This Data Processing Addendum ("DPA") forms part of the Terms of Service between TrueThinks Ltd ("Processor", "we") and the customer ("Controller", "you"). It applies automatically whenever we process personal data in Your Content on your behalf under UK GDPR, the Data Protection Act 2018 and, where relevant, EU GDPR. If you need a countersigned copy, email hello@contentrue.com. Terms defined in the Terms of Service have the same meaning here. Where this DPA conflicts with the Terms on data protection, this DPA prevails.
1. Scope and roles
You are the controller (or a processor acting for your own client, in which case we are your subprocessor) of the personal data in Your Content and in the social-account data we receive for you. We are the processor and process it only to provide the Service. For our own account, billing and security data we are an independent controller, as set out in our Privacy Policy.
2. Details of the processing (Art. 28(3))
| Subject matter | Providing the Contentrue content-creation, review, scheduling and publishing Service. |
|---|---|
| Duration | The term of your subscription plus the period needed to return or delete data under section 8. |
| Nature and purpose | Hosting, storing, transmitting, adapting and generating content with AI providers, scheduling and publishing to connected social networks, retrieving statistics and (where enabled) comments and messages, and supporting you. |
| Types of personal data | Names, handles, images, voices and other personal data contained in content, comments, messages and media; social-account identifiers and tokens; team member names and email addresses. |
| Data subjects | Your team members and clients, people who comment on or message your social accounts, and people named, shown or heard in Your Content. |
3. Our obligations
We will:
- process personal data only on your documented instructions (the Terms, this DPA and your use of the Service's features), unless the law requires otherwise, in which case we will tell you first unless the law prohibits it. We will tell you if we think an instruction breaches data protection law;
- ensure our personnel authorised to process the data are bound by confidentiality;
- implement the security measures in Annex A, taking into account Art. 32 UK GDPR;
- respect the conditions for engaging subprocessors in section 4;
- taking into account the nature of the processing, assist you by appropriate technical and organisational measures to respond to data subject requests; where a request reaches us directly we will pass it to you without undue delay and not respond except to say we have forwarded it;
- assist you in meeting your obligations on security, breach notification, data protection impact assessments and prior consultation, given the information available to us;
- delete or return personal data at the end of the Service as set out in section 8; and
- make available the information needed to demonstrate compliance with Art. 28 and allow and contribute to audits as set out in section 7.
4. Subprocessors
You give us general authorisation to engage the subprocessors listed on our Subprocessors page. We will give you at least 14 days' notice of any addition or replacement, by email or by updating that page. You may object on reasonable data protection grounds within that period; if we cannot resolve the objection you may cancel the affected Service. We impose on each subprocessor data protection obligations no less protective than this DPA, and we remain liable for their performance.
5. International transfers
We will transfer personal data outside the UK (and, for EU data, outside the EEA) only with a lawful safeguard in place: an adequacy decision or regulations, the UK-US data bridge where applicable, or the IDTA or the UK Addendum to the EU Standard Contractual Clauses. Where required, the EU Standard Contractual Clauses (module two, controller to processor) and the UK Addendum are incorporated into this DPA and apply between you and us; the parties and details are as set out in this DPA and on the Subprocessors page.
6. Personal data breaches
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Your Content, with the information we then hold: the nature of the breach, categories and approximate numbers affected, likely consequences and the measures taken or proposed. We will keep you updated as we learn more.
7. Information and audits
On request, and no more than once a year unless there is a breach or a regulator requires it, we will provide reasonable information to show compliance, such as our security documentation and subprocessor agreements, and will answer your due-diligence questionnaires. Where that is not enough, we will allow an audit by you or an independent auditor you appoint, on reasonable notice, during business hours, under confidentiality, and so as not to disrupt our service or other customers. You bear the costs of an audit.
8. Return and deletion
You can export Your Content and delete workspaces yourself at any time. When your subscription ends we keep your workspace read-only so you can export it. If it has had no active plan for 90 days (and has not been granted free access by us) we schedule it for deletion, after warning you by email 14 days and 3 days beforehand. After a further 7-day period in which it can be restored (about 97 days in total after the plan ended) we permanently delete it, including from active systems and (as backup copies expire, within the periods set out in our Privacy Policy) from backups, unless the law requires us to keep it. On your written request we will confirm deletion.
9. Liability and law
Liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it. This DPA is governed by the law of England and Wales.
Annex A: security measures
- Encryption of data in transit (TLS).
- Logical separation of each customer workspace and role-based access control, with authorisation checks on every request.
- Secure storage and restricted use of social-account access tokens.
- Authentication using one-time sign-in codes or Google sign-in, with session protection against request forgery.
- Least-privilege access for our staff, with logging of administrative actions and customer-visible audit logs.
- Daily database backups kept for 14 days and weekly media archives (last 4 copies), held on access-restricted infrastructure of our hosting provider; monitoring, alerting and error reporting with personal data scrubbed where possible.
- Secrets kept out of source code and held in protected configuration.
- Vendor review before engaging subprocessors; incident response procedure.