Data processing agreement

When you connect accounts, schedule posts and upload videos with Video Automation, we process personal data on your behalf. This agreement sets out how we handle it under Art. 28 GDPR.

This English version is a convenience translation. Only the German version is legally binding: Vertrag zur Auftragsverarbeitung.

Last updated: 7 November 2026

This data processing agreement (the "DPA") applies between the customer as controller (the "controller") and Internet am Dornbusch, owner Sajjad Hanifa, Eschersheimer Landstraße 297, 60320 Frankfurt am Main, Germany, as processor (the "processor"). It supplements the terms and conditions for the use of Video Automation (the "main contract").

Conclusion

This DPA applies in every plan, including the trial, and is part of the main contract under § 13 of the terms. It is concluded when you sign up; no separate signature is needed. Under Art. 28 (9) GDPR, electronic form is sufficient.

For your data protection records you can save or print this page. On request, you receive a copy as a document by e-mail to info@my-video-automation.com. If we change the DPA, it gets a new date and we inform you in advance by e-mail.

§ 1 Subject and duration

1. The subject of this DPA is the processing of personal data that the processor carries out for the controller when providing the online application Video Automation, including its application programming interfaces and connect pages, under the main contract.
2. The DPA applies for as long as the processor processes personal data for the controller, and at least for the term of the main contract.

§ 2 Nature and purpose of processing

1. The processor processes the data exclusively to provide the service under the main contract, in particular to
   • manage users, roles and permissions of the controller's team,
   • connect social media accounts of the controller and its end customers through the platforms' official interfaces, and store and renew their access tokens in encrypted form,
   • provide connect links through which the controller's end customers connect their accounts,
   • receive and store videos, images, thumbnails and texts and, on the controller's instruction, publish them on the chosen platforms immediately or at a scheduled time,
   • show the status, results and error messages of publications and report them via webhooks to the addresses specified by the controller,
   • send e-mail notifications to the controller's users and record actions in the log.
2. Processing includes in particular collecting, storing, organising, altering, retrieving, transmitting to the sub-processors listed in Annex 2 and to the platforms chosen by the controller, and erasing the data.
3. Providing media by URL: Some platforms (in particular Instagram, Facebook and Threads) fetch videos from an address. For this, the processor makes the files available at unguessable, signed addresses on the app server. The addresses are only sent to the respective platform and work only until the file is deleted.

§ 3 Types of data and data subjects

Special categories of personal data (Art. 9 GDPR) and data relating to criminal convictions (Art. 10 GDPR) are not intended for processing. If the controller's content contains such data, the controller is responsible for its lawfulness.

§ 4 Instructions

1. The processor processes the data only on documented instructions from the controller, including with regard to transfers to third countries, unless it is required to do otherwise by the law of the European Union or a member state. In that case, it informs the controller of that legal requirement before processing, unless the law prohibits this.
2. Instructions are the main contract, this DPA and the settings and calls the controller makes in the app or through the API, for example the choice of platforms and accounts, scheduled times and webhooks. The controller gives further instructions in text form.
3. If the processor considers an instruction to be unlawful, it informs the controller without delay.

§ 5 Confidentiality

The processor only uses people who are bound to confidentiality or subject to a statutory duty of secrecy. They process the data exclusively on the controller's instructions.

§ 6 Technical and organisational measures

1. The processor takes the technical and organisational measures required under Art. 32 GDPR to ensure a level of protection appropriate to the risk. The measures are described in Annex 1.
2. The processor may adapt the measures to technical progress as long as the level of protection is not reduced.

§ 7 Sub-processors

1. The controller gives the processor general authorisation to engage further processors (sub-processors). The sub-processors engaged at the time of conclusion are listed in Annex 2.
2. The processor informs the controller in advance of any intended addition or replacement of a sub-processor, by e-mail to the owner of the workspace and by updating Annex 2, as a rule at least four weeks before the change. The controller may object to the change within four weeks of receiving the information for an important reason relating to data protection. If the parties do not find a solution, the controller may terminate the services concerned or the main contract.
3. The processor contractually binds each sub-processor to the same data protection obligations as set out in this DPA, in particular to appropriate technical and organisational measures.
4. The platforms on which the controller publishes (YouTube/Google, TikTok, Meta with Instagram, Facebook and Threads, LinkedIn, Pinterest, X and Bluesky) are not sub-processors of the processor. The processor transmits content and post details on the controller's instruction to the platform the controller chooses itself. From receipt, the platform processes the data as an independent controller under its own terms, which the controller or the holder of the connected account has accepted.
5. Stripe Payments Europe, Limited processes the controller's payment data for the main contract as an independent controller and is not a sub-processor for the data processed under this DPA.

§ 8 Transfers to third countries

1. The processor and the sub-processors listed in Annex 2 process the data exclusively in Germany.
2. Processing by the processor outside the European Union or the European Economic Area only takes place if the conditions of Art. 44 et seq. GDPR are met and the controller has been informed in advance.
3. Transfers to platforms based or processing data outside the European Economic Area take place on the instruction of the controller, who chooses the platform (§ 7 (4)). The controller is responsible for the lawfulness of this transfer.

