Data processing agreement

Draft, not in force. Version 0.1 of 6 October 2026.

This agreement takes effect on {{EFFECTIVE_DATE}}.

Agreement under Article 28 of Regulation (EU) 2016/679 (the "GDPR") for the Socializza service, a product of ITALDRONI S.r.l.

1. Parties

This agreement is concluded between:

• [customer details], with its registered office in [customer details], VAT number [customer details], acting as controller (the "controller" or the "customer");
• ITALDRONI S.r.l., with its registered office in Via Camillo Benso Conte di Cavour 13, 10019 Strambino (TO), Italy, VAT number and tax code 13399080012, REA number TO-1360305, acting as processor (the "processor").

The contact details of the parties are in Annex I.

2. Definitions

The definitions of the GDPR apply. The following definitions also apply:

• "Contract" means the contract under which the controller uses Socializza;
• "workspace" means the controller's space in Socializza, with a plan, billing, its accounts and its agents, to which every item of the controller's data belongs;
• "account" means a social account that the controller connects to the workspace;
• "agent" means an artificial intelligence program that the controller chooses and runs outside Socializza and connects to Socializza with its own credential;
• "grant" means the link between an agent and an account, with the scopes, the mode and the limits that the controller chooses on Socializza's consent screen;
• "approval" means the decision of a natural person designated by the controller on content proposed by an agent;
• "approval record" means the record, one per post, of how the approval took place and of its outcome;
• "Clauses" means the standard contractual clauses adopted in section 4.

3. Subject matter and scope

3.1. The processor processes personal data on behalf of the controller to provide Socializza to the controller's workspace. Annex II describes the processing.

3.2. This agreement applies to every workspace used for a professional or business activity, on every plan, Gratis included.

3.3. Processing for which ITALDRONI S.r.l. is the controller falls outside this agreement. The privacy notice describes it. It comprises:

• the accounts of workspace members and their authentication;
• device tokens for push notifications;
• billing;
• security logs;
• product counters;
• reports of illegal content and content decisions under Regulation (EU) 2022/2065;
• any processing carried out in a workspace used for purely personal or household purposes, under Article 2(2)(c) and Recital 18 GDPR.

4. Adoption of the standard contractual clauses

4.1. The parties adopt the standard contractual clauses of Commission Implementing Decision (EU) 2021/915, in the English text published in the Official Journal of the European Union (EUR-Lex). The Clauses form an integral part of this agreement and are not reproduced in it.

4.2. In the event of a conflict, the Clauses prevail over this agreement and over any other agreement between the parties, as Clause 4 provides.

4.3. Sections 5 to 14 are additional clauses permitted by Clause 2. They do not contradict the Clauses, directly or indirectly, and do not prejudice the fundamental rights or freedoms of data subjects.

4.4. The annexes to the Clauses are the following:

• Annex I, List of parties, in this document;
• Annex II, Description of the processing, in this document;
• Annex III, Technical and organisational measures including technical and organisational measures to ensure the security of the data, in this document;
• Annex IV, List of sub-processors, in a separate document.

Annex V, the data residency statement, is an additional annex to this agreement, in a separate document.

4.5. The parties make the following choices:

• Clause 5, which is optional, does not apply.
• In Clause 7.7(a), Option 2, general written authorisation, applies. The notice period is 30 days. The processor informs the controller by email at the contact [customer details] and by a banner in the app. A shorter notice period is permitted only for the emergency replacement in section 7.5.
• For the purposes of Clause 9.2, the processor notifies the controller of a personal data breach without undue delay and in any event within 48 hours of discovery, at the contact [customer details].

5. Documented instructions

5.1. The configuration that the controller sets in the app constitutes the documented instruction within the meaning of Article 28(3)(a) GDPR and of Clause 7.1. The configuration comprises:

• the connected accounts;
• the grants, with the scopes, the mode and the limits for each agent and account;
• the approval rules;
• the kill switch, with which the controller revokes one agent, one brand or the whole workspace in a single action.

5.2. The processor executes, as an instruction of the controller, every request that an agent of the controller sends within a grant. The processor does not execute requests that exceed the grant.

5.3. The controller changes its instructions at any time through the configuration. Every change to the scopes, the mode or the limits of a grant creates a new version of it, kept in the history.

5.4. The controller instructs the processor to make the transfers set out in Annexes IV and V, with the Chapter V GDPR mechanisms stated there. Any other transfer requires a documented instruction, as Clause 7.8 provides.

