Data processing agreement

This Data Processing Agreement ("DPA") is concluded between the Client as the data controller ("Controller") and Michał Fox, trading as Reelelle, in Kraków, Poland, e-mail: hello@reelelle.com, as the processor ("Reelelle", "we").

This DPA is concluded together with the Agreement, by accepting the Terms when creating an account in the Panel, and meets the requirements of Article 28(3) of Regulation (EU) 2016/679 (GDPR). Capitalised terms have the meaning given in the Terms.

This DPA covers only data controlled by the Client. Data of the Client, Users and contact persons that we process as controller is described in the Privacy policy.

At the Controller's request we send this DPA as a PDF or sign it on paper or electronically with qualified signatures, without changing its content.

We are entrusted only with the data needed to perform the Agreement, in particular to prepare the Materials, post them on the Client Accounts and prepare the report.

Scope of the entrusted data:

Processing consists of storing, viewing, using in editing and animation, cropping, adding captions, posting on the Client Accounts and reading statistics, automatically and manually.

We do not process the entrusted data for any purpose other than performing the Agreement; in particular we do not use it for our own marketing, combine it with other clients' data or train artificial intelligence models on it.

The Controller does not provide special category data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR), unless we agree this in advance in a Request with additional safeguards.

This DPA applies for as long as the Agreement and until the data is deleted or returned under section 11.

As processor we:

1. 1)process the data only on the Controller's documented instructions; the instructions are the Agreement, the approved Content Plan, approvals of Materials in the Panel and Requests;
2. 2)tell the Controller without delay if we believe an instruction infringes the law;
3. 3)ensure that persons authorised to process the data have committed to confidentiality;
4. 4)apply the security measures in section 8;
5. 5)use sub-processors under section 6;
6. 6)help the Controller respond to requests from data subjects (section 9);
7. 7)help the Controller meet its obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to us;
8. 8)delete or return the data after the Agreement ends under section 11;
9. 9)make available the information needed to demonstrate compliance and allow audits (section 10).

If the law requires us to process the data in another way, we tell the Controller before such processing starts, unless the law forbids it.

We use access to the Client Accounts only within clause 7.3 of the Terms. Where possible we accept access through the platforms' partner access tools, with the least permissions that allow posting and reading statistics.

We do not reply to messages and comments, do not download follower lists or message content, and do not move data out of the Client Accounts except aggregated statistics for the report, unless the Controller instructs us to in a Request.

If the Controller gives us a password to a Client Account, we keep it only in a secured password manager, do not pass it on and delete it after the Agreement ends. We ask for two-step login to be enabled.

We remove our access to the Client Accounts within 7 days after the Agreement ends, or earlier at the Controller's request.

The Controller gives us general authorisation to use sub-processors in the categories in the table:

We bind every sub-processor by contract to the same data protection obligations as in this DPA. We are liable to the Controller for each of them as for ourselves.

We announce an intended addition or replacement of a sub-processor by e-mail at least 14 days in advance. The Controller may object in that time and, if we do not reach agreement, terminate the Agreement with effect on the date of the change, including during the minimum term and at no extra cost.

At the Controller's request we give the names of the sub-processors.

The social platforms on which the Client Accounts operate are not our sub-processors. The Controller uses them under its own agreements with their operators.

We do not transfer the entrusted data to countries outside the European Economic Area. If this becomes necessary, it will happen only under Chapter V GDPR and after the notice in clause 6.3.

Posting Materials on the Client Accounts is a disclosure of data to the platform operator on the Controller's instruction, under the Controller's agreement with that operator.

We apply technical and organisational measures appropriate to the risk, in particular:

1. 1)encrypted connections to the Website and the Panel (HTTPS);
2. 2)Panel passwords stored only as a salted hash (scrypt) and sessions in a signed HttpOnly cookie;
3. 3)access to an account's files only after signing in, and only for that account;
4. 4)User roles in the Panel assigned by the Client;
5. 5)our people's access only to the accounts they work on, under the principle of least privilege;
6. 6)deletion of data after the Agreement ends (section 11).

We review the security measures with every significant change to the Panel or the way we work.

We notify the Controller of a personal data breach concerning the entrusted data without undue delay, and no later than 48 hours after becoming aware of it, by e-mail to the account owner. The notice describes the breach, the categories and approximate number of people and records, the likely consequences and the measures taken; information we do not yet have follows as soon as we establish it.

We pass a data subject's request concerning the entrusted data to the Controller within 3 Business Days and do not answer it ourselves unless the Controller asks us to.

On the Controller's instruction we remove from the Materials and from the Client Accounts the image or data of a person who has withdrawn consent or objected, within the time agreed in a Request.

At the Controller's request we provide information about the processing and the security measures within 14 days.

The Controller may carry out an audit once a year and after a data breach, giving at least 14 days' notice. The audit takes place during the Business Hours in the SLA, without access to other clients' data, and is paid for by the Controller unless it reveals a breach of this DPA.

After the Agreement ends, the data remains available to the Controller in the Panel for 30 days, read-only. On request made in that time we return it in an agreed format.

After that period we delete the entrusted data within 30 days, including working copies, and confirm deletion by e-mail on request. Materials posted on the Client Accounts stay there because the Client Accounts are under the Controller's control.

The parties' liability for breaching this DPA is governed by section 19 of the Terms, subject to Article 82 GDPR.

This DPA prevails over the Terms in matters of the entrusted data. Matters it does not cover are governed by the Terms and the GDPR.

We change this DPA under section 26 of the Terms.

This DPA applies from 24 October 2026.