Data processing agreement (DPA)
Last updated: 2026-10-27
pursuant to Art. 28 General Data Protection Regulation (GDPR) between the Postaro customer as controller ("customer") and maxiFIT Sebersdorf e.U., Oberlimbach 33, 8271 Bad Waltersdorf, Austria, as processor ("we").
This agreement forms part of our terms and is concluded electronically together with them at sign-up (Art. 28(9) GDPR). A signed copy is not required. For your records: print or save as PDF. The German version is legally binding.
1. Subject matter and duration
1.1 We process personal data on behalf of the customer in order to provide the Postaro services under the terms: reading the customer's website, creating a knowledge profile, creating, checking and storing social media posts, graphics and reels and scheduling them via the customer's Buffer account.
1.2 This agreement applies as long as we process data for the customer, i.e. for the term of the main contract and until deletion under section 10.
2. Types of data and data subjects
Types of data: content of the customer's website (texts, images, logos), knowledge entries, photos and videos from the customer's library, post texts, graphics, reels and voice-over scripts, feedback and change requests on posts, contact details contained in this content (e.g. names of contact persons) and access data for the customer's Buffer account (encrypted only).
Data subjects: owners, employees, customers and business partners of the customer as well as persons shown in the customer's photos or videos or named in its content; for agencies also their end clients and their contact persons.
Special categories of data (Art. 9 GDPR, e.g. health data) are not intended. The customer does not provide such data unless agreed with us in advance.
3. Instructions
3.1 We process the data only on documented instructions from the customer. Instructions are this agreement, the terms and the customer's settings and actions in the portal; the customer gives further instructions by email to support@postaro.at.
3.2 If we consider an instruction unlawful, we inform the customer without delay and may suspend its execution until clarified.
3.3 We only process data without instructions if required to do so by EU or Austrian law; we inform the customer beforehand where permitted.
4. Confidentiality
Persons with access to the data at our company are bound to confidentiality (§ 6 Austrian Data Protection Act). Currently only the technical operator of Postaro has access.
5. Security of processing
We take the technical and organisational measures under Art. 32 GDPR described in Annex 1 and adapt them to the state of the art without lowering the level of protection.
6. Sub-processors
6.1 The customer consents to the sub-processors listed in Annex 2. We contractually bind them to the same data protection obligations as in this agreement.
6.2 We announce new or changed sub-processors by email at least 30 days in advance. The customer may object for an important data protection reason; if no agreement is reached, it may cancel the contract effective when the change takes effect.
6.3 The following are not sub-processors: Buffer and the social media platforms (the customer uses them with its own account and contract; we transfer data on its instructions) and services the customer connects with its own access.
7. Transfers to third countries
Data is only transferred to third countries if the requirements of Art. 44 et seq. GDPR are met, in particular through the adequacy decision for the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Postaro's data is stored on a server in Germany.
8. Assistance to the customer
8.1 We assist the customer with appropriate measures in fulfilling data subjects' rights (Art. 12–22 GDPR). The customer can change or delete much of the data itself in the portal. If a data subject contacts us directly, we forward the request to the customer.
8.2 We assist the customer with the obligations under Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessment, prior consultation).
8.3 We notify the customer of personal data breaches without undue delay, if possible within 48 hours of becoming aware, with the information under Art. 33(3) GDPR as far as known.
9. Evidence and audits
On request we provide the customer with the information necessary to demonstrate compliance with this agreement and allow audits by the customer or an auditor appointed by it who is bound to confidentiality. Audits must be announced with reasonable notice and must not disrupt operations disproportionately.
10. Deletion and return after the end of the contract
After the main contract ends we delete the customer's data, immediately on request, otherwise no later than 90 days after the end of the contract; backups are overwritten within a further 14 days. Before deletion, the customer can request a copy of its posts, graphics and reels by email. Statutory retention obligations remain unaffected.
11. Liability, precedence
Liability is governed by Art. 82 GDPR; otherwise the terms apply. In case of conflict, this agreement takes precedence over the terms in data protection matters.
Annex 1: Technical and organisational measures
- Server and physical access: dedicated virtual server in a data centre in Frankfurt am Main (Hostinger); physical access control by the data centre operator.
- Server access: sign-in only with cryptographic keys (no passwords), firewall with only the necessary ports, automatic blocking of attack attempts, automatic security updates, internal services not reachable from outside.
- Transmission: all connections encrypted (HTTPS/TLS, HSTS).
- Portal access: passwords only as scrypt hashes; lockout after repeated failed attempts; signed sign-in cookies sent over HTTPS only; roles for agency staff (owner, member, read-only).
- Encryption: access keys for Buffer and other services stored encrypted (Fernet/AES); keys only in the server configuration.
- Separation: all data is assigned to one customer; portal queries only for the signed-in account.
- Public files: graphics and reels that Buffer needs to fetch only under random addresses that cannot be guessed; search engines excluded.
- Data minimisation: no analytics or tracking services; the cost log of AI requests contains no content; server logs without visitors' IP addresses.
- Availability: daily backup of database and files (14 daily versions on a computer in Austria, latest version encrypted off-site), monitoring with automatic alerts to the operator, daily automated self-test.
- Organisation: access to server and data only by the technical operator; confidentiality obligation; changes are versioned and backed up before deployment.
Annex 2: Sub-processors
| Company | Service | Place of processing | Third-country basis |
|---|---|---|---|
| Hostinger International Ltd., 61 Lordou Vironos, 6023 Larnaca, Cyprus | server and data centre | Frankfurt am Main, Germany | – |
| Anthropic PBC, San Francisco, USA | AI: texts, fact check, describing and checking images and videos | USA | EU-US Data Privacy Framework or standard contractual clauses |
| OpenAI Ireland Ltd., Dublin, Ireland / OpenAI, L.L.C., San Francisco, USA | AI: images, voice-over, fallback text model | USA | EU-US Data Privacy Framework or standard contractual clauses |
| easyname GmbH, Vienna, Austria | sending emails (e.g. approval links to agencies' end clients) | Austria | – |
| Dropbox International Unlimited Company, Dublin, Ireland | storage of encrypted backups (no access to content) | EU/USA | EU-US Data Privacy Framework or standard contractual clauses |
If this list changes, section 6.2 applies.