Data Processing Addendum

Aenze s.r.o., Moskevska 1842, 272 04 Kladno, Czech Republic, company ID 28534395, is the processor (KORD). The organization that accepts the Terms or a written order is the customer and controller, except where the parties' roles are different under applicable data-protection law.

This DPA applies to personal data that the customer, its users or authorized agents submit to a KORD workspace or instruct KORD to obtain from, process for or transmit to a connected service. It does not apply to data for which KORD independently determines purposes and means, such as its own account security, billing and legal-compliance records described in the Privacy Policy.

The terms controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings given in GDPR. Customer personal data means personal data processed by KORD as processor under this DPA.

Subject matter and purpose: providing workspace collaboration, media storage, drafts, review, scheduling, publishing, analytics snapshots, Agent API access, support, security and related service functions selected by the customer.

Duration: for the subscription or trial and until customer personal data is deleted or returned under this DPA, including the limited backup-retention period.

Nature of processing: collecting, recording, organizing, storing, retrieving, displaying, adapting, transmitting to customer-selected providers, logging, restricting and deleting data.

• Data subjects: customer users, employees, contractors, clients, collaborators, connected-profile owners and people identifiable in content or media supplied by the customer.
• Data categories: business contact and account data, roles and permissions, social profile identifiers and metadata, posts, captions, media, comments, approvals, schedules, publishing results, analytics snapshots, prompts, agent attribution, audit and support records.
• Special categories: not intentionally required by KORD. The customer must not submit special-category, criminal-offence or highly sensitive data unless lawful, necessary and protected by additional documented instructions agreed with KORD.

KORD will process customer personal data only on documented instructions from the customer, including the Terms, this DPA, product configuration, API requests, support instructions and connected-provider selections, unless EU or Member State law requires otherwise. If legally permitted, KORD will inform the customer before processing required by law.

KORD will promptly inform the customer if, in its opinion, an instruction infringes GDPR or other applicable EU or Member State data-protection law and may suspend that instruction while the parties resolve it.

The customer is responsible for a lawful basis, required notices and consents, data accuracy, appropriate roles and scopes, the authority to connect profiles and publish content, and responding to data subjects as controller.

KORD limits access to customer personal data to personnel and contractors who need it to operate, secure or support the service. Authorized persons are bound by confidentiality duties and receive instructions appropriate to their role.

Administrative access is restricted and auditable. Support impersonation is limited to authorized platform administrators, restricted roles and an expiring secure session.

KORD maintains measures appropriate to the risk, taking into account the state of the art, implementation cost and the nature and scope of processing. Measures are reviewed as the service changes and may be replaced by controls that provide equivalent or stronger protection.

• TLS for production traffic and secure, HttpOnly authentication cookies.
• AES-256-GCM encryption of connected-provider credentials at rest and controlled secret access.
• Passwordless sign-in links, password hashing for legacy credentials, rate limiting and Cloudflare Turnstile on public authentication flows.
• Workspace tenant isolation, role-based permissions, channel-level checks and scoped Agent API tokens.
• Audit events for sensitive workspace, token, channel and administrative actions without raw secrets.
• Network protection, security headers, dependency checks, health monitoring and incident investigation procedures.
• Database and media backups, a documented restore process and normally 14-day rotating backup retention.
• Pre-publish validation and worker checks that reject disabled, missing or cross-workspace social profiles.

The customer gives KORD general written authorization to use the subprocessors listed on the Subprocessors page for the described services. KORD remains responsible for each subprocessor's performance of data-protection obligations to the extent required by law and imposes obligations that are no less protective than the relevant requirements of this DPA.

The current Subprocessors page is the authoritative list and notice channel. KORD will post a material addition or replacement before it begins processing customer personal data where reasonably possible. The customer may object on reasonable data-protection grounds by emailing the privacy contact within 15 days of the change. The parties will work in good faith on an alternative; if none is reasonably available, either party may terminate the affected service without penalty for the unused prepaid period.

Customer-selected social platforms and customer-contracted AI providers are recipients acting under their own terms and are not KORD subprocessors merely because KORD transmits content to them on the customer's instruction.

Taking into account the nature of processing, KORD will provide reasonable technical and organizational assistance so the customer can respond to requests for access, correction, deletion, restriction, objection or portability.

If KORD receives a request concerning customer personal data, it will direct the requester to the customer where appropriate and will not respond substantively without the customer's authorization, except where law requires otherwise. The customer is responsible for verifying identity and deciding the response.

KORD will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data. Notification will include available information about the nature of the incident, affected data and people, likely consequences, measures taken or proposed and a contact for follow-up. Information may be provided in phases as the investigation develops.

KORD will take reasonable steps to contain, investigate and remediate the incident and assist the customer with its notification and documentation duties. Notification is not an admission of fault or liability.

KORD will provide reasonable information and assistance for the customer's GDPR security, breach-notification, data-protection impact assessment and prior-consultation obligations, considering the nature of processing and information available to KORD.

Questions and verified requests should be sent to [email protected]. Assistance that is unusually extensive or unrelated to a KORD failure may be subject to reasonable fees agreed in advance.

During an active account, the customer can retrieve content through available product and API functions. On termination or a verified request, KORD will delete or return customer personal data, at the customer's choice where technically feasible, unless applicable law requires retention.

Confirmed workspace deletion removes active workspace database records and stored media. Deleted data may remain in rotating backups for up to 14 days and in narrowly retained audit, security or billing records where independently required. Backup copies are isolated from ordinary use and expire through the normal rotation.

Provider-specific requirements may require shorter deletion. In particular, verified deletion or detected revocation of YouTube Authorized Data is handled as described in the Privacy Policy and Data Deletion page.

KORD will not transfer customer personal data outside the EEA except on the customer's instruction or using a valid transfer mechanism. Where no adequacy decision applies, the parties incorporate the applicable module of the European Commission Standard Contractual Clauses adopted by Decision (EU) 2021/914, with the customer as data exporter and KORD or the relevant subprocessor as data importer, supplemented where required.

The law and supervisory authority of the customer's EEA establishment apply for the Standard Contractual Clauses where permitted. If the customer is not established in the EEA but GDPR applies, Czech law and the Czech supervisory authority apply unless the clauses require another selection.

• EU Standard Contractual Clauses - Commission Implementing Decision (EU) 2021/914

KORD will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR, including this DPA, the Security page and subprocessor information.

If that information is insufficient, the customer may request one audit per 12-month period by an independent auditor bound by confidentiality, on at least 30 days' notice, during normal business hours and without exposing another customer's data or compromising security. Additional audits are permitted after a material incident or where a supervisory authority requires them. The customer bears reasonable audit costs unless the audit identifies material noncompliance by KORD.

If this DPA conflicts with the Terms on protection of customer personal data, this DPA controls. The Standard Contractual Clauses control over both where they apply and conflict.

This DPA ends after KORD has deleted or returned customer personal data, but confidentiality, audit, liability and transfer provisions survive as long as relevant data remains.