Data Processing Agreement (DPA)
Under Article 28 GDPR · Social Media Director — Virtual Director Kft.
These terms (the Data Processing Agreement) are concluded between the User (Tenant) as data controller and Virtual Director Kft. (Social Media Director) as data processor, with respect to the personal data that the User processes through the system about its own audience, about individuals appearing in uploaded images, and about persons associated with its connected social accounts. The DPA is an inseparable part of the Terms of Service.
1. Subject and duration of the processing
The subject of the processing is the processing of data entered and managed by the User for the purpose of providing the Social Media Director service, for the duration of the User’s subscription.
2. Nature and purpose of the processing, data subjects and data
- Purpose: creating, approving, scheduling and publishing AI social media posts on behalf of the User to the connected Facebook Pages, Instagram accounts and LinkedIn Pages, and analysing performance.
- Data subjects: the User’s audience/followers, identifiable persons appearing in uploaded images, and persons associated with the social accounts managed by the User.
- Categories of data: personal data appearing in uploaded images and texts (including a likeness), the — typically aggregated — performance and engagement data returned from the connected platforms’ APIs, and technical data related to publishing.
3. Obligations of the data processor
- processes personal data only on the User’s documented instructions;
- ensures the confidentiality of persons with access;
- applies the security measures under Article 32 GDPR (isolation, TLS, password hashing, encrypted storage of access tokens, encrypted daily backups, access restriction);
- notifies the User without undue delay in the event of a personal data breach;
- assists the User in responding to data-subject requests and in meeting compliance obligations;
- on termination of the agreement, at the User’s choice deletes or returns the data (within the limits of statutory retention obligations);
- allows for and contributes to audits conducted by the User or a mandated auditor.
4. Sub-processors
The User grants a general authorisation to use the sub-processors listed below. When adding or replacing a sub-processor, the Service Provider informs the User in advance, and the User may object on reasonable grounds.
| Sub-processor | Activity | Location |
|---|---|---|
| RackForest Zrt. | Server hosting | EU / Hungary |
| OpenAI, L.L.C. / OpenAI Ireland Ltd. | AI text and image generation | EU / USA (SCC) |
| Meta Platforms Ireland Ltd. | Publishing and analytics (Graph API) | EU / USA (DPF) |
| LinkedIn Ireland Unlimited Company (Microsoft) | Publishing and analytics (Marketing / Community Management API) | EU / USA (DPF) |
| Cloudflare, Inc. | CDN, R2 image storage | USA (DPF) |
| Microsoft Ireland Operations Ltd. | Transactional e-mail | EU |
| Google LLC | Encrypted backup | USA (DPF) |
The full, up-to-date list is available in the Privacy Policy.
5. Liability
The parties are liable in accordance with the GDPR and the Terms of Service concluded between them. The User warrants that it has an appropriate legal basis for the processing of the data it enters and manages — including the data of persons appearing in uploaded images.