Data Processing Addendum

This Addendum applies where you use PostShuttle in the course of a business and we process personal data on your behalf. Article 28 of the UK GDPR requires a written contract in those circumstances, setting out specific things. This is that contract, and it applies automatically — there is nothing to sign and nothing to request.

It forms part of our Terms and Conditions and takes precedence over them where the two conflict about processing you are the controller of.

1. When this applies, and when it does not

Most of what PostShuttle does with personal data, we decide ourselves: your account, your billing, our security logs. For that we are the controller, our Privacy Policy governs it, and this Addendum does not apply.

This Addendum applies to the narrower case where you decide what happens to someone else's personal data and we act on your instructions. In practice that means personal data you put into the Service about other people: a client named in a post you schedule, a customer's photograph in an image you upload, or details of a third party in a brief you give PostAssist. For that data you are the controller and we are your processor.

If you are using PostShuttle as a consumer, for your own purposes, this Addendum is unlikely to apply to you at all, and nothing in it reduces your rights.

2. The processing

• Subject matter: providing PostShuttle — composing, storing, scheduling and publishing content to the social media accounts you connect.
• Duration: for as long as you have an account, and afterwards only as set out in section 8.
• Nature and purpose: storage, organisation, retrieval and transmission to the platforms you choose, and to the AI provider you configure if you use PostAssist.
• Types of personal data: whatever you choose to include in post content, uploaded images, prompts and voice-profile material. We do not require any, and we do not ask for special category data.
• Categories of data subject: whoever you write about or depict — typically your customers, clients, colleagues or audience.

PostShuttle is not built for special category data — health, race, religion, political opinion, sex life, biometrics — or for criminal offence data. Scheduling a public social media post is the opposite of a controlled environment for it. Please do not put it into the Service.

3. Our obligations

We will:

• process personal data only on your documented instructions — which, in ordinary use, are the actions you take in the Service — unless the law requires otherwise, in which case we will tell you before processing unless the law forbids that too;
• make sure the people who can access it are bound by confidentiality;
• take the security measures required by Article 32, described in section 4 of our Privacy Policy and section 6 below;
• respect the conditions in section 5 for engaging another processor;
• help you respond to requests from data subjects, so far as we are able;
• help you with security, breach notification, impact assessments and prior consultation, taking into account what we know and what you do not;
• delete or return the personal data at the end of the service, as set out in section 8;
• make available the information you need to show these obligations are met, and allow and contribute to audits — see section 7;
• tell you if an instruction of yours appears to us to break data protection law.

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, with the information you need to meet your own notification duties.

4. Your obligations

You confirm you have a lawful basis for the personal data you put into the Service, that you have given the people concerned the information they are entitled to, and that your instructions to us will not put us in breach of data protection law. You are responsible for what you publish; we transmit it where you tell us to.

5. Subprocessors

You give us general authorisation to engage subprocessors. We impose on each of them obligations equivalent to these, and we remain responsible to you for what they do.

The current list — who they are, what they do, what reaches them and where they are — is in section 5 of our Privacy Policy. We will tell you before adding or replacing one, giving you a reasonable opportunity to object; if you object on reasonable data protection grounds and we cannot offer an alternative, you may terminate and receive a refund of the unused part of the period you have paid for.

AI providers you configure are not our subprocessors. PostAssist runs on an API key from your own account with the provider you pick. When you ask for a draft, we transmit your prompt to that provider on your instruction, using your credentials, under the agreement you hold with them — so for that transmission you direct the transfer and we carry it out. We have no contract with those companies, and we therefore do not promise, and could not deliver, the obligations in this section for them.

• You are responsible for your own terms with the provider you choose, including any transfer mechanism and any data processing terms you need from them.
• We will tell you what each provider's published terms say about training and retention, to the best of our knowledge, in Settings → AI and in section 5.2 of the Privacy Policy. That is information, not a warranty.
• If you would rather no prompt left our infrastructure for a third party, do not configure a provider. PostAssist is optional and the rest of the Service works without it.

6. Security and international transfers

Our technical and organisational measures are described in the Privacy Policy. In summary: data is encrypted in transit; platform access tokens and any AI provider keys you supply are encrypted before they are stored; passwords are hashed and never recoverable; access is restricted and audited; and retention windows are enforced on a schedule.

PostShuttle is hosted in the Netherlands. Where personal data is transferred to a country without a UK adequacy decision, we rely on a lawful transfer mechanism as described in section 11 of the Privacy Policy. Transfers to an AI provider you configure are the exception described in section 5 above: those you direct, and the mechanism is the one in your agreement with that provider.

7. Audits

We will answer reasonable questions about our processing and provide the information you need to demonstrate compliance. PostShuttle is operated by a very small company; an on-site audit is not something we can sensibly offer, and pretending otherwise would be a term we could not honour. Where a written response genuinely will not settle a question, we will agree a proportionate alternative with you — no more than once a year unless a regulator or a breach requires otherwise, and at your cost.

8. Deletion at the end

When your account is deleted, we delete the personal data we process for you. Deleting your account in Settings does this immediately, and what survives — and for how long, and why — is listed in section 7 of the Privacy Policy. You can export your data at any time before then from Settings.

9. Contact

Kestrel10 Limited acts as processor only to the extent described in section 1. Nothing here makes us the controller of data you are responsible for, or you the controller of data we are responsible for.