Data Processing Agreement
Effective date: 17 October 2026 · Version: 1.0
1. Parties and scope
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Uplonic (Simon Tivadar, 6400 Kiskunhalas, Felsőőregszőllők 159, Hungary; tax number 90283015-2-23 — the “Processor”) and the customer who uses Uplonic (the “Customer”, the controller). It applies to the personal data that Uplonic processes on the Customer’s behalf while providing the Service, as required by Article 28 of the GDPR. By using the Service the Customer accepts this DPA; a countersigned copy is available on request at info@uplonic.com.
This DPA does not cover the data Uplonic processes as an independent controller (the Customer’s own account, billing and security logs) — that is described in the Privacy Policy.
2. Subject matter and details of the processing
- Nature and purpose: storing, organising, scheduling and publishing the Customer’s content on the social networks the Customer connects; collecting the performance statistics and comments of that content; collaboration and approval inside the Customer’s workspaces; AI-assisted text suggestions and analysis requested by the Customer.
- Data subjects: the Customer’s team members and invited users; the Customer’s clients who review content through an approval link; people who comment on the Customer’s connected channels; people who appear in media the Customer uploads.
- Categories of data: names, email addresses, usernames and profile pictures; comment and reply text; uploaded videos, images and their captions; post and channel statistics; approval decisions and notes. Uplonic does not request special categories of data; if uploaded media contains such data, the Customer is responsible for its lawful processing.
- Duration: for the term of the Customer’s subscription, plus the deletion period in section 9.
3. Instructions and confidentiality
Uplonic processes personal data only on the Customer’s documented instructions. The Terms of Service, this DPA and the Customer’s use and configuration of the Service (for example connecting a channel, scheduling a post or sending an approval link) are the complete instructions. If Uplonic believes an instruction infringes the law, it informs the Customer. Everyone authorised to access the personal data is bound by confidentiality.
4. Social networks and connected AI applications
The social networks the Customer connects (YouTube, Facebook, Instagram, Threads, TikTok, LinkedIn, Pinterest, Snapchat) and the AI applications the Customer connects through the MCP integration are not sub-processors of Uplonic. Data is sent to them on the Customer’s instruction, through the Customer’s own account, and they process it under their own terms.
5. Security
Uplonic maintains technical and organisational measures appropriate to the risk (GDPR Art. 32), including:
- TLS encryption for all data in transit;
- encryption of stored social-network access tokens; passwords hashed with bcrypt; API keys and session tokens stored only as hashes;
- workspace-level isolation of every resource, and role-based access within a workspace;
- databases reachable only from the internal network, behind a firewall; servers and storage in the EU;
- daily backups stored in the EU, kept on a rolling 14-day cycle;
- masking of secrets and tokens in logs and error reports; rate limiting and bot protection on public endpoints.
6. Sub-processors
The Customer gives general authorisation for Uplonic to engage the sub-processors listed on the sub-processor page. Uplonic binds each sub-processor to data-protection obligations no less protective than this DPA and remains responsible for them. Uplonic announces a new sub-processor at least 30 days in advance on that page and by email to the workspace owners. The Customer may object on reasonable data-protection grounds within that period; if no solution is found, the Customer may terminate the affected subscription.
7. Assistance to the Customer
Taking into account the nature of the processing, Uplonic assists the Customer in responding to data subject requests (most can be handled in the Service directly: deleting content, disconnecting a channel, which deletes its stored comments and statistics, removing a team member) and in meeting its obligations under GDPR Articles 32–36. A data subject request that reaches Uplonic directly is forwarded to the Customer without undue delay.
8. Personal data breach
Uplonic notifies the Customer of a personal data breach affecting the Customer’s data without undue delay, and at the latest within 48 hours of becoming aware of it, with the information available at that time (nature of the breach, affected data, likely consequences, measures taken), so that the Customer can meet its own notification duties.
9. Deletion at the end of the service
Before the end of the subscription the Customer can download its media and data from the Service. After a workspace or account is deleted, Uplonic deletes the personal data processed on the Customer’s behalf from its live systems within 30 days; backups are overwritten within a further 14 days. Data that Uplonic must keep by law (e.g. invoices) is retained only for that purpose.
10. Information and audits
Uplonic makes available the information necessary to demonstrate compliance with this DPA. The Customer may request an audit, at most once a year and with at least 30 days’ notice, at its own cost; it is carried out primarily by written questions, and on-site only if the answers are insufficient. Information about Uplonic’s other customers is not disclosed.
11. International transfers
Uplonic’s servers and storage are in the EU. Where a sub-processor processes data outside the EEA, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, as shown on the sub-processor page.
12. Liability, precedence, contact
Liability under this DPA is governed by the Terms of Service. In case of conflict regarding personal data, this DPA prevails. Questions and requests: info@uplonic.com.
