Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the dmconverts Terms of Service ("Terms") between Flowstart Kft. ("we", "us") and the business that accepted the Terms ("Customer", "you"). You accept it together with the Terms, when you create an account or use the Service. It applies whenever we process personal data on your behalf. Where it conflicts with the Terms on data protection, this DPA wins.

Terms such as "controller", "processor", "personal data", "processing" and "personal data breach" have the meaning given in the EU General Data Protection Regulation (GDPR).

1. Roles

You are the controller of the personal data of the people who comment on or message your Instagram account, and of the order data your webshop sends us ("Customer Personal Data"). We process it as your processor.

For your own account, team members and billing we are the controller. Our Privacy Policy covers that processing, and this DPA does not.

2. What we process, and why

Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the people concerned.

3. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA and the settings you make in the Service, such as campaign rules, message texts, coupon pools and contact deletions. If EU or member state law requires other processing, we tell you before we do it, unless that law forbids telling you.

If we think an instruction breaks the GDPR or other data protection law, we tell you and may hold that instruction until you confirm or change it.

4. Your duties

You are responsible for:

• having a valid legal basis for the processing, including the commenters' consent where it is needed;
• informing commenters, at least through the privacy link every campaign must include;
• giving only lawful instructions;
• not running campaigns that ask commenters for special categories of data, such as health, religion or political views, or for data of children.

5. Confidentiality

Only people who need it to run the Service get access to Customer Personal Data, and each of them is bound to confidentiality by contract or by law.

6. Security

We keep the technical and organisational measures in Annex 2 and review them when the Service or the risks change. We may replace a measure with one that protects at least as well.

7. Sub-processors

You authorise us to use the sub-processors listed in Annex 3.

Before we add or replace a sub-processor that will process Customer Personal Data, we email the owner of your account at least 30 days in advance. You may object in writing within that period, on reasonable data protection grounds. If we cannot resolve the objection, you may terminate the affected subscription before the change takes effect, and we refund the fees you paid in advance for the period after termination.

We give each sub-processor data protection duties no weaker than those in this DPA. We remain liable to you for their work.

8. Transfers outside the EEA

Where a sub-processor processes Customer Personal Data outside the European Economic Area, the transfer relies on an adequacy decision (for example the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

9. Helping you

When a commenter exercises a GDPR right, you can act in the Service yourself. You can delete a contact, export contacts and orders as CSV, and the opt-out keywords stop all messages to that person. If a request reaches us directly, we forward it to you without undue delay and do not answer it ourselves unless you ask us to.

We also help you, as far as the information we hold allows, with security, breach notifications, data protection impact assessments and prior consultations with a supervisory authority (GDPR Articles 32 to 36). We may charge for help that goes beyond what the Service does on its own, at a price we agree with you in advance.

10. Personal data breaches

If we become aware of a personal data breach that affects Customer Personal Data, we notify you without undue delay, and at the latest within 48 hours. The notice describes what happened, the data and the people affected, the likely consequences and the steps we have taken or propose. If we do not have all the facts yet, we send what we have and add the rest as we learn it.

11. Deletion at the end

When the Terms end, we delete Customer Personal Data within 30 days. You can export your contacts and orders as CSV before that.

We keep only what law or the protection of commenters requires, as listed in the retention table of our Privacy Policy:

• the opt-out record (a keyed one-way hash), so that a person who opted out is never messaged again;
• the records of Meta deletion requests, which prove the erasure;
• invoices and billing records for the period Hungarian accounting law requires.

12. Audits

On request we give you the information you need to check that we keep this DPA, normally as written answers and documents. If that is not enough, or a supervisory authority requires it, you or an independent auditor bound to confidentiality may audit us once a year, with 30 days' written notice, during business hours and at your own cost. Audits must not give access to other customers' data.

13. Liability and term

The limitations of liability in the Terms also apply to this DPA, as far as the GDPR allows. This DPA lasts as long as we process Customer Personal Data for you.

We may change this DPA when the law, a supervisory authority or a change of the Service requires it, with the same notice as a change of the Terms. A change may not lower the protection of Customer Personal Data.

Annex 1. Details of the processing

Annex 2. Technical and organisational measures

• We encrypt Instagram access tokens and webshop credentials at rest with AES-256-GCM.
• All traffic to and from the Service uses HTTPS.
• We accept webhooks from Meta and Stripe only with a valid signature.
• The database separates each customer's data by organisation. On every request the app checks that the signed-in member belongs to the organisation whose data is asked for, and members have roles within their organisation.
• Click logs store IP addresses only as a hash. An opt-out record that outlives an erasure keeps only a keyed one-way hash of the IGSID.
• We delete raw webhook payloads after 14 days.
• The background job service (Inngest) gets identifiers only, never message text, names or email addresses.
• We scrub server error reports before they reach Sentry. They carry no message text, tokens, request bodies, cookies or IP addresses. Browser session replays mask all text and block all media.
• The application runs in the EU (Frankfurt), and the database is stored there too.
• Only the people who operate the Service can access production systems.

Annex 3. Sub-processors

These sub-processors process Customer Personal Data. Our Privacy Policy lists every provider we use, including those that only process our own customer and billing data (such as Stripe and Resend).

Meta (Instagram) and your webshop platform are not our sub-processors. You use them under your own agreements with them, and they send us data at your request.