Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Data Controller") and Bonalogic, operating Nolorem ("Data Processor"), for the provision of the Nolorem platform services.

This DPA applies to all personal data processed by Nolorem sub-processors on behalf of the Data Controller in connection with the use of the Service.

2. Definitions

• Controller: The customer who determines the purposes and means of processing personal data through the Service.
• Processor: Bonalogic (Nolorem), which processes personal data on behalf of the Controller.
• Sub-processor: A third-party service engaged by the Processor to assist in processing personal data.
• Personal data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, including collection, storage, use, transmission, and deletion.

3. Processing Details

The Processor processes the following categories of personal data on behalf of the Controller:

• Account data: Name, email address, organization name, and authentication credentials for user account management.
• Content data: Blog posts, social media content, research queries, topic outlines, and generated text and images.
• Reactions on published social media posts: When someone reacts to a post that the Controller published through the Service, the Processor retrieves that reaction from the platform (through bundle.social) and stores it. This covers the author's platform id, the display name where the platform provides one, the profile link, the profile picture link (a link that expires; the image itself is not stored), the text of the reaction, the time, the number of likes and replies, and the position in the thread. Purpose: to let the Controller read and answer the reactions. These people are not customers of the Processor; their data comes from the platform.
• Billing data: Subscription tier, payment method references, and invoice records processed through Stripe.
• Usage data: Feature usage, page views, and interaction logs for service improvement.
• Text before and after editing: The text as the Processor generated it and as the Controller sent or scheduled it, with the channel, the voice profile, the language, the kind of content and the id of the user who started the final step. Purpose: to be able to improve the Controller's own generations. The Processor does not use this data for other customers and not to train a model. Any analysis runs on figures without customer names. The user id is kept until the retention period ends and, once that account is deleted, no longer refers to anyone.

Data is processed for the duration of the Controller's use of the Service and deleted within 30 days of account termination.

The text before and after editing is kept for 12 months, or deleted earlier together with the post or article and when the Controller's organisation is deleted. A post or article in the trash counts until it is definitively deleted or until the 12 months are over.

Reactions from third parties are kept for as long as the post they appear on exists in the Service. The Processor retrieves reactions until about 30 days after the post was published. A reaction removed on the platform before that point also disappears from the Service at the next retrieval. A reaction removed on the platform after that point stays in the Service until the Controller deletes the post definitively (also out of the trash); the reactions then go with it. Answers sent from the Service are kept as part of the post.

4. Sub-processors

The following sub-processors are engaged to deliver the Service. Each sub-processor is bound by data processing agreements consistent with GDPR requirements.

The Controller will be notified of any changes to sub-processors. Objections to new sub-processors may be raised within 30 days of notification.

bundle.social also retrieves the reactions on the Controller's posts from the platform and sends the answers the Controller gives from the Service. Anthropic (and OpenAI as fallback) receives the text of a reaction and the author's name only when the Controller presses the button "Stel een antwoord voor" (Suggest an answer), to write a proposal. Without that action no reaction goes to an AI provider. The proposal is never sent unless a human presses send.

5. Data Security

The Processor implements appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit: All data transmitted between the platform and users is encrypted using TLS 1.2 or higher.
• Encryption at rest: Personal data stored in the database is encrypted at rest using AES-256.
• Access controls: Role-based access controls and organization-scoped Row Level Security (RLS) policies ensure data isolation between customers.
• Regular reviews: Security practices and sub-processor agreements are reviewed regularly.

6. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject rights requests under GDPR, including:

• Access to personal data
• Rectification of inaccurate data
• Erasure of personal data
• Data portability in machine-readable format
• Restriction of processing
• Objection to processing

The Processor will respond to Controller requests within 15 business days.

For reactions from third parties: at the Controller's request, an administrator of the Processor erases all reactions from one person in that Controller's workspace. The answers the Controller gave that person in the Service are erased as well, because they may carry that person's name. The answer on the platform itself stays; the Controller manages it there. The Processor then records only that person's platform id and the date on an exclusion list for that workspace, so the next retrieval does not bring the person back. That list applies per organisation and holds nothing else. Legal basis: the legitimate interest in making an erasure last.

7. Data Breach Notification

In the event of a personal data breach, the Processor will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include:

• The nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

8. Audit Rights

The Controller may request information necessary to demonstrate compliance with GDPR obligations. The Processor will make available all information necessary and allow for audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and confidentiality obligations.

9. Termination

Upon termination of the DPA or the underlying service agreement, the Processor will, at the Controller's choice:

• Return all personal data to the Controller in a structured, commonly used format, or
• Delete all personal data within 30 days, unless retention is required by applicable law.

The Processor will provide written confirmation of data deletion upon request.

10. Contact

For questions about this Data Processing Agreement, to request an audit, or to report a data concern, contact us at:

• Email: info@nolorem.io
• Company: Bonalogic