Data Protection Addendum

• "Data Controller" means the entity which determines the purposes and means of processing personal data — this is you, the Customer.
• "Data Processor" means the entity which processes personal data on behalf of the Data Controller — this is Majestic Company for Communications ("Majestic", the Provider).
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, including collection, storage, use, transmission, and deletion.

This Data Protection Addendum ("DPA") supplements the Terms of Service between you ("Customer", the Data Controller) and Majestic ("Provider", the Data Processor) for the Social Hub platform.

This DPA applies to all personal data processed by the Provider on behalf of the Customer through the Social Hub platform, including data collected via connected social accounts, messaging channels, competitive intelligence features, and AI-assisted analysis tools.

The Provider shall:

• Process personal data only on documented instructions from the Customer, unless required by law
• Ensure that persons authorized to process personal data are under obligations of confidentiality
• Implement appropriate technical and organizational security measures as described in our Security page
• Maintain a current list of its subprocessors on our Subprocessors page
• Assist the Customer in responding to data subject requests (access, correction, deletion, portability)
• Notify the Customer of any data breach without undue delay

Provider personnel may access a customer workspace where needed to provide support, maintain the service or investigate security issues.

The Provider implements and maintains security measures appropriate to the risk, including:

• Encryption: TLS 1.2 or higher for data in transit; OAuth access tokens encrypted at the application level with AES-256
• Access controls: Role-based access control, team-scoped data access, branch-level agent restrictions
• Authentication: Laravel Sanctum token-based API authentication, CSRF protection on all state-changing requests
• Infrastructure: Server hosted by Hetzner Online GmbH in Finland (EU), protected by a host firewall
• Monitoring: Laravel Horizon queue monitoring and daily log rotation
• Backups: Automated daily database backups

The Provider maintains a list of approved subprocessors on our Subprocessors page. Current subprocessors include Hetzner (hosting), Meta (social APIs), Anthropic (AI analysis), Google (AI image generation and connected Google services), Apify (data collection), and MyFatoorah (payments).

The Provider updates the Subprocessors page when it adds or replaces a subprocessor. The Customer may raise concerns about a subprocessor by contacting support@social-hub.net.

The Provider will assist the Customer in fulfilling its obligation to respond to requests from data subjects exercising their rights under applicable law, including:

• Access: Providing copies of personal data processed
• Rectification: Correcting inaccurate personal data
• Erasure: Deleting personal data when no longer necessary
• Data portability: Providing available exports, such as contact lists, in a structured file format
• Restriction: Limiting processing in certain circumstances

For Meta/Instagram-connected data, data subjects may also disconnect accounts or request deletion by emailing support@social-hub.net.

The Provider will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data. The notification will include:

• The nature of the breach and categories of data affected
• Approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

Customer data is primarily stored on a server in Finland, EU (Hetzner, Helsinki). Processing may also occur in:

• United States: Anthropic (AI analysis), Google (AI image generation and connected Google services), Meta (social media APIs)
• Czech Republic (EU): Apify (data collection)
• Kuwait: MyFatoorah (payments)

Email is delivered through a mail server operated by Majestic. Processing by these providers is subject to their published data protection terms.

Upon termination of the service agreement:

• The Customer can delete its account at any time from its profile settings, which permanently deletes the account and its workspace data from the live database
• On written request after the service ends, the Provider will delete remaining customer personal data within 30 days
• Backup copies are removed through the standard backup rotation cycle
• Data required for legal compliance, billing disputes, or fraud prevention may be retained for the legally required period

During the active subscription, data retention follows the policies described in our Privacy Policy.

This DPA is governed by the laws of the State of Kuwait, consistent with Kuwait Law No. 20 of 2014 regarding Electronic Transactions and applicable data protection provisions.

For questions about this Data Protection Addendum, data subject requests, or to report a concern, please contact:

Email: support@social-hub.net Website: https://social-hub.net