Appendix 1 to the Terms — Data Processing Agreement (DPA)

Entered into under Article 28 of Regulation (EU) 2016/679 ("GDPR") between the Customer ("Controller") and OUTLINE SASU, operator of Socialoop ("Processor"). Where the Customer is a Manager acting for their own clients, the Manager is itself a processor for those clients and OUTLINE is its sub-processor; the Manager undertakes to flow down equivalent obligations in its contracts with its clients.

1. Description of processing

2. Instructions

The Processor processes data only on the Controller's documented instructions: the Terms, this DPA, and the choices made in the service (content sources, publishing mode, approvals, corrections). It informs the Controller if an instruction appears to infringe the GDPR.

3. Confidentiality

People authorised to process the data (OUTLINE staff, editors) are bound by confidentiality and access it only to the extent necessary.

4. Security

The Processor implements the measures in Annex A and keeps them up to date with the state of the art.

5. Sub-processors

The Controller gives general authorisation for the sub-processors listed in Annex B. The Processor informs the Customer of any addition or replacement at least 30 days in advance (in the bot or by email); the Customer may object on reasonable data-protection grounds and, failing agreement, terminate without penalty. The Processor imposes equivalent obligations on each sub-processor and remains liable for their performance.

6. Transfers outside the EU

Transfers outside the European Economic Area rely on an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or on the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented by additional measures where needed.

7. Assistance

The Processor assists the Controller, as far as possible, in responding to data subject requests (including by deleting a piece of content or a post on request via the bot), ensuring security, carrying out a data protection impact assessment where required and consulting the supervisory authority. Any request received directly from a data subject is forwarded to the Customer without delay.

8. Personal data breach

The Processor notifies the Controller of any personal data breach within 48 hours of becoming aware of it, with the available information (nature, categories and approximate number of data subjects, likely consequences, measures taken or proposed).

9. End of processing

Working copies are deleted according to the periods in the Privacy Policy (30 days after publishing, 60 days for unused material). When the contract ends, the Processor deletes the data within 30 days at the latest, unless the law requires retention; on request made before the end of the contract, it provides the Customer with a copy of the produced content. Originals always remain in the Customer's storage.

10. Audit

The Processor makes available the information needed to demonstrate compliance with this DPA. The Customer may carry out an audit at its own expense once a year, with 30 days' notice, without access to other customers' data; a written questionnaire is the preferred first step.

11. Liability

The Controller warrants having a legal basis for the processing entrusted and having informed data subjects, in particular identifiable people in images. Each party's liability is governed by GDPR Article 82 and Section 9 of the Terms.

Annex A — Security measures

• Server and database in the European Union; administrator access by SSH key only; firewall opening only necessary ports; automatic security updates.
• Social media access tokens encrypted at rest; secrets kept out of source code.
• Encryption in transit (HTTPS/TLS) for API calls and service pages.
• Plan pages reachable only through long, random, expiring links; temporary image links deleted after publishing.
• Technical logs without names or content; kept 30 days.
• Automatic deletion of working copies according to the agreed periods.
• Daily backups kept for at most 30 days; monthly restore test.
• Staff access on a need-to-know basis; confidentiality undertaking.
• Automatic administrator alert on publishing errors or incidents.

Annex B — Sub-processors