This Data Processing Agreement ("DPA") is part of the agreement between Swonkie, Lda. ("Swonkie", "Processor") and the customer that accepted our Terms of Service ("Customer", "Controller"). It applies automatically whenever Swonkie processes personal data on the Customer's behalf through Rizamo, without needing a signature. If you need a signed copy, write to hi@rizamo.com.
1. Definitions
"GDPR" means Regulation (EU) 2016/679. "Data Protection Laws" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and any other law that applies to the processing under this DPA. "Personal Data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR. "Customer Personal Data" means personal data in Customer Data that Swonkie processes for the Customer. Other capitalised words have the meaning given in the Terms.
2. Roles and scope
The Customer is the controller, or a processor acting for its own customers, of Customer Personal Data. Swonkie is its processor, or sub-processor. Networks are independent controllers of the data they hold and are not sub-processors of Swonkie. Annex I describes the processing.
3. Instructions
Swonkie processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, the Customer's configuration of the Service and the requests made by the Customer, its users, its API keys and its Agents are the Customer's complete instructions. Swonkie will tell the Customer if it believes an instruction breaks Data Protection Laws. If the law requires Swonkie to process Customer Personal Data in another way, it will tell the Customer first unless the law forbids it.
The Customer is responsible for having a lawful basis for the processing, for the instructions it gives, and for the notices and consents its End Users and data subjects need.
4. Confidentiality
Swonkie ensures that everyone authorised to process Customer Personal Data is bound by confidentiality.
5. Security
Swonkie implements and maintains the technical and organisational measures in Annex II. Swonkie may update them as long as the overall level of protection does not decrease.
6. Sub-processors
The Customer gives general authorisation for Swonkie to use sub-processors. The current list is at rizamo.com/legal/subprocessors. Swonkie will give at least 14 days' notice of a new sub-processor to customers who subscribe to updates. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro rata refund of prepaid fees for it.
Swonkie imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.
7. Data subject requests
Swonkie will forward to the Customer, within 5 business days, any request it receives from a data subject about Customer Personal Data, and will not answer it except to say it was forwarded. Taking into account the nature of the processing, Swonkie will help the Customer answer requests, mainly through the export, deletion and disconnect features of the Service.
8. Personal data breaches
Swonkie will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, what happened, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken. Swonkie will update the Customer as it learns more.
9. Impact assessments
Swonkie will give reasonable help with the Customer's data protection impact assessments and prior consultations with authorities, to the extent the Customer cannot do them with the information available to it.
10. Deletion and return
During the subscription, the Customer can export and delete Customer Personal Data in the Service. When the Terms end, the Customer has 30 days to export it. Swonkie then deletes Customer Personal Data within 30 days, except copies the law requires it to keep. Backups are overwritten within 30 days and logs within 90 days. Network-specific deletion periods in our Privacy Policy apply where shorter. On request, Swonkie will confirm deletion in writing.
11. Audits
Swonkie will make available the information reasonably needed to show compliance with this DPA, starting with written answers to security questionnaires and any third-party reports it holds. If that is not enough, the Customer may audit Swonkie once a year, with at least 30 days' notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and in a way that does not compromise other customers' data.
12. International transfers
Swonkie may transfer Customer Personal Data outside the European Economic Area as described in the subprocessors list. Where a transfer is not covered by an adequacy decision, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference: Module 2 when the Customer is a controller and Module 3 when it is a processor. For those clauses: clause 7 (docking) applies; under clause 9, option 2 (general authorisation) applies with the notice period in section 6; the optional language in clause 11 does not apply; clauses 17 and 18 select the law and courts of Portugal; Annexes I and II of this DPA complete the clauses' annexes. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies; for Switzerland, the clauses apply with the necessary adaptations for the Swiss Federal Act on Data Protection.
13. California
To the extent the CCPA applies, Swonkie is a service provider. Swonkie will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, and will not combine it with personal information from other sources except as the CCPA allows.
14. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If it conflicts with the Standard Contractual Clauses, the clauses prevail.
15. Term and law
This DPA lasts as long as Swonkie processes Customer Personal Data. It is governed by the laws of Portugal, and the courts named in the Terms have jurisdiction.
Annex I: Description of the processing
Parties. Data exporter: the Customer, as identified in its Team. Data importer: Swonkie, Lda., NIPC 514107502, Rua do Progresso, n.º 140, 2.º andar, Fração BS, Vilarinho das Cambas, 4760-841 Vila Nova de Famalicão, Portugal. Contact: hi@rizamo.com.
Data subjects. The Customer's users and End Users; owners and managers of connected Accounts; people who interact with connected Accounts, such as commenters, followers, people who send messages or leave reviews, and people mentioned or tagged in content.
Categories of data. Names, handles, profile pictures and Network identifiers; content of posts, comments, messages, mentions and reviews; media; engagement and audience metrics, mostly aggregated; custom field values; assignments and notes; technical data such as IP addresses in logs.
Special categories. None intended. Content written by third parties may reveal special category data. The Customer should not use custom fields or notes to record it.
Frequency. Continuous, for the duration of the Terms.
Nature and purpose. Hosting, storing, synchronising with Networks, publishing, analysing, routing to the Customer's Agents, webhooks and users, and deleting Customer Personal Data, to provide the Service.
Retention. As in section 10 and the Privacy Policy.
Sub-processors. As listed at rizamo.com/legal/subprocessors, for the purposes stated there.
Competent supervisory authority. Comissão Nacional de Proteção de Dados (CNPD), Portugal.
Annex II: Technical and organisational measures
- Encryption. TLS 1.2 or higher for all traffic. Network access tokens encrypted at rest. Database storage and backups encrypted by the hosting providers.
- Access control. Production access limited to named staff who need it, with single sign-on, multi-factor authentication and logging. Least privilege for service credentials.
- Tenant isolation. Every record carries its Team identifier, and every query is scoped by it. API keys and OAuth tokens are limited to one Team and, optionally, to specific Profiles and scopes.
- Credentials. API keys stored as hashes and shown once. OAuth access tokens short-lived.
- Logging and monitoring. Audit log of changes to Customer Data, with the user, key or Agent that made them. Monitoring and alerting on production systems.
- Availability. Managed database with automated backups and point-in-time recovery. Infrastructure across multiple data centres.
- Development. Code review before deployment, dependency updates, separation of development and production data.
- People. Confidentiality obligations and security awareness for staff with access.
- Incidents. A documented process to detect, contain, assess and notify personal data breaches.
- Deletion. Deletion on disconnect, Team deletion and request, within the periods stated in the Privacy Policy.