to be given also on behalf of the brand;
• the Agency will pass on to the brand the information that the Processor provides to it about this processing.

3. Description of the processing

4. Obligations of the Processor

The Processor undertakes to:

a) Follow instructions. Process the data only on the documented instructions of the Agency. This agreement, the terms of service and the configuration the Agency sets in Tintaki (what to publish, where, when, to whom to send the link) constitute those instructions. If an instruction appears to it to be contrary to the law, it will inform the Agency immediately.

b) Not use the data for any other purpose. In particular, not to use it for its own purposes, for advertising or to train artificial intelligence models.

c) Confidentiality. Ensure that the persons authorised to process the data have committed in writing to keep it confidential, including after they stop working for the Processor.

d) Security. Apply the measures in Annex I, appropriate to the risk in accordance with Art. 32 GDPR.

e) Sub-processors. Comply with clause 5.

f) Assist with rights. If a data subject exercises their rights before the Processor, it will forward the request to the Agency within 5 working days at most and will help it to respond. Tintaki provides tools so that the Agency can consult, export and delete the data itself.

g) Assist with the Agency's obligations. Cooperate, as appropriate, in impact assessments, prior consultations with the authority and breach notifications.

h) Security breaches. Notify the Agency of any breach affecting its data without undue delay and, in any event, within 48 hours at most of becoming aware of it, with the information available: what has happened, the approximate data and persons affected, the likely consequences and the measures taken or proposed. It will supplement the information as it becomes available.

i) Records. Maintain the record of processing activities as processor (Art. 30(2) GDPR).

j) Demonstrate compliance. Make available to the Agency the information necessary to demonstrate compliance with this agreement, and allow audits in accordance with clause 7.

5. Sub-processors

5.1. The Agency gives general authorisation for the Processor to engage the sub-processors listed in Annex II.

5.2. Before adding or replacing a sub-processor, the Processor will notify the Agency by email and in the dashboard at least 30 days in advance (or such shorter period as is strictly necessary for security reasons or because a provider ceases operating), stating who it is, what it will do and where.

5.3. The Agency may object on reasonable grounds relating to data protection, in writing and within that period. If no alternative is found, the Agency may terminate the contract without penalty and with a refund of the proportional part already paid for the unused period.

5.4. The Processor will impose on each sub-processor, by contract, the same data protection obligations that this agreement imposes on it, and will remain liable to the Agency for the actions of each sub-processor.

5.5. Meta is not a sub-processor. When the Agency instructs publication, the Processor sends the content to Meta Platforms Ireland Limited, which processes it as an independent controller under its own terms, accepted by the brand when connecting its account. The same applies to Stripe with regard to payment data.

5.6. Nor is Metricool. If the Agency connects its own Metricool account, the Processor sends it the posts that the Agency instructs it to schedule. Metricool processes them under the contract it has with the Agency, not on behalf of the Processor.

6. International transfers

6.1. The Processor does not transfer data outside the European Economic Area except to the sub-processors in Annex II that indicate so, and only with one of the following safeguards:

• an adequacy decision of the European Commission, including that of the EU-US Data Privacy Framework for certified entities;
• the Commission's standard contractual clauses (Decision 2021/914), with a transfer impact assessment and supplementary measures where necessary.

6.2. In the AI functions, the Processor minimises the personal data sent: it does not include contact details of the brands' people or approval records in the requests.

7. Audits

7.1. The Agency may request information on compliance with this agreement once a year, or at any time following a breach. The Processor will respond within 30 days, normally with documentation, certifications or reports of its own and of its sub-processors.

7.2. If that is not sufficient, the Agency may carry out or commission an audit, giving 30 days' notice, during working hours, without accessing data of other customers and with an auditor bound by confidentiality. Each party bears its own costs, unless the audit reveals a serious breach by the Processor.

8. Obligations of the Agency

The Agency undertakes to:

• have a legal basis for the data it enters in Tintaki and to have informed the data subjects (for example, those to whom it will send the approval link);
• have the authorisation of each brand to connect its accounts and publish on them;
• have the permission of the people who appear in the images it uploads;
• not enter sensitive data or data of minors except as provided in clause 3;
• give instructions that comply with the law.

9. Liability

Each party is liable for its own breaches in accordance with Art. 82 GDPR. If the Processor processes data outside the instructions, it will be considered a controller in respect of that processing (Art. 28(10) GDPR). The limits of liability are those of the terms of service, unless the law does not permit it.

10. Term

This agreement lasts as long as the service relationship between the Agency and Tintaki.

11. End of processing: return and deletion

11.1. When the service ends, the Agency has 30 days to export its content and data from the dashboard.

11.2. After that period, the Processor will delete the personal data processed on behalf of the Agency, including from backups within a further 30 days at most, and will certify this in writing if the Agency so requests.

11.3. Access tokens for Instagram, Facebook and Metricool are deleted immediately when the service ends or the account is disconnected.

11.4. The Processor will only retain blocked data where required by law, and for as long as required.

12. Law and jurisdiction

Spanish law. Courts of city pending, unless the law provides otherwise.

Annex I. Security measures

Organisational

• Access to the data only for staff who need it, with a signed confidentiality undertaking.
• Password policy and mandatory two-factor authentication for administrative access.
• Written breach management procedure.
• Annual review of these measures and of the sub-processors.

Technical

• Servers in Germany (EU), at Hetzner Online GmbH.
• Encryption in transit with TLS 1.2 or higher.
• Meta and Metricool tokens encrypted in the database with a key stored outside it; never in logs or in the browser.
• Passwords with a robust hashing algorithm (for example, Argon2 or bcrypt).
• Separation of each Agency's data within the database itself (row-level security).
• Images sent to Meta and to Metricool via signed links, not permanently public.
• Encrypted daily backups, with 30-day retention, and periodic restore tests.
• Access and administrative action logs kept for 12 months.
• Security updates applied within a reasonable time; firewall and SSH key access.

Annex II. Authorised sub-processors

List current as at 28 October 2026.

Not sub-processors (see clauses 5.5 and 5.6):