Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms an integral part of the Terms of Service ("Agreement") between Prognóza, spol. s r.o., Popolná 39/8074, 83106 Bratislava, Slovakia ("Processor", "We", "Us") and the customer agreeing to the Terms of Service ("Controller", "You"). This DPA applies to the extent that We process Personal Data on Your behalf in the course of providing the PostShield service.

1. Definitions

"Data Protection Laws" means all applicable worldwide legislation relating to data protection and privacy which applies to the respective party in the role of processing Personal Data, including the European Data Protection Legislation (GDPR).

"Personal Data" means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller.

"Sub-processor" means any third party appointed by or on behalf of the Processor to process Personal Data on behalf of the Controller.

2. Roles and Scope of Processing

2.1. Role of the Parties. For the purposes of the GDPR, the Customer is the Data Controller of the Personal Data, and Prognóza, spol. s r.o. is the Data Processor processing Personal Data on behalf of the Controller.

2.2. Customer Instructions. The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do so by European Union or Member State law to which the Processor is subject. The Agreement and this DPA constitute Your complete and final documented instructions to Us.

2.3. Nature and Purpose of Processing. The Processor evaluates, moderates, hides, or deletes comments on Third-Party Social Media Services (e.g., Meta Platforms) based on parameters configured by the Controller. This includes analyzing the text of comments using Artificial Intelligence (AI) models to detect spam, hate speech, or rule violations.

3. Sub-processing

3.1. General Authorization. The Controller provides a general authorization for the Processor to engage Sub-processors to fulfill its obligations under the Agreement. We will enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA.

3.2. Current Sub-processors. As of the effective date of this DPA, the Controller authorizes the following Sub-processors:

1. Cloud Hosting & Infrastructure: Vercel Inc. (USA), Amazon Web Services / AWS (EU/USA)
2. AI Infrastructure & Processing: OpenAI, L.L.C. (USA), Anthropic, PBC (USA)
3. Social Media APIs: Meta Platforms, Inc. (USA/Ireland)

3.3. Changes to Sub-processors. The Processor shall notify the Controller of any intended changes concerning the addition or replacement of other Sub-processors, thereby giving the Controller the opportunity to object to such changes. If the Controller has a reasonable basis to object, the Controller may terminate the Agreement.

4. Security of Processing

The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These measures include encrypting data in transit, securing API keys, and restricting access to Personal Data to authorized personnel bound by confidentiality obligations.

5. Data Subject Rights and Assistance

5.1. Data Subject Requests. The Processor shall, to the extent legally permitted, promptly notify the Controller if it receives a request from a Data Subject to exercise their rights under Data Protection Laws. The Processor shall not respond to such a request without the Controller's prior written consent, except to direct the Data Subject to the Controller.

5.2. Assistance. Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the Data Subject's rights.

6. Personal Data Breach

The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The Processor shall provide sufficient information to allow the Controller to meet any obligations to report or inform Data Subjects of the breach under the Data Protection Laws.

7. Return or Deletion of Data

Upon termination of the Agreement, the Processor shall, at the choice of the Controller, delete or return all the Personal Data to the Controller and delete existing copies unless Union or Member State law requires storage of the Personal Data. By default, the Processor automatically purges temporary comment text data shortly after the AI analysis is completed, retaining only metadata necessary for analytical and billing purposes.

8. International Transfers

Any transfer of Personal Data outside the European Economic Area (EEA) to a country that does not ensure an adequate level of protection shall be governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission, which are deemed incorporated into this DPA by reference, or another valid transfer mechanism recognized by Data Protection Laws.

Annex 1: Details of Processing

1. Data Subjects: The Personal Data processed concern end-users, followers, or visitors who post comments or interact with the Controller's linked Third-Party Social Media Services (e.g., Facebook Pages, Instagram Accounts).

2. Categories of Data: Public profile information (such as name, username, profile picture URL provided by the API), the textual content of the comments, timestamps, and internal platform IDs.

3. Special Categories of Data: The Processor does not intentionally collect special categories of data. However, because the Service analyzes unstructured text entered by Data Subjects, it may incidentally process sensitive data if a Data Subject includes it in their comment.

4. Duration: The processing will continue for the duration of the Agreement.