5.5. The processor notifies every change to Annex V with the notice period and by the means of section 7.3. The controller may object on the terms of section 7.4.

6. Use of workspace data

6.1. The processor processes workspace data only to provide Socializza to the controller. It does not use the data for its own purposes.

6.2. The processor does not use workspace data to train, fine-tune or evaluate any artificial intelligence model.

6.3. The processor does not draft content for the controller and does not process workspace data with language models.

6.4. The processor does not put workspace data in the description fields or metadata of payment services.

7. Sub-processors

7.1. Through Clause 7.7, Option 2, the controller gives its general written authorisation for the engagement of the sub-processors listed in Annex IV. The processor publishes Annex IV at the stable address https://app.socializza.com/legal/sub-processors. For each sub-processor Annex IV states the name, registered office, function, categories of data, place of processing and transfer mechanism.

7.2. The processor keeps a dated record of every version of Annex IV. The record proves that each change was notified and on which date.

7.3. The processor notifies every addition or replacement of a sub-processor at least 30 days in advance, by the means of section 4.5.

7.4. Within the notice period the controller may object in writing, on grounds relating to the protection of personal data. The processor first tries to accommodate the objection, for example by processing the controller's data elsewhere. If it cannot, the controller may terminate the affected service without penalty. In that case the processor refunds pro rata the fees paid for the unused period.

7.5. If a sub-processor discontinues its service, or a security issue requires immediate replacement, the processor may replace it with less than 30 days' notice. The processor notifies the replacement by the means of section 4.5. The controller may object within 30 days of the notice, on the terms of section 7.4.

7.6. Every contract with a sub-processor imposes the same data protection obligations as this agreement, as Article 28(4) GDPR requires. The processor remains fully responsible to the controller for the performance of the sub-processors' obligations (Clause 7.7(d)).

8. Social platforms

8.1. The platforms on which the controller connects accounts receive the data because the controller so decides. They are recipients chosen by the controller, set out in Annex II.

8.2. Each platform processes the data as an independent controller, under its own relationship with the controller. No platform is a sub-processor, and none appears in Annex IV.

8.3. The processor accesses the platforms only through their official APIs.

9. Communications

9.1. The processor sends the communications provided for in this agreement and in the Clauses to the contact [customer details].

9.2. The controller sends communications, requests for assistance under Clause 8 and objections under section 7 to privacy@socializza.com.

10. Audits and inspections

10.1. The processor demonstrates compliance with its obligations, as Clause 7.6 provides, first of all through documentation and answers to the controller's questionnaires.

10.2. The controller may carry out an on-site inspection, directly or through an independent auditor, once a year and with 30 days' notice.

10.3. More frequent on-site inspections are permitted only after a personal data breach, on indications of non-compliance with the Clauses or at the request of a supervisory authority.

11. Deletion and return of data

11.1. On termination of the Contract the controller chooses between the return and the deletion of the data, as Clause 10(d) provides.

11.2. Approval records are an exception. The controller instructs the processor to keep each approval record for 5 years from publication of the post, on every plan, including after termination of the Contract.

11.3. On termination of the Contract the processor delivers to the controller the signed export of the approval records. The controller may order the early deletion of the records in writing. When the 5 years expire the processor deletes every record.

11.4. Deletion of the workspace removes the other data from the active systems within 30 days. It ends with the destruction of the workspace's encryption key (crypto-shred). Destroying the key makes the data encrypted with that key unrecoverable, starting with the platform tokens.

11.5. Backups comprise 30 days of rolling backups and one monthly copy kept for 12 months. Deleted data can therefore remain in the backups for up to 13 months, in encrypted form only. Backups do not allow selective deletion and expire on their own.

12. Regulation (EU) 2024/1689 on artificial intelligence

12.1. The controller is the deployer of the artificial intelligence systems it uses through its own agents. The controller has editorial responsibility for the published content.

12.2. The exemption in Article 50(4) of Regulation (EU) 2024/1689 for text that has undergone human review or editorial control is for the controller to claim. The processor does not declare the controller's compliance on the controller's behalf.

12.3. The processor keeps an approval record for each post, for the period in section 11.2. The controller may use it to demonstrate human review. At the controller's request, the processor exports the record in signed format.

12.4. Only a natural person designated by the controller and authenticated in the app approves. An agent token can never approve.

12.5. Content published without review automatically carries the label indicating the use of artificial intelligence.

13. Term and language

13.1. This agreement has the same term as the Contract. It remains in effect until the backups holding the controller's data have expired, at most 13 months after the deletion under section 11.4, in line with Clause 10(d). For approval records it remains in effect until their deletion under section 11.3.

