Data processing terms
Processing customer personal data on documented instructions.
1. Scope and parties
These terms apply when a business customer acts as controller and David Paulos Da Fonseca, operating as an entreprise individuelle (sole proprietor) under the trading name Solfaia, 34 Boulevard Prince Henri, L-4280 Esch-sur-Alzette, Luxembourg. VAT identification: LU31854716. Luxembourg business permit (autorisation d’établissement): 10105084 / 2. acts as processor for personal data in its itsends workspace. They supplement the service terms and remain effective while that processing continues. Contact [email protected] for data-protection matters. Our independent controller activities are described in the privacy policy.
2. Processing description
The subject is hosting and operating the customer’s content-management workspace. Processing lasts for the service relationship and necessary return or deletion period. Operations include collection, storage, organization, retrieval, media handling, publication, supported interaction management and deletion. Data may include customer user identifiers, professional profile details, drafts and media, posts, comments, supported messages, recipient/sender identifiers and engagement or delivery metadata. Data subjects include customer personnel, account owners, contacts, commenters, followers and message participants. The customer determines lawful purposes and may provide documented instructions through settings, approved actions and authorized tools. Do not intentionally submit special-category or criminal-conviction data without a specific agreement and appropriate safeguards.
3. Instructions and confidentiality
We process customer personal data only on documented instructions, including for transfers, unless legally required otherwise; where permitted we inform the customer of that requirement. We inform the customer if an instruction appears to infringe data-protection law and may pause that processing while it is resolved. Persons authorized to process data must be bound by confidentiality. We do not use this data for our own advertising or general-purpose model training.
4. Security
Measures include encrypted transport, password hashing, tenant-scoped authorization, encrypted provider credentials and supported private-message bodies, restricted connector permissions, session revocation, activity records and software maintenance. Authorized processing requires server-side access; end-to-end encryption and operator-inaccessible storage are not promised. We maintain measures appropriate to risk under GDPR Article 32 and review them as the service changes without materially reducing agreed protection.
5. Service providers
The customer authorizes Cloudflare (cloud hosting, networking, Workers, D1 and R2; international infrastructure) and Resend (transactional email; international processing including the United States) for the applicable service. We impose Article 28 obligations on subprocessors and remain responsible for their performance of those obligations. Before adding or replacing a subprocessor handling customer personal data, we give at least 15 days’ notice and an opportunity for a reasoned data-protection objection. We seek a reasonable alternative; if none is available, the customer may terminate the affected service without a termination penalty. Customer-selected social platforms and independently connected agents are not automatically our subprocessors; their actual role and applicable agreement govern. A new optional generation processor must be identified before its feature processes customer personal data.
6. International transfers
Transfers outside the EEA require documented instructions and a valid GDPR Chapter V mechanism, such as an applicable adequacy decision or standard contractual clauses with the necessary assessment and supplementary measures. We provide relevant safeguard information on request. These terms are not themselves standard contractual clauses and do not certify EEA-only storage.
7. Assistance and incidents
We assist the customer with data-subject requests, security duties, impact assessments and prior consultations taking account of the processing and available information. We forward requests concerning customer-controlled data and do not independently answer them except on instruction or legal requirement. We notify the customer of a personal-data breach without undue delay after becoming aware, provide available information on scope, consequences and remediation, and supplement it as the investigation progresses. This does not replace either party’s own notification duties.
8. Return, deletion and audit
At the customer’s choice on termination, we return or delete personal data and delete copies unless law requires retention. Provider-specific shorter deletion requirements prevail. Restricted backups follow their documented lifecycle, are not used for ordinary business activity and must have deletion instructions reapplied if restored. Contact us to arrange export and deletion; archiving alone does not erase data. We make information necessary to demonstrate Article 28 compliance available and allow and contribute to lawful audits, including inspections, by the customer or its mandated auditor. Reasonable confidentiality, security and scheduling arrangements must not defeat that right or supervisory-authority powers.
9. Responsibility
The customer is responsible for lawful collection, notices, instructions and permissions for the data it controls. We remain responsible for our processor obligations. Contractual allocations apply only where lawful and do not limit data subjects’ rights, mandatory contribution rights or regulators’ powers.