Data Processing Addendum

This Data Processing Addendum (DPA) applies when GSAM Solution LLC (Processor, we) processes personal data on behalf of the Customer (Controller, you) in providing the Service, and that processing is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), US state privacy laws or similar laws (together Data Protection Laws).

Where you act for a client (as an agency), you confirm that you have the client's authority, and we act as your sub-processor.

We are a controller, not a processor, for account and billing data, security logs and how we run and improve the Service; our Privacy Policy covers that.

• Subject matter and purpose: providing the Service: analysing your brand material, planning and creating content, approvals and review links, reports, support and security.
• Duration: for as long as you use the Service, then until deletion under section 9.
• Nature: collection, storage, analysis (including by AI models), editing and transformation, transmission to subprocessors, display and deletion.
• Data subjects: your team members, your clients and their approvers, your customers and other people who appear in, or are named in, your material, website or uploads.
• Personal data: names, email addresses, roles, images, video and voice recordings, and any personal data contained in your uploads, website content or notes.
• Special categories: none intended. Do not upload them unless necessary and lawful.

• We process personal data only on your documented instructions, which are these Terms, this DPA and your use and settings of the Service, unless the law requires otherwise (we will tell you first if the law allows). We will tell you if we think an instruction breaks Data Protection Laws.
• Everyone we authorise to process it is bound by confidentiality.
• We apply the technical and organisational measures in section 6.
• We help you, taking into account the nature of the processing, to respond to requests from data subjects, and with security, breach notification, data protection impact assessments and consultations with authorities.
• We do not sell personal data, and we do not use it for our own purposes beyond providing and securing the Service.

You give us general authorisation to use the subprocessors listed in the Privacy Policy. We impose data protection terms on each that protect the data at least as well as this DPA, and we remain responsible for their performance.

We will announce a new or replacement subprocessor at least 14 days in advance by updating the list and emailing account owners. You may object on reasonable data protection grounds within that time. If we cannot address the objection, you may cancel the affected package and receive a refund of the unused prepaid part.

Our database is hosted in the European Union (Frankfurt, Germany). Some subprocessors, and GSAM Solution LLC itself, are in the United States or other countries.

For transfers of personal data from the EEA to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable: Clause 7 (docking) applies; Clause 9 option 2 (general authorisation, with the notice period in section 4); Clause 11 optional language does not apply; Clause 17 and Clause 18: the law and courts of Ireland. Annex I is section 2 of this DPA and Annex II is section 6. For the UK, the International Data Transfer Addendum issued by the UK Information Commissioner is incorporated; for Switzerland, the Clauses apply with the necessary changes.

Where the KVKK applies to you and requires it, we will sign the standard contract published by the Turkish Personal Data Protection Board on request; you, as the data exporter, notify the Board as the law requires.

• Encryption in transit (TLS) for all traffic, and encryption at rest provided by our hosting and database providers.
• Per-customer isolation in the database with row-level security, least-privilege database roles and separate service credentials.
• Sign-in by one-time email link or Google, sessions that can be revoked, and access for our staff only where needed.
• Uploaded files stored in private storage and served only through short-lived signed links; file type checks on upload.
• IP addresses used for free-preview abuse checks and terms acceptance records stored only as keyed hashes; secrets kept outside the code.
• Rate limits, bot protection, audit logs for sensitive actions, and backups by our database provider.
• Security reviews of the code before releases. We do not hold a security certification such as ISO 27001 or SOC 2.

We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations, and we will take reasonable steps to contain it.

We will make available the information reasonably needed to show compliance with this DPA and Article 28 of the GDPR, including answers to reasonable security questionnaires. Once a year, or after a breach or at an authority's request, you may audit our compliance, with 30 days' notice, during business hours, through an independent auditor bound by confidentiality, at your cost, and without access to other customers' data.

You can export your content at any time in Settings → Your data. When you delete your account, or when the agreement ends and the account is deleted, we delete the personal data we process for you within 30 days, and from backups on their normal rotation, unless the law requires us to keep it.

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Laws do not allow it. If this DPA and the Terms conflict on personal data, this DPA prevails; if the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

To request a countersigned copy, write to support@feedhand.com.