Data Processing Agreement

1. Scope & Applicability

This Data Processing Agreement ("DPA") supplements the Opimatic Terms & Conditions and applies to the processing of Personal Data subject to Data Protection Laws (including GDPR, UK GDPR, and CCPA/CPRA) in connection with the provision of Opimatic services.

This DPA governs the processing of customer personal data by Opimatic when acting as a Processor or Service Provider on behalf of the Customer (the Data Controller).

2. Roles & Obligations

The parties acknowledge and agree to their respective obligations under applicable Data Protection Laws:

• Customer (Controller): Determines the purposes and means of processing Personal Data and guarantees that it has obtained all necessary consents and legal rights to transmit data to Opimatic.
• Opimatic (Processor): Processes Personal Data solely on documented instructions from the Customer, including with respect to international transfers, unless required to do so by applicable law.

3. Details of Processing

The details of data processing activities performed by Opimatic under this DPA are specified as follows:

• Subject Matter: Provision of omnichannel social media management, automation, AI post scheduling, and conversational inbox workflows.
• Duration: The duration of the Customer’s active subscription plus the period until full deletion of data as requested or required by law.
• Categories of Data Subjects: Customer’s end-users, lead inquiries, client contacts, and authorized system users.
• Types of Personal Data: Names, email addresses, phone numbers, social media handles, communication metadata, chat logs, and IP addresses.

4. Sub-processors

Customer grants general authorization to Opimatic to engage third-party Sub-processors to perform infrastructure and application support functions.

• Vetting & Binding: All Sub-processors are bound by data protection obligations at least as restrictive as those in this DPA.
• Notice of Change: Opimatic shall provide notice to Customer prior to adding or replacing Sub-processors, giving Customer an opportunity to object on reasonable data protection grounds.

5. Technical & Organizational Security

Opimatic maintains comprehensive technical and organizational security measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

• Encryption of data in transit (TLS 1.3 / 256-bit SSL) and at rest (AES-256).
• Strict role-based access controls (RBAC) and mandatory multi-factor authentication (MFA) for production environments.
• Regular vulnerability scanning, penetration testing, and continuous system monitoring.

6. Incident Notification & Assistance

Opimatic will notify the Customer without undue delay (and no later than 48 hours) after becoming aware of a confirmed Personal Data Breach affecting Customer data. Opimatic shall provide reasonable assistance to the Customer to meet its data breach notification requirements under applicable Data Protection Laws.

7. International Data Transfers

Where Personal Data originates from the European Economic Area (EEA), United Kingdom, or Switzerland and is transferred to countries that do not ensure an adequate level of data protection, Opimatic relies on valid data transfer mechanisms, including the EU Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendum.

8. Data Protection Officer & Requests

For questions regarding this DPA, executing a signed copy, or submitting Data Subject Access Requests (DSARs), please contact our Data Protection Team: