Data Processing Agreement
This is an English translation for your convenience. The Dutch version is legally binding.
This Data Processing Agreement applies between the customer (“controller”) and DMback (“processor”), and is entered into by accepting the terms and conditions when creating a workspace. It complies with Article 28 of the General Data Protection Regulation (GDPR).
1. Subject, duration and purpose
The processor processes personal data solely to provide the service: receiving comments on the customer’s connected Instagram accounts, recognising configured keywords, sending automatic private messages and public replies, and displaying statistics. The agreement lasts as long as the customer uses the service, plus the period needed to erase data.
2. Types of data and data subjects
| Data subjects | Instagram users who comment on the customer’s posts (“followers”). |
|---|---|
| Data | Instagram user ID (a number), comment ID, media ID, the comment text (only to recognise the keyword), timestamp, the matched keyword and the status of the message sent. Usernames are not stored. |
| Special categories of data | Are not knowingly processed. The customer does not set up keywords or messages aimed at special categories of personal data. |
3. Instructions
The processor only processes on the customer’s written instructions. The settings the customer makes in the dashboard (keywords, messages, retention period) count as instructions. The processor will report it if, in its opinion, an instruction violates the GDPR.
4. Confidentiality and security
Persons who have access on behalf of the processor are bound by confidentiality. The processor takes appropriate measures, including:
- storage and processing within the EU (Frankfurt);
- encrypted connections (TLS) and encrypted storage of access tokens (AES-256-GCM);
- separation of customer data per workspace, also enforced in the database (row level security);
- verification of the origin of every message from Meta (cryptographic signature);
- access to production systems only for authorised persons, with logging of support access;
- automatic erasure of data after the configured retention period.
5. Subprocessors
The customer gives general authorisation for engaging the subprocessors below. We announce new subprocessors at least 30 days in advance on the subprocessors page; the customer may object and in that case cancel free of charge.
| Party | Purpose | Location | Transfer basis |
|---|---|---|---|
| Vercel Inc. | Application hosting (server functions in Frankfurt, fra1) | EU (Frankfurt); company in the US | EU-US Data Privacy Framework + SCC |
| Supabase Inc. | Database (PostgreSQL) | EU (Frankfurt, eu-central-1) | SCC; data stays in the EU |
| Meta Platforms Ireland Ltd. | Instagram API: receiving comments, sending DMs | EU / US | Necessary for the service; Meta Platform Terms |
| Stripe Payments Europe Ltd. | Payments and invoices (customer data only, no Instagram data) | EU (Ireland) / US | EU-US Data Privacy Framework + SCC |
| Resend (Plus Five Five Inc.) | Sending emails to customers (no Instagram data) | US / EU | EU-US Data Privacy Framework + SCC |
6. Rights of data subjects
The processor assists the customer with requests from data subjects (access, erasure). Deletion requests received via Meta are carried out automatically across all workspaces.
7. Data breaches
The processor informs the customer without undue delay and no later than 48 hours after discovering a security breach involving the customer’s personal data, with the information the customer needs for any notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Retention period and termination
Data is kept for the period set by the customer (30 days by default, minimum 8, maximum 400). After termination or deletion of the workspace, the processor erases all personal data within 30 days, unless a legal obligation requires otherwise. The customer can download an export beforehand.
9. Audit
On request, the processor provides the customer with the information needed to demonstrate compliance. An on-site audit is possible after reasonable notice and at the customer’s expense.
10. Liability
Liability is governed by what has been agreed in the terms and conditions.
Questions: the contact address on our website.