This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Customer”, acting as controller) and Imposted (“Imposted”, acting as processor). It governs our processing of personal data on your behalf and reflects the requirements of Article 28 of the GDPR.
“GDPR” means Regulation (EU) 2016/679. “Personal data”, “processing”, “controller”, “processor”, “data subject”, and “personal data breach” have the meanings given in the GDPR. “Customer Personal Data” means personal data Imposted processes on the Customer’s behalf in providing the service. “Sub-processor” means a third party engaged by Imposted to process Customer Personal Data.
The Customer is the controller (or a processor acting for another controller) of Customer Personal Data, and Imposted is the processor. Imposted will process Customer Personal Data only to provide the service and only on the Customer’s documented instructions, including those given through normal use of the product. If Imposted is required by law to process otherwise, it will inform the Customer first unless that law prohibits it.
The details required by Article 28(3) are set out in Annex A below.
The Customer provides general authorisation for Imposted to engage the sub-processors listed in Annex C. We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We will give the Customer reasonable notice of any intended addition or replacement of a sub-processor; the Customer may object on reasonable data-protection grounds, and if we can’t resolve the concern, the Customer may terminate the affected service.
Taking into account the nature of the processing, Imposted will assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil the Customer’s obligation to respond to requests from data subjects exercising their rights. Much of this is available directly in the product (editing profiles, exporting, and deleting workspace data). If we receive a request directly from a data subject, we will direct them to the Customer.
Imposted will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to us to help the Customer meet its own notification obligations.
On termination of the service, or on the Customer’s request, Imposted will delete Customer Personal Data within a reasonable period, unless retention is required by law. Deleting a workspace in the product permanently removes its connections, posts, schedules, and media; residual copies in backups are removed as backups rotate out.
Imposted will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates — on reasonable prior notice, no more than once per year (unless required by a supervisory authority), during business hours, and subject to confidentiality.
Imposted processes Customer Personal Data within the European Union. Where a sub-processor processes data outside the EU/EEA, such transfers are made under an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. This DPA takes effect when the Customer accepts the Terms and remains in force for as long as Imposted processes Customer Personal Data.
Subject matter: provision of the Imposted cross-posting and scheduling service.
Duration: for the term of the Customer’s use of the service, plus the deletion period in Section 8.
Nature and purpose: hosting, storing, formatting, scheduling, and transmitting the Customer’s content to the social and messaging platforms the Customer connects, and operating the Customer’s account and workspace.
Types of personal data: account identifiers (names, email addresses); authentication and connected-account credentials and identifiers; the content of posts, captions, and media (which may contain personal data the Customer chooses to include); and usage metadata.
Categories of data subjects: the Customer’s users and workspace members, and any individuals referenced in the content the Customer publishes.
| Sub-processor | Purpose | Location |
|---|---|---|
| Laravel Cloud (Laravel LLC), on Amazon Web Services | Application hosting and managed database | European Union |
| Amazon Web Services EMEA | File and media storage (S3) | European Union |
| PostHog (Hiberly Inc.) | Cookieless product analytics | European Union (Frankfurt) |
Connected social and messaging platforms that the Customer chooses to publish to (such as Slack) act as independent controllers of the data they receive, not as our sub-processors.
For any matter relating to this DPA, contact [email protected].