Data Processing Agreement

1. Parties

This data processing agreement is made between:

• the agency that uses nomad social planner, as controller (“the agency”), identified by its account in the app; and
• Borbála Nagy, sole entrepreneur, trading as Nomad Creatives, Herman Ottó utca 4, 9024 Győr, Hungary, tax number 71769583-2-28, as processor (“we”, “us”). You can reach us at bori.nagy@gmail.com.

The agreement is concluded when an administrator of the agency accepts it on the agency's behalf, at sign-up or when the app asks for it. It sets out how we process personal data for the agency, as Article 28(3) of the General Data Protection Regulation (GDPR) requires. It applies alongside the Terms of Service. The personal data for which we are the controller ourselves is covered by the Privacy Policy.

2. Subject and duration

The subject of the processing is the personal data that the agency, its staff and its client users put into the app, processed so that we can provide the app to the agency.

The processing lasts as long as the agency has an account. An administrator can schedule the agency for deletion; 15 days later the agency and its data are deleted for good, as described under “Agency deletion” in section 5 of the Privacy Policy. Backups keep the data for up to 30 more days.

3. Nature and purpose of the processing

We store, organise and display the data, process images and videos so they can be played, and send the emails the app needs, such as invitations and notifications. The purpose is to let the agency plan social media posts with its clients and get them approved. We process the data for no other purpose.

4. Types of personal data and data subjects

Types of personal data

• names, email addresses, roles and optional profile photos of agency staff and client users;
• client work: plans, posts, captions, comments, approvals, images and videos, and any personal data in them;
• the activity log: who did what and when.

Data subjects

• the agency's staff (administrators and employees);
• the client users the agency invites;
• people who appear or are mentioned in the content, such as people shown in photos and videos.

5. Our obligations as processor

We:

• process the personal data only on the agency's documented instructions, including with regard to transfers outside the EU, unless EU or Hungarian law requires otherwise; in that case we tell the agency before processing, unless that law forbids it. This agreement, the Terms of Service, and what the agency's staff set and do in the app are the agency's instructions;
• tell the agency at once if, in our opinion, an instruction infringes the GDPR or other data protection law;
• ensure that the people authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and access the data only where this is needed to run, support or fix the app, or when the agency asks;
• take the security measures in section 6;
• engage sub-processors only as section 7 describes;
• help the agency answer requests from data subjects (section 8);
• taking into account the nature of the processing and the information available to us, help the agency meet its obligations under Articles 32 to 36 of the GDPR: security, notifying personal data breaches, data protection impact assessments and prior consultation with the authority;
• delete or return the data at the end of the processing (section 9);
• make information available and allow audits (section 10);
• notify personal data breaches (section 11).

6. Security

We protect the personal data with these measures:

• the data is stored in the European Union: the database with Railway in the Netherlands, and files in Cloudflare R2 under EU jurisdiction;
• connections to the app are encrypted (HTTPS);
• an agency's data can be reached only by its own staff, and client users reach only the clients the agency invited them to; what each person can do depends on their role;
• passwords and invitation links are stored only as hashes, and access tokens for connected services, such as Google Drive, are encrypted;
• repeated failed sign-in attempts are limited, and an account can be disabled at once, which signs the person out everywhere;
• the database is backed up daily, and each backup is kept for 30 days.

7. Sub-processors

The agency gives us general authorisation to engage the following sub-processors:

• Railway (Railway Corporation): hosting, database and server logs. Data is stored in its EU West region (Amsterdam, the Netherlands).
• Cloudflare R2 (Cloudflare, Inc.): storage of uploaded images and videos, under EU jurisdiction, so the files stay in the EU.
• Cloudflare Stream (Cloudflare, Inc.): processing and playing videos. It receives only the video file and an internal id, no account data. It runs on Cloudflare's global network.
• Cloudflare Turnstile (Cloudflare, Inc.): a bot check on the sign-up form, used only when an agency signs up. The check runs in the browser from Cloudflare; to confirm it, we send Cloudflare the check's token and the IP address of the person signing up.
• Resend (Resend, Inc.): sending emails, from its EU region (Ireland).
• Sentry (Functional Software, Inc.): error reports, stored in its EU region.
• Google (Google Ireland Limited and Google LLC): only when the agency's staff use Google Drive import, for the import and the Google file picker.

Each sub-processor is bound by a contract with data protection obligations that match this agreement, and we remain responsible to the agency for how it meets them.

Before we add or replace a sub-processor, we email the agency's administrators at least 30 days in advance. Within that time the agency can object on reasonable data protection grounds by writing to bori.nagy@gmail.com. If we cannot resolve the objection, the agency can end its use of the app by deleting its agency (section 9).

Where data is transferred to or accessed from outside the EU, the safeguards described in section 4 of the Privacy Policy apply: the European Commission's standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.

8. Requests from data subjects

The agency answers requests from its staff, its client users and other data subjects about the data it controls. We help it with appropriate technical and organisational measures: staff can correct and delete content in the app, administrators can delete accounts, and on request we provide a copy of a person's data. If a data subject writes to us about data the agency controls, we tell the agency without undue delay and act on its instructions.

9. End of the processing

When the agency's account ends, we delete the personal data we process for it, unless EU or Hungarian law requires us to keep it:

• An administrator schedules the agency for deletion in the app. 15 days later the agency is deleted for good with its clients, plans, posts, comments and files, the activity log, invitations and staff accounts. Until then any administrator can cancel the deletion.
• A client user whose only agency this was has their account anonymised as “Deleted user”; a client user who also works with another agency keeps their account and that agency.
• Backups keep the data for up to 30 more days.

Before the deletion, the agency can take its data back: staff can download the original of each image and video and export plans as PDF or PowerPoint, and the agency can ask us at bori.nagy@gmail.com for a copy of a person's data.

10. Information and audits

We make available to the agency the information needed to show that we meet our obligations under Article 28 of the GDPR, including this agreement, the Privacy Policy and a description of our security measures. On reasonable request and with reasonable notice, we allow and contribute to audits, including inspections, by the agency or by an auditor it mandates who is bound by confidentiality. Requests go to bori.nagy@gmail.com.

11. Personal data breaches

If we become aware of a personal data breach affecting the agency's data, we notify the agency's administrators by email without undue delay and at most 48 hours after becoming aware of it.

We tell them what we know about the nature of the breach, the data and people concerned, its likely consequences, and the measures taken or proposed, and we send further details as we learn them. We help the agency notify the authority and the people concerned where it has to.

12. Changes to this agreement

The date of the current version is shown at the top of this page. If we change this agreement materially, the agency's administrators are asked to accept the new version the next time they use the app. Changes of sub-processors follow section 7.

13. Language

This agreement is available in Hungarian and English. If the two differ, the Hungarian version prevails.