Data Processing Addendum

1. Parties and application

This Data Processing Addendum (DPA) forms part of the InfoQast Terms of Service between the customer that controls an agency workspace (Customer) and Syntetiq Limited, company number SC827265, of 146 Newhaven Road, Edinburgh, United Kingdom, EH6 4PZ (Processor). It applies where Processor handles personal data for Customer in providing InfoQast.

Customer is controller and Syntetiq Limited is processor for agency workspace and client-brand data processed on Customer's documented instructions. Each party remains independently responsible for processing for which it determines the purposes and means, including Syntetiq Limited's account security, abuse prevention, legal compliance, and business administration described in the Privacy Policy.

2. Processing details

Subject matter and purpose: tenant-scoped hosting, organisation, generation, adaptation, review, approval, scheduling, publication, metrics, support, backup, deletion, and authorised MCP or CLI access for Customer's social-content workflow.

Duration: for the service relationship and the deletion, backup-rotation, audit, or legal-hold periods described in the Privacy Policy and documented product controls.

Nature of processing: collection, recording, organisation, storage, retrieval, consultation, adaptation, generation, disclosure to Customer-selected destinations, restriction, anonymisation, export, and deletion.

Data subjects can include Customer personnel and contractors, Customer's clients and reviewers, people named or depicted in supplied content, social-network users represented in connected metrics or interactions, and support correspondents. Personal-data types can include contact and account identifiers, role and access data, briefs, drafts, comments, approvals, media, brand material, social identifiers and metrics, support content, device or security metadata, and audit events. Customer must not submit special-category or criminal-offence data unless separately agreed in writing with a documented lawful basis and safeguards.

3. Documented instructions and Customer duties

Processor will process Customer personal data only on documented instructions in the Terms, this DPA, Customer's authorised use of product controls, and additional written instructions accepted by Processor, unless UK law requires otherwise. Processor will notify Customer before legally required processing unless the law prohibits notice.

Processor will promptly tell Customer if an instruction appears to infringe applicable data-protection law and may pause that instruction. Customer is responsible for lawful instructions, notices and lawful bases, data accuracy and minimisation, permissions from its clients and users, role assignments, and its own contracts with customer-selected social, AI, MCP, or CLI providers.

4. Confidentiality and security

Processor ensures that people authorised to process Customer personal data are bound by confidentiality and receive access only as necessary. Processor maintains proportionate technical and organisational measures, including tenant and brand authorisation checks, encryption of credentials at rest, TLS in transit, short-lived access credentials, least-privilege service identities, audit logging, bounded inputs and outputs, rate limits, encrypted off-site backups, tested deletion workflows, vulnerability and dependency controls, and incident procedures.

Customer is responsible for account security, appropriate roles, client and provider credentials, endpoint security for the CLI, and prompt revocation of access that is no longer required. Security measures may evolve without materially reducing the overall protection of Customer personal data.

5. Subprocessors and Customer-selected providers

Customer gives general written authorisation for Processor to use subprocessors needed for hosting, encrypted backup storage, transactional email, bounded error monitoring, and support. Processor remains responsible for a subprocessor's performance of equivalent data-protection obligations and will maintain a current record available through support.

Processor will give reasonable advance notice of a new subprocessor where the change can materially affect Customer personal data. Customer may object on reasonable data-protection grounds before the change; the parties will seek a practical alternative, and either may terminate the affected service if no compliant alternative is reasonably available.

A social network, AI provider, ChatGPT, Claude, or another MCP client that Customer or its user independently selects and contracts with is a Customer-selected recipient, not automatically Processor's subprocessor. Customer instructs the corresponding disclosure and is responsible for authority, provider terms, and any controller-side transfer assessment. A provider engaged directly by Processor is treated as a subprocessor instead.

6. Assistance, incidents, and rights

Taking account of the processing and information available, Processor will reasonably assist Customer with data-subject requests, security obligations, breach notifications, data-protection impact assessments, regulator consultations, and records needed to demonstrate compliance. Customer remains responsible for deciding and communicating the response to a request where it is controller.

Processor will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data and provide available information about its nature, likely consequences, affected data, containment, and remediation. Notification is not an admission of fault or liability.

7. Return, deletion, and audit

During the service, Customer can use documented export, revocation, archive, and deletion controls. On termination or written instruction, Processor will delete or return Customer personal data according to the product's audited deletion workflow, unless law or a valid legal hold requires retention. Encrypted backup copies are isolated from ordinary use and age out through the backup lifecycle.

Processor will provide information reasonably necessary to demonstrate compliance with this DPA. No more than once per year, unless a breach or regulator reasonably requires more, Customer may request an audit by an independent qualified auditor bound by confidentiality. The audit must avoid other tenants, secrets, disruption, and unreasonable cost; Customer bears its cost unless a material Processor breach is found.

8. International transfers

Processor will not initiate a restricted transfer of Customer personal data without an applicable UK adequacy regulation, an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum together with the required data-protection test, or another lawful basis. Processor will make relevant safeguard information available on reasonable request, subject to confidentiality.

Where Customer instructs a direct transfer to its independently selected provider, Customer is responsible for its own transfer role and assessment, and Processor will provide reasonable information about the technical flow. If no lawful transfer basis applies, the relevant connection must not be enabled.

9. Priority and changes

If this DPA conflicts with the Terms on processing Customer personal data, this DPA controls. Mandatory data-protection law controls over both. Defined terms follow the UK GDPR and Data Protection Act 2018 unless the context requires otherwise.

Material changes receive a new DPA version and apply prospectively after notice or acceptance where required. This DPA is governed by the law and jurisdiction stated in the Terms.