1. Introduction and Scope
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Customer,” “you,” or “your”) and Expertion Technology OÜ, a company registered in Estonia (“Company,” “we,” “us,” or “our”), for your use of the AgentMio platform (the “Service”). It applies to the extent we process personal data on your behalf as a processor under the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
This DPA does not apply where we act as a controller of personal data, such as for our own account administration, billing, security, and marketing. Those activities are described in our Privacy Policy.
2. Definitions
The terms “controller,” “processor,” “data subject,” “personal data,” “personal data breach,” “processing,” and “supervisory authority” have the meanings given in the GDPR. “Customer Personal Data” means personal data that we process on your behalf in providing the Service. “Sub-processor” means a third party that we engage to process Customer Personal Data.
3. Roles of the Parties
You are the controller of Customer Personal Data, and we are your processor. You are responsible for having a lawful basis to process Customer Personal Data, for the instructions you give us, and for the content you create, upload, and publish through the Service.
If you use the Service on behalf of your own clients, you may act as a processor for them. In that case, you confirm that you are authorized to give us the instructions in this DPA, and we act as your sub-processor.
4. Details of Processing
- Subject matter: providing the Service to you, as described in the Terms of Service.
- Duration: the period your account is active, plus the period needed to delete or return the data under section 13.
- Nature and purpose: hosting and storing data; generating social media content and AI assistant replies; scheduling and publishing posts; reading comments and publishing the replies you approve; reading metrics and showing analytics; and sending service emails such as verification, weekly stats, reconnect notices, and payment-failed notices.
- Categories of data subjects: your team members who use the Service, and people whose personal data appears in the content, comments, and metrics of the social media accounts you connect.
- Types of personal data: name, email address, company name, and job title of your users; identifiers and profile information of connected social media accounts; encrypted access tokens; content you create or upload; comments and replies, including the names and handles of comment authors; post metrics; and usage and device data.
- Special categories of data: the Service is not designed to process special categories of personal data. You agree not to submit them intentionally.
5. Our Obligations as Processor
We will:
- process Customer Personal Data only on your documented instructions, which are this DPA, the Terms of Service, and your use of the Service’s features, unless EU or Member State law requires otherwise, in which case we will inform you before processing unless the law prohibits it;
- tell you if we believe an instruction infringes the GDPR;
- ensure that the people we authorize to process Customer Personal Data are bound by confidentiality;
- not sell Customer Personal Data, and not use it for third-party advertising.
6. Your Instructions and Human Approval
The Service uses AI to suggest content and comment replies. Content and replies that the Service creates are not published to a connected platform until a person on your account approves them. Two exceptions are under your control: content you send through the API is your own and can be published without approval, and you can set a data feed to approve its posts automatically. You are responsible for reviewing and approving content and replies before they are published, and for content you publish through the API or through a data feed set to approve automatically.
7. Security Measures
We implement appropriate technical and organizational measures to protect Customer Personal Data, as required by Article 32 GDPR. These measures include:
- encryption of data in transit and at rest;
- storage of social media access tokens in encrypted form, so that they are not exposed in plaintext;
- access controls that limit access to Customer Personal Data to people who need it;
- hosting in the European Union;
- bot protection on public forms.
You are responsible for keeping your own login credentials secure and for the access you grant to your team members. See also our Security page.
8. Sub-processors
You give us general authorization to engage Sub-processors. We impose data protection terms on each Sub-processor that offer a level of protection no lower than this DPA, and we remain responsible for their performance. Our current Sub-processors are:
- Anthropic: social media content generation and AI assistant
- OpenAI: social media content generation and AI assistant
- Google: social media content generation
- Brevo: transactional and lifecycle email, such as verification, weekly stats, reconnect notices, and payment-failed notices
- Paddle: billing, as Merchant of Record
- DigitalOcean: hosting in the EU
- Cloudflare: Turnstile bot check on forms, plus CDN and DNS
- LinkedIn, X/Twitter, Meta (Instagram, Graph API), and TikTok: publishing, comments, metrics, and deleting posts on the accounts you connect
The social media platforms in the last item process data because you connect your accounts to them and instruct us to publish, read, and delete content there. Their own terms and privacy policies also apply.
We will inform you of any intended addition or replacement of a Sub-processor by email or by a notice on the Service at least 30 days before it starts processing Customer Personal Data. You may object on reasonable data protection grounds by writing to [email protected] within that period. If we cannot resolve your objection, you may stop using the affected part of the Service or close your account.
9. International Data Transfers
Some Sub-processors may process Customer Personal Data outside the European Economic Area. Where they do, we ensure that an appropriate transfer mechanism is in place, such as an adequacy decision of the European Commission or the Standard Contractual Clauses approved by the European Commission. You may request a copy of the safeguards by contacting us.
10. Assistance
Taking into account the nature of the processing, we will help you respond to requests from data subjects to exercise their rights under the GDPR, through the features of the Service where possible. If we receive such a request directly about Customer Personal Data, we will forward it to you and will not respond unless you instruct us to.
We will also give you reasonable help with your obligations on security, personal data breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the information available to us.
11. Personal Data Breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose to take. We will keep you informed as we learn more.
12. Audits and Information
We will make available to you the information necessary to demonstrate our compliance with this DPA and Article 28 GDPR. We will allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice and in a way that does not disrupt our operations or compromise the security of other customers’ data.
13. Return and Deletion of Data
You can export or delete your content through the Service at any time. When you delete your account, we will delete or anonymize Customer Personal Data within 30 days, except where EU or Member State law requires us to keep certain data, such as for tax and accounting purposes. Disconnecting a social media account revokes the access tokens we hold for it.
14. Liability
The limitations and exclusions of liability in the Terms of Service apply to this DPA, to the extent permitted by law. Nothing in this DPA limits the rights of data subjects or the powers of supervisory authorities under the GDPR.
15. Term, Changes, and Governing Law
This DPA applies from the day you start using the Service and lasts as long as we process Customer Personal Data on your behalf. We may update this DPA to reflect changes in law or in the Service. If we make material changes, we will notify you by email or by a notice on the Service at least 30 days before they take effect.
If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. This DPA is governed by the laws of the Republic of Estonia, and section 14 of the Terms of Service applies to disputes.
16. Contact Us
If you have questions about this DPA, or want a signed copy for your records, please contact us at:
Expertion Technology OÜ
Data Protection Contact
Email: [email protected]
Website: agentmio.com