Skip to content
AutoFeed

Data Processing Agreement

Last updated: 1 November 2026 · Version 1.0

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer that uses AutoFeed (the "Customer") and AG IT-Solutions, trade name AGITS, legal form, with registered office at registered office address and enterprise number enterprise number ("AGITS"). It applies automatically when the Customer accepts the Terms and fulfils the requirements of Article 28 of Regulation (EU) 2016/679 (the "GDPR").

1. Roles and scope

1.1 For personal data contained in Customer Content (as defined in the Terms) and data retrieved from the Customer's connected social media accounts, the Customer is the controller and AGITS is the processor.

1.2 For account, billing, security and website data, AGITS acts as an independent controller, as described in the Privacy Policy. This DPA does not apply to that processing.

1.3 Terms such as "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR.

1.4 If this DPA conflicts with the Terms, this DPA prevails as regards the processing of personal data.

2. Details of the processing

Subject matterProvision of AutoFeed, a social media planning, creation, publishing and reporting service
DurationFor the term of the Customer's use of the Service, plus the deletion periods in section 10
NatureStorage, hosting, organisation, structuring, retrieval, adaptation (e.g. image resizing, rendering into templates), AI-assisted generation and analysis, transmission to social platforms, consultation, and erasure
PurposeEnabling the Customer to plan, create, edit, store, schedule and publish social media content, collaborate in Workspaces, use AI features, and receive analytics on its connected Channels
Types of personal dataNames, usernames, email addresses and roles of Workspace Members; names, likenesses (photos, videos) and other personal data that appear in Customer Content; texts, captions and chat messages; account and page identifiers, names, usernames and profile picture URLs of connected Channels; aggregated engagement metrics (likes, comments, shares, saves, reach, views, follower counts); any other personal data the Customer chooses to upload
Special categoriesNot intended. The Customer shall not upload special categories of personal data (art. 9 GDPR) or data relating to criminal convictions (art. 10 GDPR) unless it has a valid legal basis and has assessed the risks
Categories of data subjectsThe Customer's employees, contractors and other Workspace Members; persons depicted or mentioned in Customer Content (e.g. customers, staff, models, partners); followers and audiences of connected Channels to the extent reflected in metrics; administrators of connected Channels

3. Obligations of AGITS

AGITS shall:

  1. process personal data only on the documented instructions of the Customer, including with regard to international transfers, unless required to do so by EU or Member State law; in that case AGITS informs the Customer before processing unless the law prohibits this. The Terms, this DPA and the Customer's use and configuration of the Service constitute the Customer's complete instructions;
  2. promptly inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law;
  3. ensure that persons authorised to process personal data are bound by confidentiality;
  4. implement the technical and organisational measures described in Annex 1;
  5. respect the conditions for engaging sub-processors in section 5;
  6. taking into account the nature of the processing, assist the Customer with appropriate measures in responding to data subject requests (arts. 12–22 GDPR). If AGITS receives a request directly, it forwards it to the Customer without undue delay and does not respond itself, except to refer the data subject to the Customer;
  7. assist the Customer in ensuring compliance with arts. 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to AGITS;
  8. make available all information necessary to demonstrate compliance with Article 28 GDPR and allow for audits as described in section 8;
  9. not use personal data in Customer Content for its own purposes, including training AI models, marketing or profiling.

4. Obligations of the Customer

The Customer:

  1. is responsible for the lawfulness of the processing, including having a valid legal basis and providing the required information to data subjects (for example, people depicted in images it uploads or publishes);
  2. ensures it has the rights and consents needed for Customer Content and for connecting its social media accounts;
  3. configures the Service appropriately (for example, managing Members and their roles) and keeps its account credentials secure;
  4. recognises that content it chooses to publish becomes public on third-party platforms (Meta), which act as independent controllers.

5. Sub-processors

5.1 The Customer gives AGITS general written authorisation to engage sub-processors. The current list is published at Sub-processors and is deemed approved.

5.2 AGITS informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance by email to the Workspace owner and by updating the list.

5.3 The Customer may object on reasonable grounds relating to data protection by emailing privacy@agits.be within that 30-day period. The parties will discuss the objection in good faith. If AGITS cannot reasonably accommodate the objection, the Customer may terminate the affected subscription before the change takes effect and receives a pro-rata refund of prepaid fees for the remaining period.

5.4 AGITS imposes on each sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains fully liable towards the Customer for the performance of its sub-processors' obligations.

6. International transfers

6.1 AGITS stores Customer Content primarily in the EU (AWS region eu-west-1, Ireland).

6.2 Where personal data is transferred to a country outside the EEA without an adequacy decision, AGITS ensures an appropriate safeguard under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, module 3 processor-to-processor where applicable) concluded with the relevant sub-processor, or certification under the EU-US Data Privacy Framework, supplemented by additional measures where needed.