13.2. This agreement is drawn up in Italian, English, Spanish, French and German. In the event of any discrepancy the Italian text prevails. The prevalence of the Italian text does not apply to the Clauses. Each language version of this agreement adopts the Clauses in its own language, and every version published in the Official Journal of the European Union is equally authentic.

14. Limitation of liability

14.1. The processor's liability to the controller under this agreement and the Clauses falls within the cap in section 18.2 of the terms of service.

14.2. The cap does not apply in the cases of section 18.3 of the terms of service (Art. 1229(1) and (2) of the Codice civile). It does not affect the compensation owed to data subjects (Article 82 GDPR). This section does not modify the Clauses and applies only insofar as it does not contradict them (Clause 2).

Annex I. List of parties

Controller

Processor

Annex II. Description of the processing

Categories of data subjects

• Workspace members, including approvers and, on the Agenzia plan, the approvers of the agency's clients, for the data concerning them in grants, approvals and the audit log.
• The people who manage the connected accounts.
• The audience of the connected accounts, for the data that the platforms' APIs return.
• Third parties present in platform content: authors of comments, people mentioned or tagged, authors of search results, correspondents in direct messages.
• People who appear in the controller's drafts, texts and media.

Categories of personal data

• Connected accounts: platform, external identifier, username, display name, profile picture and public profile (name, username, profile picture, follower count, biography), refreshed daily. Platform tokens are stored in encrypted form only and never leave the vault.
• Controller content: drafts and posts with text, media, options, scheduled date, ai_generated flag and reference to the published post. Media are images and video.
• Third-party content read through the APIs: comments, mentions, direct messages, search results, statistics and audience data.
• Agents and grants: agent name, runtime environment, connection method, last access and last IP address. The grants, with scopes, mode, limits, versions and the member who created them. The consent record of each grant, with member, copy of the grant, device, IP address, language and method. Agent credentials, stored only as a cryptographic hash.
• Approval records, one per post: SHA-256 hashes of the agent's draft and of the approved text, with the differences; post reference, platform, account, publication time; agent identifier, generation time, model or provider if the agent declares them; the reviewer, a natural person, with identifier and authentication method; the reviewer's role and subject competence; time open, text displayed, edits, links opened, the reviewer's note and attestation; decision with timestamp; responsible entity, responsible person and URL of the public contact page; public-interest flag and who set it; presence of media; deepfake assessment.
• Audit log: event type, actor, account, tool or action, redacted arguments, outcome, IP address, date and time. The arguments contain no secrets or tokens, and any free text is truncated to 2000 characters.

Sensitive data

No field of Socializza is designed for the special categories of personal data in Article 9 GDPR. Comments and direct messages may still contain such data. For that data the measures in Annex III apply, as Clause 7.5 provides, with these specific safeguards:

• the processor only stores the data, delivers it to the controller's agents and deletes it;
• the processor carries out no profiling;
• no language model processes the data;
• access is limited as Annex III provides;
• third-party content is deleted within 30 days.

Nature of the processing

The processor performs the following operations:

• stores platform tokens in the vault, in encrypted form, and never hands them to agents;
• reads comments, mentions, direct messages, statistics and search results through the official APIs;
• delivers third-party content to agents as untrusted data, with a provenance marker and a length cap, never as instructions;
• receives drafts and media from agents, schedules them and publishes them on the controller's accounts;
• runs the approval flow and keeps the approval records;
• records every agent call and every member action in the audit log;
• sends approval notifications by email and push, which do not contain the text of posts.

Purpose

To allow the controller's agents to operate on the controller's accounts within the grants and the approval rules set by the controller.

Frequency

Continuous, for the term of the Contract.

Duration and retention

The processing lasts as long as the Contract, except for the approval records in section 11.2. The following periods apply.

On termination of the Contract, section 11 applies.

Recipients chosen by the controller

The platforms on which the controller connects accounts. At launch they are X and Meta for Facebook Pages, Instagram and Threads. Section 8 applies.

Processing by sub-processors

Annex IV states, for each sub-processor, the function, the categories of data and the place of processing. Sub-processors process the data for as long as this agreement remains in effect under section 13.1. That period runs until the backups expire, at most 13 months after the deletion under section 11.4, and for approval records until their deletion.

Transfers

Annex V states what stays in the European Union and every exception, with the corresponding Chapter V GDPR mechanism.

Annex III. Technical and organisational measures including technical and organisational measures to ensure the security of the data

Encryption

• Public traffic uses TLS 1.3 only, with HSTS. The servers communicate over a private WireGuard network. Database connections also use TLS.
• Every volume that holds data is fully encrypted with LUKS2. Swap is disabled on every server, so that key material never reaches disk.
• With envelope encryption, every platform access token and refresh token is encrypted with a data key specific to the workspace (AES-256-GCM). The credentials Socializza issues to agents are stored only as a hash, never in clear. The client secrets of Socializza's developer apps are common to all workspaces and are encrypted with a separate system key. Each of these keys is in turn encrypted by a key that never leaves the key store. The database holds these secrets in encrypted form only.
• Backups are encrypted on the server before upload, with a key that the backup vault provider does not hold.

Key management

• The key store (OpenBao) runs on the Socializza server. Unsealing requires 3 of 5 key shares, held outside the servers.
• The processor uses no key management services of US providers.
• Workspace data keys are rotated when a compromise is suspected. Platform app secrets rotate every 6 months, signing keys every quarter.
• Services fetch secrets from the key store at start-up. No secret sits in a configuration file. Every disk is encrypted.

Isolation between workspaces

• Every row of controller data belongs to a single workspace.
• Database row-level security is enforced on every table that holds controller data. Without a workspace set, the application reads no rows.
• The token vault is separate from the other data, with its own roles.

Agent access

• Agents receive only credentials issued by Socializza, audience-bound and short-lived, one hour at most. Platform tokens never leave the vault.
• Agents connect with OAuth 2.1 and PKCE, with exact matching of redirect URIs.
• Each agent sees only the tools its grant allows.
• Revoking a grant or pausing an agent takes effect within one minute. The kill switch revokes one agent, one brand or the whole workspace.

Member access

• Two-factor authentication is mandatory for workspace owners and admins and available to every member.
• Re-authentication to change a grant, use the kill switch or change billing.
• Device-bound sessions and sign-in alerts.
• CSRF protection and Content Security Policy on every page.

Network and servers

• Two controls on every network path: the private network rules by role, then a default-deny firewall.
• Only the proxy answers the public, on ports 80 and 443. The database and the key store are reachable only locally or from the private network.
• Anti-DDoS protection from the hosting provider. Rate limits per credential, workspace and IP address. Request size limits. CrowdSec on the servers, with the community blocklist.
• Automatic security updates, minimal packages, one system user per service, unprivileged containers.

Administrative access

• Only one authorised person at ITALDRONI S.r.l. has access to the production systems.
• SSH access only from the private network, with keys on a hardware device. Password and root login disabled. Every administrative session is recorded.
• Automated development tools hold no production credentials. Releases ship only from the continuous integration pipeline, from reviewed changes.

Untrusted content and media

• Third-party content reaches agents with a provenance marker and a 2000-character cap, never as instructions.
• Media are checked in an isolated process, with size and time limits, type detection, image re-encoding and video transcoding in a container without network access.
• Media are published at unguessable addresses that expire.

Records

• The audit log is append-only, with one row before the platform call and one after, linked by the same identifier. The application can only insert rows.
• Logged arguments are redacted. No secret or token enters the audit log.
• Approval records are append-only, chained by cryptographic hashes and exportable in signed format. No operation modifies an approval record.

Backups and continuity

• The write-ahead log (WAL) of the database is archived continuously.
• Continuous backups to an AWS S3 backup vault in the eu-central-1 region, Frankfurt, Germany, with object lock in compliance mode and versioning. The identity that writes backups cannot read or delete them. Restoration uses a separate identity, with multi-factor authentication.
• The recovery targets are an RPO under 5 minutes and an RTO under 4 hours for a full rebuild from backups.
• Automatic restore drill every month, with an integrity check. Full rebuild tested twice a year.

Development

• Pinned dependencies, reviewed every week and verified in continuous integration. Secret scanning of the code in continuous integration.
• Software bill of materials (SBOM) for every release. Signed container images.
• Mandatory human review for changes to the vault, the authorisation server, token handling and media isolation.

Incidents

• Written procedure for each scenario, with a severity scale.
• Notification to the controller of every personal data breach within 48 hours of discovery, as section 4.5 provides.
• Incident analysis within one week.

Annex IV. List of sub-processors

Annex IV is the list of sub-processors, published at the stable address https://app.socializza.com/legal/sub-processors, with its change log.

Annex V. Data residency statement

Annex V is the data residency statement.