Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Thetechhacker Global Solutions ("Processor") and you ("Controller") for the processing of Personal Data on behalf of the Controller in connection with Socira AI. This DPA reflects the parties' obligations under the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and equivalent data-protection laws.

1. Definitions

Terms not defined here have the meaning given in the GDPR. "Personal Data" means personal data of the Controller's end users, employees, and social-audience contacts that we process on the Controller's behalf when providing the Service.

2. Subject Matter & Duration

Subject matter: Hosting and processing of the Controller's content (posts, media, replies, connected-account metadata, audience data) so we can provide the Service. Duration: For as long as the Controller has an active account, plus the retention periods described in our Privacy Policy.

3. Nature & Purpose of Processing

We process Personal Data to (a) authenticate users; (b) synchronize connected social accounts; (c) publish, schedule, and analyze content; (d) run AI-assisted features (content generation, sentiment scoring, listening); (e) generate reports; (f) provide support; and (g) comply with legal obligations.

4. Categories of Data Subjects & Data

Data subjects: Controller's employees, agents, followers, commenters, and audience members. Categories of data: name, handle, profile picture, email, post and comment text, engagement counts, sentiment, location metadata provided by the connected network, and audit-log metadata (IP, timestamps).

5. Processor Obligations

• Process Personal Data only on the documented instructions of the Controller, including as reflected in the Service's configuration and these Terms.
• Ensure that persons authorized to process Personal Data are under confidentiality obligations.
• Implement appropriate technical and organizational measures (see Security Overview and Annex II below).
• Not engage a sub-processor without the Controller's prior general authorization, granted here (see Section 7).
• Assist the Controller to respond to data subject requests within a reasonable time.
• Assist the Controller with data protection impact assessments and prior consultations where required.
• At the Controller's choice, delete or return all Personal Data at the end of the provision of the Service, unless retention is required by law.
• Make available to the Controller all information necessary to demonstrate compliance and allow for reasonable audits.

6. Personal Data Breach Notification

We will notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data breach affecting the Controller's data, providing the information required by Article 33(3) GDPR to the extent then known.

7. Sub-processors

The Controller grants a general authorization for the Processor to engage sub-processors listed at /legal/subprocessors. We will notify the Controller of intended additions or replacements at least 30 days before the change and give the Controller an opportunity to object on reasonable grounds.

8. International Data Transfers

For transfers of Personal Data outside the EEA, UK, or another jurisdiction with equivalent protection, we rely on the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 (Module Two: Controller-to-Processor), which are incorporated by reference into this DPA. For UK transfers, the UK International Data Transfer Addendum applies. Where Sub-processors are located outside such jurisdictions, we ensure they are bound to equivalent obligations.

9. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service. This DPA does not limit any rights that data subjects have under the GDPR.

10. Governing Law

This DPA is governed by the laws of India, without prejudice to the GDPR and any other mandatory law applicable to the Controller.

Annex I — Description of Processing

See sections 3 and 4 above.

Annex II — Technical & Organizational Measures

• TLS 1.2+ for all data in transit; encrypted at-rest storage for backups.
• bcrypt cost 12 for password hashing.
• Strong Content Security Policy, HSTS, X-Frame-Options, referrer policy.
• CSRF tokens on every state-changing form; SameSite=Lax cookies.
• Rate limiting on authentication and API endpoints.
• Account lockout after 5 failed login attempts (15 minute cooldown).
• Role-based access; separation of super-admin, client-admin, and client-user roles.
• Immutable audit log of privileged actions, retained ≥12 months.
• Nightly automated backups, encrypted, stored off-host.
• Least-privilege access to production systems; access reviewed quarterly.
• Vulnerability scanning of dependencies (npm audit) on every deploy.

Annex III — Sub-processor List

See /legal/subprocessors.