Data processing agreement
Last updated: October 25, 2026
This page is a translation of the French original. In the event of any discrepancy, the French version prevails.
This agreement (the “Agreement”) forms part of the SprintPost general terms. It applies when Marklls HK processes personal data on behalf of the Customer, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR). In the event of any conflict, the Agreement prevails over the general terms with regard to data protection.
1.Roles of the parties
The Customer is the controller of the personal data that it places in its workspaces or that the service retrieves on its behalf. Marklls HK acts as processor and processes this data solely in order to provide the service.
2.Description of the processing
| Subject matter | Provision of SprintPost: hosting, import and editing of media, writing (including AI-assisted writing), approval, scheduling and publishing on social networks, collection of analytics and comments, replies and moderation. |
|---|---|
| Duration | Term of the subscription, followed by the deletion period provided for in the “End of processing” section. |
| Nature of the operations | Collection (import, network APIs), recording, adaptation, consultation, transmission to social networks and AI providers at the Customer’s request, erasure. |
| Categories of data | Identity and business contact details of Users; content (texts, images, videos), which may depict individuals; identifiers of social accounts; post analytics; public data of people who comment (name, identifier, picture, comment text). |
| Data subjects | Users and members of the Customer’s workspaces; people appearing in its content; people who interact with its posts. |
| Sensitive data | Not required by the service. The Customer refrains from importing any, unless it is necessary and an appropriate legal basis exists, for which the Customer is responsible. |
3.Customer’s instructions
Marklls HK processes the data only on documented instructions from the Customer, which consist of the general terms, this Agreement and the Customer’s use of the service (settings, posts, connections). Marklls HK informs the Customer if, in its opinion, an instruction infringes the applicable regulations. The data is not used for any other purpose.
4.Confidentiality
The persons authorized to process the data are subject to an obligation of confidentiality and access the data only to the extent necessary for their duties (support, maintenance, security).
5.Security
- Encryption of communications (TLS) and hosting in France;
- encryption at rest of social network access tokens and API keys (AES-256-GCM);
- passwords stored as hashes; two-factor authentication; secure sessions;
- segregation by workspace, roles and permissions, access restricted social account by social account;
- administrator access that is restricted, individually assigned and logged; log of calls rejected by the networks;
- regular backups kept for no more than 30 days; security updates monitored.
6.Sub-processors
The Customer authorizes Marklls HK to engage the sub-processors listed below. Marklls HK imposes the obligations of this Agreement on each of them and remains liable for their performance.
| Sub-processor | Service | Location and safeguards |
|---|---|---|
| Clever Cloud SAS | Hosting of the application, the database and the files | France |
| Anthropic PBC | Generation of AI suggestions, if this provider is chosen | United States — EU–US Data Privacy Framework and/or standard contractual clauses |
| OpenAI, L.L.C. | Generation of AI suggestions, if this provider is chosen | United States — EU–US Data Privacy Framework and/or standard contractual clauses |
| Mistral AI SAS | Generation of AI suggestions, if this provider is chosen | France |
| X.AI LLC (xAI) | Generation of AI suggestions, if this provider is chosen | United States — EU–US Data Privacy Framework and/or standard contractual clauses |
| Google LLC | Import from Google Drive and Google Photos, at the User’s request | United States — EU–US Data Privacy Framework and/or standard contractual clauses |
Any addition or replacement is notified to the Customer at least 30 days in advance, by email or in the application. The Customer may object on reasonable grounds relating to data protection; if no solution is found, the Customer may terminate the part of the service concerned without penalty. The social networks on which the Customer chooses to publish are not sub-processors: they receive the content as independent controllers.
7.Transfers outside the European Union
No transfer outside the European Union takes place without appropriate safeguards within the meaning of Chapter V of the GDPR: an adequacy decision (EU–US Data Privacy Framework for certified companies) or the standard contractual clauses of the European Commission, supplemented where necessary by additional measures.
8.Assistance to the Customer
Marklls HK assists the Customer, insofar as possible, in responding to requests from data subjects to exercise their rights: the service makes it possible to delete posts and media, to disconnect social accounts and to hide comments, and Marklls HK carries out on request any extractions and deletions that are not available in the application. It also provides the information needed for impact assessments and for consultations with the supervisory authority.
9.Data breaches
Marklls HK notifies the Customer of any personal data breach concerning it without undue delay and no later than 48 hours after becoming aware of it, with the information referred to in Article 33 of the GDPR that is available to it: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or envisaged. It supplements this information as it becomes available.
10.End of processing
At the end of the contract, the Customer may retrieve its content; Marklls HK then deletes the personal data within 30 days, unless there is a legal retention obligation, and the backups expire within the following 30 days. A certificate of deletion is provided on request.
11.Documentation and audits
Marklls HK makes available to the Customer the information necessary to demonstrate compliance with its obligations. The Customer may have an audit carried out, no more than once a year and subject to 30 days’ notice, either by itself or by an independent auditor bound by professional secrecy, at its own expense, without disrupting the service or accessing the data of other customers. An additional audit is possible following a data breach concerning the Customer.
12.Customer’s obligations
- to have a legal basis for each processing operation and to inform the data subjects, including its audience on the networks;
- to hold the necessary rights and authorizations over its content, in particular the image rights of the persons depicted;
- to assign the roles and access of its members with care and to withdraw those that are no longer needed;
- to respond to requests from data subjects, with the assistance of Marklls HK if needed.
13.Liability and term
The liability of the parties under the Agreement is governed by the general terms. The Agreement applies for as long as Marklls HK processes data on behalf of the Customer. For any question: contact@sprintpost.app.