§ 9 Assistance to the controller

1. The processor assists the controller with appropriate measures in responding to requests from data subjects exercising their rights (Art. 12 to 23 GDPR). For this, the app provides a data export as a JSON file, disconnection of individual accounts and deletion of the workspace. If a data subject contacts the processor directly, the processor forwards the request to the controller without delay.
2. If the holder of a connected account requests deletion of their data directly through a platform (for example through Meta's data deletion interface or TikTok's notification of a revocation), the processor automatically removes the account concerned together with its tokens. The controller hereby instructs the processor to handle such requests in this way. The controller can see the disconnection in the app.
3. The processor also assists the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular regarding security of processing, notification of personal data breaches and data protection impact assessments, as far as the necessary information is available to it.

§ 10 Notification of personal data breaches

The processor notifies the controller of a personal data breach without undue delay after becoming aware of it. The notification contains, as far as known, the information under Art. 33 (3) GDPR. The processor takes measures without delay to limit the consequences, for example revoking affected tokens.

§ 11 Deletion and return

1. The controller can export its data as a JSON file in the app at any time.
2. The processor deletes uploaded media automatically after the plan's retention period (trial 3 days, Starter 7 days, Pro 14 days, Business 30 days, Agency 90 days).
3. If the controller disconnects an account, the processor deletes its tokens immediately and revokes them at the platform where the platform offers this. If the controller deletes its workspace, the processor deletes all of the controller's data immediately.
4. Otherwise, the processor deletes the controller's data 30 days after the end of the contract, unless the law of the European Union or a member state requires storage. On request, it confirms the deletion in text form.
5. The processor does not delete content that has already been published on a platform; this is the responsibility of the controller or the account holder.

§ 12 Evidence and audits

1. The processor makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
2. It allows for and contributes to audits, including inspections, by the controller or an auditor mandated by it who is bound to confidentiality. Inspections must be announced with reasonable notice and take place during normal business hours without unnecessarily disrupting operations.

§ 13 Obligations of the controller

1. The controller is responsible for the lawfulness of the processing, in particular for being allowed to upload and publish the content and for ensuring that its end customers who connect accounts through connect links are informed about the processing.
2. If the controller notices errors or irregularities in the processing, it informs the processor without delay.

§ 14 Liability and final provisions

1. Liability is governed by Art. 82 GDPR. Otherwise, the liability rules of the main contract apply.
2. In the event of contradictions between this DPA and the main contract, this DPA takes precedence in matters of data protection.
3. Changes and additions require text form. The law of the Federal Republic of Germany applies.
4. If a provision is invalid, the remaining provisions remain valid.

Annex 1: Technical and organisational measures

The following measures apply (as of 7 November 2026):

• Location: The app, the database (PostgreSQL) and media are hosted on servers operated by the processor itself in a STRATO GmbH data centre in Berlin, Germany. STRATO is responsible for access control and physical security of the data centre.
• Encryption in transit: The app, API and connect pages are only reachable via HTTPS (TLS). Connections to the platforms and to the mail server are encrypted.
• Encrypted credentials: Platform access and refresh tokens and Bluesky app passwords are stored encrypted with AES-256-GCM. The key is kept separately from the database.
• Minimal permissions: At the platforms, the service only requests the permissions needed for publishing and for showing the connected account.
• Passwords: stored only as a hash using Argon2id.
• Sign-in: password, sign-in code by e-mail or passkey; optional second factor via an authenticator app.
• Separation of customer data: The data of each workspace is separated at database level (row level security).
• Access control: roles (owner, administrator, editor, viewer) and custom roles with permissions per area. API keys apply per workspace and can be revoked individually.
• Log: Actions in the workspace are recorded in a log.
• Media: Files are only reachable at unguessable, signed addresses and are deleted automatically after the plan's retention period.
• Webhooks: Notifications are signed with HMAC-SHA256 so that the recipient can verify their origin.
• Deletion through the platforms: Signed deletion requests from Meta and revocation notices from TikTok are verified and carried out automatically.
• Protection against misuse: Requests to the app and API are limited (rate limits), in particular sign-in attempts.
• No third-party scripts: The website and the app load no analytics, tracking or advertising services.
• Data export and deletion: export as a JSON file and immediate deletion of the workspace in the app.
• Review: The processor reviews the measures with every significant change to the app, at least once a year, and adapts them.

Annex 2: Sub-processors

The platforms on which the controller publishes (§ 7 (4)) and Stripe for payment processing (§ 7 (5)) are not sub-processors.

Questions about the DPA

If you have questions about the DPA or data protection, contact us by e-mail at info@my-video-automation.com or by phone at +49 69 34 87 77 44. More information is available in the privacy policy.