Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer and BA Solutions, LLC ("Gramdesk", "we"). It applies when we process personal data of the Customer's End users on the Customer's behalf and the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP) or another data protection law with similar requirements applies to that processing ("Data Protection Law"). The Customer accepts this DPA by accepting the Terms; no signature is needed. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

"End users" are the people who write to, comment on, or otherwise interact with an Instagram account the Customer connects, and anyone the Customer records as a contact. Terms such as "controller", "processor", "personal data breach" and "data subject" have the meanings given in the GDPR.

The Customer is the controller, and we are the processor, of the End-user data described in Annex I. The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis for it and for using AI features on it, giving End users the information the law requires, and the accuracy of the data it adds. The Customer will not instruct us to process special categories of data, and acknowledges that End users may send such data in messages on their own initiative.

We process End-user data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the Service — for example, which accounts it connects, which AI features it turns on and what it sends — unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it. We will tell the Customer if, in our opinion, an instruction infringes Data Protection Law.

The Customer also instructs us to carry out deletion requests that Meta forwards from Instagram users: such a request deletes that Instagram account's data in every workspace where it is connected, including the Customer's.

We do not sell End-user data, use it for advertising, build profiles of people from it, use it for surveillance, or use it for any purpose of our own.

US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, we act as the Customer's service provider or processor. We will not sell or share End-user data; retain, use or disclose it outside our direct business relationship with the Customer or for any purpose other than providing the Service; or combine it with personal data we receive from others, except as that law permits. We will comply with that law, give End-user data the protection it requires, and tell the Customer if we can no longer meet these obligations, so that the Customer can take reasonable steps to stop and remediate unauthorised use.

We ensure that the people we authorise to process End-user data are bound by confidentiality and access it only as needed to provide, support and secure the Service.

We implement the technical and organisational measures in Annex II, taking into account the state of the art, the cost of implementation and the risks of the processing. We may update them, provided the overall level of protection does not fall.

The Customer gives us general authorisation to engage subprocessors of End-user data. The current list is the first table on the Subprocessors page; the other providers listed there never receive End-user data, or receive it only because the Customer sends it to them (a Telegram chat it connects). We will announce a new subprocessor of End-user data there at least 30 days before it processes End-user data, except where a change is needed urgently to keep the Service running or secure, in which case we announce it as soon as we can. The Customer may object on reasonable data protection grounds by writing to support@gramdesk.io within that period; if we cannot reasonably accommodate the objection, the Customer may end the affected part of the Service and we will refund any prepaid fees for the remainder of the period, by bank transfer or as account credit. We impose on each subprocessor data protection obligations that offer at least the same level of protection as this DPA, and remain responsible for its performance.

Taking into account the nature of the processing, we will help the Customer respond to requests from End users exercising their rights — in particular by deleting the data of a connected account or a contact, and by providing a copy of data on request — and with data protection impact assessments and prior consultations, as far as they concern the Service. If an End user contacts us directly, we will pass the request to the Customer and not answer it ourselves, unless the law requires us to.

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting End-user data, with the information the Customer reasonably needs to meet its own obligations, as it becomes available, and we will take reasonable steps to contain it.

When the Customer disconnects an Instagram account, we permanently delete the data imported from it into that workspace. When the Customer's account is deleted, we delete End-user data within 30 days; copies in database backups are overwritten within a further 7 days. Before deletion, the Customer may ask at support@gramdesk.io for a copy of its data, which we provide within 30 days as a machine-readable JSON file. We keep data longer only where the law requires it.

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires. If that is not enough, the Customer may, once a year and on 30 days' notice, have an independent auditor bound by confidentiality inspect our relevant records, at the Customer's cost, in a way that does not disrupt the Service or expose other customers' data.

We are established in the United States, the Service is hosted in Sweden, and some subprocessors are in other countries (see the Subprocessors page). Where Data Protection Law restricts the transfer of End-user data to us or onward, the following are incorporated into this DPA by reference:

• the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 — Module Two (controller to processor), and Module Three (processor to processor) where the Customer is itself a processor — with: Clause 7 not included; Clause 9 option 2, with the notice period in § 6; Clause 11 optional language not included; Clause 17 option 1, the law of Ireland; Clause 18, the courts of Ireland; and Annexes I and II as set out below;
• for the UK, the International Data Transfer Addendum issued by the Information Commissioner, with Part 1 completed from this DPA and either party able to end it as its Section 19 allows;
• for Switzerland, the same Clauses, with the FADP as the applicable law where it governs the transfer, the Swiss Federal Data Protection and Information Commissioner as a competent authority, and "Member State" read to include Switzerland.

If a public authority asks us for End-user data, we will tell the Customer unless the law forbids it, challenge the request where we have reasonable grounds, and disclose no more than the request legally requires.

C. Competent supervisory authority

• If the Customer is established in the EU, the supervisory authority responsible for it under Clause 13(a).
• If it is not established in the EU but has appointed a representative under Article 27 of the GDPR, the supervisory authority of the Member State in which the representative is established.
• If it is not established in the EU and is not required to appoint a representative, the Irish Data Protection Commission.
• For transfers under the UK GDPR, the Information Commissioner's Office; under the FADP, the Swiss Federal Data Protection and Information Commissioner.

• Encryption in transit: TLS on every connection to the website, console and API.
• Encryption at rest: database storage and file storage encrypted by AWS.
• Instagram access tokens and payment card tokens encrypted in the database with Fernet (AES-128-CBC with HMAC-SHA256).
• Database in private network subnets, not reachable from the internet; separate application database role.
• Database credentials and other production secrets provided to the servers from AWS Secrets Manager.
• Hosting in AWS eu-north-1 (Stockholm); automated database backups kept 7 days.
• Role-based access inside each workspace; an activity log of actions in the workspace.
• Invitation secrets stored only as hashes; limits on repeated sign-in and code requests.
• Access tokens and full phone numbers kept out of logs; logs deleted after 30 days.
• Error monitoring configured not to send personal data by default; session recordings masked in the browser.
• Staff access limited to what is needed to run and support the Service.