PLEN
Jointhe beta
SocialFox · Documents

Data Processing Agreement

Effective from: 29 October 2026.6 min readWersja polska
Contents
  1. 1. Parties
  2. 2. Subject matter and duration
  3. 3. Types of data, categories of data subjects, nature and purpose
  4. 4. SocialFox's obligations
  5. 5. The Agency's obligations
  6. 6. Sub-processors
  7. 7. Security
  8. 8. End of processing
  9. 9. Data breaches and audits
  10. 10. Transfers outside the EEA
  11. 11. Liability and final provisions

1. Parties

  1. Processor: Alfabet Marki sp. z o.o., ul. Strzałowa 13K/1, 87-100 Toruń, Poland, tax ID (NIP) 956 239 91 18, KRS 0001147842, operator of the SocialFox platform ("SocialFox", "we").
  2. Controller: the business that created a workspace in SocialFox and accepted the Terms of Service ("Agency"). Where the Agency itself processes data on behalf of its clients, it ensures that its agreements with them allow sub-processing by us.

2. Subject matter and duration

  1. The Agency entrusts us with the processing of personal data to the extent we process it in its workspace while providing the services described in the Terms of Service (socialfox.pl/en/terms-of-service).
  2. The agreement lasts as long as the Agency's workspace exists, until its permanent deletion.

3. Types of data, categories of data subjects, nature and purpose

  1. Data subjects: members of the Agency's team, persons on the side of the Agency's clients (client portal), persons connecting social profiles, persons commenting on, reacting to and writing messages to the profiles run in SocialFox, persons visible in materials (photos, videos).
  2. Types of data: identification and contact data (first and last name, e-mail address, profile name and identifier, profile picture), the text of posts, comments and messages with attachments, post statistics, panel activity data, materials uploaded to the workspace, the Agency's clients' data (name, contact details, brand brief).
  3. Nature of processing: storing, organising, displaying, publishing on social platforms, retrieving from them, passing to AI models at a user's request, deleting.
  4. Purpose: running the Agency's own or its clients' social media with SocialFox.
  5. Special categories of data are not entrusted; the Agency does not enter them into SocialFox, and if they appear in content from the platforms (e.g. in comments) we treat them like other data.

4. SocialFox's obligations

We process the data:

  1. only on the Agency's documented instructions; the actions of the Agency's users in SocialFox (e.g. publishing, replying, deleting), the workspace's settings and tickets in Help count as instructions; we inform the Agency of an instruction that in our view infringes the GDPR;
  2. ensuring that persons authorised to process have committed themselves to confidentiality;
  3. applying the technical and organisational measures described in section 7;
  4. respecting the conditions of sub-processing (section 6);
  5. assisting the Agency, as far as possible and taking into account the nature of the processing, in responding to data subjects' requests; a request addressed to us is passed to the Agency without undue delay;
  6. assisting the Agency in meeting its obligations under Art. 32–36 GDPR (security, breaches, impact assessment), taking into account the information available to us;
  7. deleting the data at the end of the agreement as in section 8;
  8. making available to the Agency the information needed to demonstrate compliance with Art. 28 GDPR and allowing audits on the terms of section 9.

5. The Agency's obligations

  1. The Agency is responsible for the lawfulness of the processing, including the legal basis, information duties towards data subjects, and the content its users enter into SocialFox and publish.
  2. The Agency decides whom it grants access to the workspace and removes access from persons who do not need it.
  3. The Agency uses SocialFox's security features (second sign-in factor, security log, code-based support access) in proportion to the risk.

6. Sub-processors

  1. The Agency gives general consent to our use of the sub-processors named in the Privacy Policy (socialfox.pl/en/privacy-policy, section 5): the providers of the database and file storage, hosting, e-mail, payments, AI models, stock photos and graphic tools.
  2. We inform the Agency of an intended addition or replacement of a sub-processor by e-mail or in SocialFox at least 14 days in advance. The Agency may object within that time; if no agreement is reached, the Agency may end the agreement without additional fees before the change takes effect.
  3. We impose on sub-processors data protection obligations at least equal to those in this agreement. We are liable for their actions as for our own.
  4. The social platforms (Meta, LinkedIn, TikTok, Google) the Agency publishes to and retrieves data from, and AI assistants connected by the Agency's user on their own initiative (MCP), are not our sub-processors; they act under their own terms.

7. Security

We apply in particular:

  • isolation of workspaces by database access rules, checked automatically;
  • a separate encryption key for every workspace, used for platform tokens, keys to external services and Inbox message text; the key is destroyed when the workspace is deleted;
  • encryption in transit (HTTPS) and encryption at rest at the database provider;
  • second-factor sign-in, required for workspace administrators and always for our team;
  • no access of our team to a workspace's content without its owner's consent (code-based, time-limited access, recorded in the security log);
  • security and activity logs, database backups at the provider;
  • least privilege for server functions; platform tokens never reach the browser.

8. End of processing

  1. After the workspace is deleted (with the 30-day grace period described in the Terms) we delete all data entrusted within it and destroy the workspace's encryption key, unless Union or Member State law requires storage.
  2. Before the deletion the Agency may download an export of the workspace's data.
  3. Backups are overwritten automatically in the database provider's cycle.

9. Data breaches and audits

  1. We notify the Agency of a personal data breach concerning the data it entrusted without undue delay, no later than 48 hours after becoming aware of it, giving the available information under Art. 33(3) GDPR and completing it as it becomes available.
  2. Once a year, and additionally after a breach, the Agency may request information and documents confirming compliance with this agreement. An on-site audit is agreed with 30 days' notice, during working hours, without compromising the security of other workspaces; the Agency bears the audit's cost unless the audit shows a material breach on our side.

10. Transfers outside the EEA

Sub-processors based outside the European Economic Area process data under the European Commission's adequacy decisions (including the EU-US Data Privacy Framework) or the standard contractual clauses approved by the Commission, with supplementary measures where needed.

11. Liability and final provisions

  1. Each party is liable for damage caused by processing under Art. 82 GDPR. Towards the Agency the liability limitation of the Terms applies where the law allows it.
  2. Changes to this agreement are announced like changes to the Terms.
  3. In case of conflict between this agreement and the Terms on data protection matters, this agreement prevails.
  4. The agreement is available at socialfox.pl/en/dpa; the Polish version prevails in case of discrepancies.
Back to the home page