Data Processing Addendum.

This Data Processing Addendum (“DPA”) forms part of the OutPost Terms between Shanie Martin trading as OutPost (“OutPost”) and the customer using OutPost (“Customer”). It applies where OutPost processes personal data on the Customer’s behalf, for example personal data in uploaded material, drafts or publishing instructions.

For that processing, the Customer is controller and OutPost is processor. OutPost remains controller for separate activities it determines, including account administration, billing, security and its own service analytics.

OutPost processes Customer Personal Data only on documented instructions unless UK law requires otherwise. The Terms, the Customer’s configuration and use of OutPost, and specific support requests are documented instructions. OutPost will inform the Customer if it believes an instruction infringes applicable data-protection law.

• Purpose: generating, storing, managing, analysing and publishing social-media material as directed.
• Duration: the service period followed by the deletion process in the Privacy Policy.
• People: Customer users and people included in Customer content, media, instructions or connected accounts.
• Information: names, handles, photographs, video, audio, correspondence, social-account information and other personal data supplied by the Customer.
• Special-category data: not intentionally required and should not be supplied without a lawful reason and clear instruction.

OutPost ensures authorised people are bound by confidentiality and access data only as necessary. Proportionate measures include access controls, tenant separation, encryption in transit, restricted administration, private storage, signed links, authentication controls, backups and incident procedures.

The Customer gives general written authorisation for OutPost to use subprocessors needed to provide the service. Current core subprocessors are Supabase, Vercel, Cloudflare, Anthropic, Inngest, Zernio and Resend. OutPost requires subprocessors to protect Customer Personal Data under written terms that provide no less protection than this DPA, remains responsible for their processing on its behalf, and will give reasonable notice of a material new subprocessor so the Customer may object on reasonable data-protection grounds.

A social platform selected as a publishing destination processes the published material under its own terms.

Where Customer Personal Data is transferred outside the UK, OutPost uses a lawful route such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to approved Standard Contractual Clauses, with supplementary measures where appropriate.

Taking account of the processing and information available, OutPost will provide reasonable assistance with individual rights, security obligations, breach assessments, data-protection impact assessments and regulatory consultation. OutPost will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data.

At the Customer’s choice, OutPost will delete or return Customer Personal Data at the end of the service and delete existing copies, unless applicable law requires limited retention. Data in protected backups will be isolated from normal use and removed through the applicable backup-expiry cycle.

OutPost will provide information reasonably necessary to demonstrate compliance. If that is insufficient, the Customer may request a reasonable, proportionate audit no more than annually or after a relevant breach. Audits must protect other customers, security and confidentiality and should use existing evidence before requiring inspection.

The Customer is responsible for the lawfulness, accuracy and transparency of the personal data and instructions it provides, and must not use OutPost to process personal data unlawfully.

If this DPA conflicts with the Terms about Customer Personal Data, this DPA takes priority. Questions or data-protection notices may be sent to hello@outpostsocial.ai.