Data processing agreement (DPA)

This agreement sets out the obligations of the parties under Art. 28 GDPR for personal data that the controller and their members enter into their FeedFoundry workspace or have generated there. For this data the controller is the controller under data protection law (Art. 4 (7) GDPR); we process it solely on the controller's behalf (Art. 4 (8) GDPR).

For account, sign-in, invitations, billing and support we are the controller ourselves. That processing is not covered by this agreement and is described in the privacy policy.

This agreement is part of the terms and conditions and is concluded with them in electronic form. It applies equally to businesses and consumers where they process personal data of third parties.

The subject matter is the provision of FeedFoundry for the controller's workspace: storing projects, sources, answers, brand profile, Growth Dossier, campaigns and posts; AI-assisted drafting of dossiers and post texts; rendering the post graphic from fixed templates; automatic quality checks of text and rendered graphic, also by AI models; preview, approval, export and deletion.

Nature of processing: collection, storage, retrieval, analysis with AI models, transmission to the sub-processors listed in annex 1 for the individual request, provision as an export and erasure.

Purpose: creating, checking and providing marketing content for the controller according to their instructions.

Duration: the term of the user contract under the terms and conditions, then until deletion under section 12.

• people whom the controller names or describes in sources, answers, campaigns or posts, such as their customers, partners, employees or people in quotes and testimonials;
• members of the workspace, where it is recorded who created, changed or approved content.

• names, roles, statements and contact details, as far as they appear in the workspace content;
• authorship and approval records: account identifier, time and type of action.

FeedFoundry is not intended for special categories of personal data (Art. 9 GDPR). The controller does not enter such data.

We process the data only on documented instructions from the controller (Art. 28 (3) (a) GDPR), unless Union or Member State law requires us to process it. Instructions are this agreement, the terms and conditions and the use of functions in the app, such as capturing a source, starting a dossier run or a Content Job, approval, export and deletion. Actions of members count as instructions of the controller as far as their role permits.

If we consider an instruction to infringe data protection law, we inform the controller without undue delay.

We ensure that all persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Art. 28 (3) (b) GDPR).

We take the measures required under Art. 32 GDPR (Art. 28 (3) (c) GDPR). They are listed in annex 2. We may replace them with equivalent or better measures.

The controller authorises the sub-processors listed in annex 1 (Art. 28 (2) and (3) (d) GDPR). We bind them contractually to obligations corresponding to this agreement.

If we intend to add or replace a sub-processor, we inform the controller by email at least 30 days in advance. The controller may object within this period for an objective reason. If we find no solution, the controller may terminate the contract with effect from the change.

We assist the controller within reason with requests from data subjects (Art. 28 (3) (e) GDPR). If a data subject contacts us directly, we forward the request to the controller without undue delay.

We assist the controller with the obligations under Art. 32 to 36 GDPR (Art. 28 (3) (f) GDPR). If we become aware of a personal data breach affecting their workspace, we notify the controller without undue delay so that they can meet their obligations under Art. 33 and 34 GDPR.

We make available the information needed to demonstrate compliance with Art. 28 GDPR and allow audits by the controller or an auditor mandated by the controller (Art. 28 (3) (h) GDPR). As a sole proprietorship we usually provide evidence through written information and documents; an on-site audit is possible after reasonable notice.

The controller can export the data of their workspace at any time. The export contains texts and metadata, no image files. If the controller deletes their workspace, or the contract ends and the controller requests deletion, we delete the workspace data. Database backups are overwritten in line with their retention cycle.

A deletion record without workspace content is kept so that the deletion can be evidenced (Art. 5 (2) GDPR). There are no statutory retention duties for workspace data at FeedFoundry; invoices for the subscription concern our own processing under the privacy policy.

Liability is governed by statutory law and, in addition, by the liability rules of the terms and conditions.

We change this agreement only for an objective reason, such as new laws, new processing or changed sub-processors. Section 11 of the terms and conditions applies to changes.

Austrian law applies. If a provision is invalid, the remaining provisions stay valid. In case of conflict between this agreement and the terms and conditions, this agreement prevails for the processing on behalf.

These sub-processors process data from the controller's workspace:

Access

Sign-in only through a one-time link sent to the email address, with request limits and, where configured, a security check (CAPTCHA); every server action checks the session before it accesses data.

Tenant separation

Every row with customer data carries the identifier of its workspace; enforced database access rules (row level security) admit only members of that workspace; automated tests with two workspaces check that one cannot read or change the other.

Roles

The role in the workspace determines what a member may read and change; billing, export and deletion are managed by the owner.

Transmission

Encrypted transmission (TLS) between browser, application and database.

Input control

Security-relevant actions in the workspace are recorded in a log without content.

AI requests

Each request contains only the content needed for the step and requires no storage and no training; we decide which model a function uses.

Cost caps

Every paid AI call reserves workspace budget beforehand; once the cap is reached, no further calls are executed.

Data residency

Content is stored in the EU region Frankfurt; server functions run in Frankfurt.

Deletion

Deleting a workspace in the app requires signing in again, immediately blocks any further processing and removes the workspace data; a deletion record without content is kept. As long as the app does not offer deletion, we handle it on request by email.

Separation

FeedFoundry has its own projects and keys with the database and the AI service; data from FeedFoundry is not used for other offerings of the operator.