Data Processing Agreement (DPA)

1. Parties and nature of this Annex

This Data Processing Agreement (the “DPA”) forms an integral part of the Terms of service (the “Contract”) entered into between:

The Interactive Studio, S.L., tax ID (CIF) B85428746, registered office at C/ Teide, 4, oficina 0.3, 28703 San Sebastián de los Reyes (Madrid, Spain), registered in the Madrid Commercial Registry, Volume 25584, Folio 88, Section 8, Sheet M-461080, 1st entry (“The Interactive Studio” or the “Processor”), and

The agency, business or organization identified when the account was registered (the “Customer” or the “Controller”).

This DPA governs the processing of personal data that The Interactive Studio carries out on the Customer’s behalf in providing the Fountant service, under article 28 of Regulation (EU) 2016/679 (“GDPR”).

Electronic acceptance. This DPA is accepted electronically together with the Contract. The person accepting it states that they are authorized to bind the Customer.

2. Roles of the parties

The Customer is the controller of the personal data contained in the content it uploads, creates or imports and in the social accounts it connects, including third-party data (for example, authors of comments and messages or people appearing in images and videos). It determines the purposes and essential means of the processing, including turning on features such as the inbox or AI.

The Interactive Studio is the processor: it processes that data solely on the Customer’s behalf, under this DPA and the Customer’s documented instructions.

For the avoidance of doubt: The Interactive Studio acts as controller (not processor) only for the processing described in its Privacy policy, in particular user accounts, billing, measurement and data about visitors to its website. That processing is outside this DPA.

3. Description of the processing

The detailed description (subject matter, duration, nature, purposes, categories of data subjects and types of data) is in Annex I, which forms part of this DPA.

4. Controller’s instructions

4.1. The Interactive Studio will process personal data only on the Customer’s documented instructions, including those given through its members’ configuration and use of the platform, and those in this DPA and the Contract.

4.2. If The Interactive Studio considers that an instruction infringes the GDPR or other applicable data protection law, it will inform the Customer immediately and may suspend it until it is clarified or changed.

4.3. The Interactive Studio may process the data where required by Union or Member State law; in that case it will inform the Customer of that legal requirement before processing, unless the law prohibits it on grounds of public interest.

4.4. The Interactive Studio will not use personal data processed on the Customer’s behalf for its own purposes, including training artificial intelligence models, profiling for commercial purposes or disclosure to third parties other than authorized subprocessors. AI memory and context are kept isolated per organization and brand.

5. Confidentiality

The Interactive Studio ensures that people authorized to process personal data have committed to confidentiality or are under a statutory obligation of confidentiality, and that their access is limited to what their role requires. This obligation survives the end of the Contract.

6. Security

6.1. The Interactive Studio implements technical and organizational measures appropriate to the risk under art. 32 GDPR, described in Annex II. Annex II may be updated to improve security, but no update may materially reduce the level of protection.

6.2. The Customer is responsible for managing its members’ access, for assigning roles and permissions within its organization and for the social accounts it connects.

7. Subprocessors

7.1. The Customer gives a general authorization for The Interactive Studio to use the subprocessors listed in Annex III (also available and kept up to date at fountant.com/en/legal/subprocessors).

7.2. The Interactive Studio will inform the Customer at least 30 days in advance of any addition or replacement of subprocessors, by email to the administrators and by updating the published list. The Customer may object on reasonable, justified data protection grounds; if there is no reasonable solution and the objection stands, the Customer may terminate the Contract for the affected service without penalty, with a pro-rata refund of prepaid amounts.

7.3. The Interactive Studio will contractually impose on each subprocessor data protection obligations equivalent to those in this DPA, and is liable to the Customer for its subprocessors’ compliance.

7.4. The social platforms to which the Customer connects its accounts and on which it publishes (Meta, Google/YouTube) are not subprocessors: they receive content by the Customer’s decision and process it as controllers under their own terms.

8. Assistance to the Controller and data subject rights

8.1. Data subjects must address the exercise of their rights (arts. 15 to 22 GDPR) to the Customer. If The Interactive Studio receives a request directly, it will pass it on to the Customer without undue delay and within 5 business days at the latest, without answering it itself unless the Customer instructs it to.

8.2. The Interactive Studio will assist the Customer, taking into account the nature of the processing, through the platform’s features (viewing, editing and deleting content, disconnecting accounts) and, where these are not enough, through reasonable assistance at the Customer’s request.

8.3. The Interactive Studio will assist the Customer, to the extent reasonably applicable to it as processor, in complying with arts. 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation), providing the information available about the processing it carries out.

9. Personal data breaches

9.1. The Interactive Studio will notify the Customer without undue delay, and at the latest within 72 hours of becoming aware of a security breach affecting personal data processed on the Customer’s behalf, by email to the organization’s administrators.

9.2. The notice will include, as far as available: the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases.

9.3. Notifying the supervisory authority and, where applicable, data subjects is the Customer’s responsibility as controller. The Interactive Studio will provide reasonable assistance and will internally document all breaches under art. 33.5 GDPR.