6.3 Published media files are cached worldwide by the content delivery network so that social platforms can fetch them; the Customer instructs this by choosing to publish.

7. Personal data breaches

7.1 AGITS notifies the Customer without undue delay and in any case within 48 hours after becoming aware of a personal data breach affecting Customer Content.

7.2 The notification contains, as far as available: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases.

7.3 AGITS takes reasonable steps to contain and remedy the breach and assists the Customer with notifications to the supervisory authority and data subjects. Notification of a breach is not an acknowledgement of fault.

8. Audits

8.1 On request, AGITS provides the Customer with information reasonably necessary to demonstrate compliance with this DPA, such as a description of its security measures and available third-party certifications and reports of its sub-processors (for example AWS ISO 27001 and SOC 2 reports).

8.2 If that information is insufficient, or if a supervisory authority requires it, the Customer may conduct an audit, once per 12 months, with at least 30 days' written notice, during business hours, without disrupting operations, and subject to confidentiality. The audit may be performed by the Customer or an independent auditor bound by confidentiality who is not a competitor of AGITS.

8.3 Each party bears its own costs. Audits of AGITS's infrastructure providers are performed by relying on their certifications and reports.

9. Liability

The liability provisions of the Terms apply to this DPA, without prejudice to article 82 GDPR concerning liability towards data subjects.

10. Term, return and deletion

10.1 This DPA applies as long as AGITS processes personal data on behalf of the Customer.

10.2 Before termination, the Customer can download its media and request an export of its Workspace content in a structured format (see the Terms).

10.3 After deletion of a Workspace or Account, or at the end of the Service, AGITS deletes the Customer Content within 30 days. Copies in rotating backups are overwritten within 35 days. AGITS may retain data only if EU or Member State law requires storage, in which case it remains protected under this DPA.

10.4 On request, AGITS confirms the deletion in writing.

11. Governing law

This DPA is governed by Belgian law. The jurisdiction clause of the Terms applies.

12. Language

This DPA is available in English and Dutch. Both language versions are equally authoritative.

Annex 1 – Technical and organisational measures (TOMs)

Hosting and location

  • All primary data stored in Amazon Web Services, region eu-west-1 (Ireland), in data centres certified to ISO 27001, ISO 27017, ISO 27018 and SOC 2.
  • Serverless architecture (Lambda, API Gateway, DynamoDB, S3): no self-managed servers to patch.

Encryption

  • In transit: TLS 1.2 or higher for all connections between browsers, our API, sub-processors and social platforms. HTTP is redirected to HTTPS.
  • At rest: databases, file storage, backups and logs encrypted with AES-256 using AWS-managed encryption keys (AWS KMS).
  • Platform tokens: Instagram and Facebook access tokens are additionally encrypted at application level using Fernet (AES-128-CBC with HMAC-SHA256 authentication) with a key stored separately in a secrets store, and are decrypted only at the moment of use.
  • Passwords are never stored by AGITS; authentication is handled by Amazon Cognito, which stores salted password hashes.

Access control

  • Least-privilege IAM: each service component has its own role with only the permissions it needs.
  • Multi-factor authentication (MFA) mandatory for all administrative access to the cloud environment.
  • Administrative access limited to a small number of named AGITS staff who need it for their role, bound by confidentiality.
  • Customer data is logically separated per Workspace; every API request is checked for membership and role of the user in the Workspace.
  • Sign-in tokens with limited lifetime; rate limiting and abuse prevention at sign-up and sign-in.

Logging and monitoring

  • Access and activity logging of administrative actions on the cloud environment (AWS CloudTrail) and of application requests (CloudWatch).
  • Application logs retained for a maximum of 90 days and minimised to avoid storing content.
  • Automated alerts on errors and anomalies.

Availability and resilience

  • Backups: DynamoDB point-in-time recovery with a rolling 35-day window; S3 storage designed for 99.999999999% durability.
  • Infrastructure defined as code, allowing reproducible recovery.
  • Multi-availability-zone services within the EU region.

Secure development and operations

  • Code review and automated tests before deployment; dependencies kept up to date.
  • Secrets never stored in source code.
  • Separation of development and production environments.
  • Vulnerability reports handled via security@agits.be.

Data minimisation and deletion

  • Only data needed for the Service is collected; AI providers receive only the context required for the specific request.
  • AI provider used on a paid tier where prompts and outputs are not used for model training.
  • Deletion of Customer Content within 30 days after deletion of a Workspace or Account; backups overwritten within 35 days.

Organisation

  • Confidentiality obligations for all staff and contractors with access to data.
  • Incident response procedure, including breach notification to customers within 48 hours.
  • Periodic review of these measures and of sub-processors.

Related documents: Terms of Service · Privacy Policy · Sub-processors