Data Processing Agreement

Customer means the organization entering into this DPA with PostNow.

Personal Data, Processing, Data Subject, Data Controller, Data Processor, Personal Data Breach, and Supervisory Authority have the meanings given in the General Data Protection Regulation (GDPR) (EU 2016/679) and, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection (nFADP).

PostNow Labs, Inc. acts as a Processor of Personal Data on behalf of the Customer, who is the Controller. This DPA applies to the Processing of Personal Data in connection with the PostNow service under the Terms of Service between the parties.

This DPA forms part of the agreement between the Customer and PostNow. In the event of a conflict between the Terms of Service and this DPA, this DPA will govern with respect to data processing matters.

The following describes the Processing of Personal Data under this DPA:

• Categories of Data Subjects: the Customer's authorized users and individuals whose content is processed via LinkedIn OAuth.
• Categories of Personal Data: account information, content drafts, scheduling metadata, engagement analytics, and AI inputs (knowledge base materials).
• Purposes of Processing: providing the PostNow service as described in the Terms of Service — including AI drafting, scheduling, publishing, analytics, and reporting.
• Duration of Processing: for the duration of the agreement plus a deletion window of 30 days as described in the Privacy Policy, unless retention is required by law.

The Customer is responsible for the lawfulness of Processing, providing notice to Data Subjects, and obtaining any consents required for LinkedIn OAuth authorization and for the processing of their content through the Service.

The Customer represents and warrants that: (a) the processing of Personal Data under this DPA complies with applicable data protection laws; (b) it has obtained all necessary consents and provided all required notices; and (c) its instructions to PostNow comply with applicable law.

PostNow will:

• Process Personal Data only on documented instructions from the Customer, unless required to do otherwise by applicable law (in which case PostNow will inform the Customer of that legal requirement before processing, unless the law prohibits such notice).
• Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement the technical and organizational measures described in our Security page and Privacy Policy, including encryption at rest and in transit, least-privilege access controls, and regular security assessments.
• Engage sub-processors only as described in Section 6 (Sub-processors) below and notify the Customer of any intended changes at least 30 days in advance, allowing the Customer to object.
• Taking into account the nature of the Processing, assist the Customer by appropriate technical and organizational measures to fulfill the Customer's obligation to respond to Data Subject requests.
• Notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer's Personal Data, and provide reasonable assistance to mitigate the breach.
• At the choice of the Customer, delete or return all Personal Data after the end of the Processing services, and delete existing copies unless otherwise required by law.

PostNow engages the following categories of sub-processors to provide the Service:

• Managed cloud infrastructure (compute, storage, networking).
• Authentication and identity services.
• Error monitoring and diagnostics.
• Payment processing.
• AI inference providers (for draft generation, rewriting, and Content DNA operations).

A current, authoritative list of sub-processors is available at postnow.io/sub-processors. The list is updated at least 30 days before any sub-processor is added or replaced. Enterprise customers will receive direct notification of changes.

Where Personal Data is transferred outside the EEA, the United Kingdom, or Switzerland, PostNow relies on the Standard Contractual Clauses (EU 2021/914) as adopted by the European Commission, or the UK International Data Transfer Addendum (IDTA) to the EU SCCs, as applicable, together with supplementary technical and organizational measures where required.

Enterprise customers can opt into EU data residency with isolated infrastructure to satisfy GDPR data residency requirements. Contact dpa@postnow.io for details.

PostNow will, taking into account the nature of the Processing, assist the Customer by appropriate technical and organizational measures to fulfill Data Subject requests under the GDPR, UK GDPR, or nFADP, where possible through self-service features in the dashboard (such as account deletion, data export, and content management).

If a Data Subject contacts PostNow directly with a request relating to the Customer's data, PostNow will forward the request to the Customer without undue delay and will not respond to the Data Subject without the Customer's prior authorization.

PostNow will make available to the Customer all information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, conducted by the Customer or an independent auditor appointed by the Customer, with reasonable prior notice (at least 30 days) and subject to confidentiality obligations.

Audits will be conducted during normal business hours, no more than once per calendar year, and at the Customer's expense, except where a Personal Data Breach or regulatory investigation necessitates additional audits.

PostNow may satisfy its audit obligations by providing the Customer with a copy of a current SOC 2 Type II report or equivalent certification, which the Customer agrees constitutes compliance with this Section.

Upon termination of the agreement between the Customer and PostNow, PostNow will, at the Customer's election, delete or return all Personal Data within 30 days of the effective date of termination, except where retention is required by applicable law (for example, billing records and security logs).

PostNow will certify in writing that the deletion or return has been completed within 60 days of the termination date.

Send DPA-related requests to dpa@postnow.io. We will countersign a DPA addendum within five business days for qualified customers.

For security review packets, including SOC 2 readiness reports and pen test summaries, email security@postnow.io.