10. Artificial intelligence features

10.1. AI content generation and adaptation is turned on by the Customer’s decision and uses its plan’s credits. Output is a suggestion that a Customer member reviews before using it; the platform does not publish or reply with anything substantive automatically.

10.2. Model providers (Annex III) process context and instructions only to generate the response and do not use them to train models, under their terms.

11. Data location and international transfers

11.1. Data is hosted mainly in the European Union, as detailed in Annex III.

11.2. Certain subprocessors may involve international transfers (e.g. email delivery, bot protection or AI models), relying on an adequacy decision (including the EU-US Data Privacy Framework) or on the European Commission’s standard contractual clauses, as detailed in Annex III.

11.3. If the Customer is established outside the European Economic Area, the transfer of data from The Interactive Studio to the Customer relies on the Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Four (processor to controller), incorporated by reference. Options chosen: clause 17 (governing law), Spanish law; clause 18 (forum), the courts of Madrid.

12. End of the service: return and deletion

12.1. On termination of the Contract, the Customer will have an export period of 90 days to obtain the data processed on its behalf in a structured, commonly used format, through the platform or, at the Customer’s request, through a secure channel.

12.2. On termination of the Contract or when a social account is disconnected, The Interactive Studio revokes or deletes that account’s access tokens.

12.3. Once the export period ends, The Interactive Studio will delete all personal data processed on the Customer’s behalf, except data it must keep under Union or Member State law, and will issue a deletion certificate at the Customer’s request.

13. Audits

13.1. The Interactive Studio will make available to the Customer the information needed to demonstrate compliance with this DPA, including documentation of its security measures.

13.2. The Customer may carry out, itself or through an independent auditor who is not a competitor of The Interactive Studio, one audit per calendar year, with at least 30 days’ notice, during business hours, without access to other customers’ data and subject to a confidentiality agreement. Costs are borne by the Customer, unless the audit reveals material breaches of this DPA, in which case The Interactive Studio will bear reasonable costs. The Customer may also audit after a security breach affecting its data.

14. Liability

Each party is liable for damage it causes by breaching the obligations the GDPR specifically places on its role (art. 82 GDPR). The Contract’s limitation of liability applies to this DPA except where it cannot legally be waived, including liability to data subjects under art. 82 GDPR.

15. Term and governing law

This DPA takes effect on acceptance and remains in force while The Interactive Studio processes personal data on the Customer’s behalf. It is governed by Spanish law and, where applicable, by the GDPR. In case of conflict between this DPA and the Contract on data protection matters, this DPA prevails.

Annex I — Description of the processing

Subject matter: provision of the Fountant service for planning, preparing, approving and publishing social media content, an inbox for comments and messages, and AI content generation and adaptation.

Duration: the term of the Contract, plus the export period in clause 12.

Nature and purposes: collection, import, recording, structuring, storage, consultation, adaptation, disclosure to the platforms the Customer chooses, and deletion of data, for the purposes of: (i) preparing, approving, scheduling and publishing content on connected accounts; (ii) importing those accounts’ history; (iii) receiving and replying to comments and messages, when the Customer turns on the inbox; (iv) generating and adapting content with AI from the brand context; (v) storing the Customer’s media.

Categories of data subjects: people who interact with the Customer’s accounts (authors of comments and messages, followers); people who appear or are mentioned in the Customer’s content; Customer members as authors or reviewers of content.

Types of data: social account identifiers and public names; access tokens of connected accounts (encrypted); posts, copy, images and videos and their metadata; imported history; comments and messages, with their author’s identifier and public name, content and date; brand context and AI instructions; technical usage metadata.

Data the platform does not seek to process: special categories of data. If the Customer’s content or the messages it receives contain them, the Customer is responsible for their legal basis.

Annex II — Security measures

Encryption. Data in transit is encrypted (TLS) in all communications. Access tokens of connected social accounts are stored encrypted at application level.

Isolation and access control. The organization is the isolation boundary, and within it brands and memberships limit access. Isolation is enforced in the database (row-level security) and in the application, and is covered by automated cross-access tests. Role-based access control with least privilege. Authentication through one-time email codes or sign-in with Google, Microsoft or Apple; revocable sessions.

Files. Object storage is private by default; downloads are authorized for a limited time.

Traceability. Audit log of relevant account actions and technical security logs.

Continuity. Encrypted backups of the database and files are being put in place; their status is reported to any Customer who asks.

Secure development. Separate development and production environments; tests and demos use fictitious data. Secrets managed outside source code and every change reviewed before deployment.

Staff access. The Interactive Studio staff access environments with named credentials on a least-privilege basis; confidentiality obligation under clause 5.

Annex III — Authorized subprocessors

Providers for processing The Interactive Studio controls (payments with Stripe, product analytics with PostHog, measurement with Meta and sign-in with Google, Microsoft or Apple) are not subprocessors of Customer content and are listed in the Privacy policy and the public provider list. Changes with 30 days’ notice under clause 7.