Data Processing Agreement

1. Introduction

This Data Processing Agreement (DPA) forms part of, and is incorporated by reference into, the Terms of Service between Aigentifyable LLC (“ScoutSocial”, Processor) and the Customer(as defined in § 1.1 of the ToS, Controller). It applies whenever, in the course of providing the ScoutSocial platform, ScoutSocial processes Personal Data on the Customer's behalf. Where the Customer is itself a natural person using ScoutSocial for personal purposes (not on behalf of an organisation), this DPA applies only to the extent the Customer is acting as controller of third-party Personal Data (e.g. data of Connected Platform Members it is processing through ScoutSocial).

2. Definitions

• “Personal Data” means any data relating to an identified or identifiable natural person
• “Processing” means any operation performed on personal data
• “Controller” means the entity that determines the purposes and means of processing
• “Processor” means the entity that processes personal data on behalf of the Controller
• “Sub-processor” means any third party engaged by the Processor to process personal data

“Connected Platform” means a third-party social-media service whose account the Customer has connected to ScoutSocial via OAuth (currently Facebook, Instagram, LinkedIn, X, TikTok and YouTube). “Platform Data”means any data ScoutSocial accesses, stores or processes through a Connected Platform's API — including raw API responses, derived analytics, and aggregated outputs. “Authorised Client” has the meaning given in the LinkedIn Marketing API Terms. “Tech Provider”means a third-party developer providing services on behalf of an end-user under Meta's, LinkedIn's or Google's developer programs, in which capacity ScoutSocial acts when it manages a Page, organisation or channel on the Customer's behalf.

3. Scope and Roles

3.1 Customer as Controller. With respect to (a) account data of the Customer and its workspace users, (b) content the Customer or its users create or upload in ScoutSocial, and (c) Platform Data the Customer instructs ScoutSocial to process on its behalf, the Customer is the data Controller and ScoutSocial is the data Processor, and the processing is limited to providing the service as described in the Terms of Service.

3.2 Independent controller for certain Platform Data. For Platform Data ScoutSocial receives from X under the X Controller-to-Controller Data Protection Addendum (automatically incorporated into the X Developer Agreement), ScoutSocial receives that data as an independent Controlleralongside X. The Customer acknowledges this dual relationship; ScoutSocial's obligations under this DPA continue to apply to such data in addition to its obligations as independent controller.

3.3 Sub-Processor relationships. ScoutSocial's Sub-processors (§ 5) act as processors of ScoutSocial under written terms. ScoutSocial remains fully liable to the Customer for the acts and omissions of its Sub-processors as if they were its own.

4. Processing Purposes

ScoutSocial processes Personal Data for the following purposes:

• Providing and maintaining the platform
• Social media content management and publishing
• AI-powered content generation and analysis
• Analytics and performance reporting (where consented)
• Account and subscription management
• Security, fraud prevention and service reliability
• Legal and regulatory compliance

4.1 EU/UK Lawful-Basis Mapping

For customers and data subjects in the EU/EEA/UK, ScoutSocial's processing activities map to the following GDPR/UK GDPR lawful bases:

• Performance of contract (Art. 6(1)(b)): delivering the contracted ScoutSocial service.
• Legitimate interests (Art. 6(1)(f)): platform security, abuse prevention, service reliability, and observability. ScoutSocial maintains documented legitimate-interest balancing assessments for these activities.
• Legal obligation (Art. 6(1)(c)): mandatory compliance logging, tax records, and responses to lawful regulatory requests.
• Consent (Art. 6(1)(a)): optional analytics cookies and optional marketing communications.

A per-activity lawful-basis mapping is set out in our Privacy Policy § 4 and the two must be read consistently. Public-interest and vital-interest lawful bases are not used for ordinary ScoutSocial service processing. Where any feature would involve processing of GDPR Article 9 special-category data, ScoutSocial will obtain explicit consent under Art. 9(2)(a) or rely on another Art. 9 condition explicitly identified before processing; ScoutSocial does not currently process Article 9 data in its standard service. Any change to this position will require an update to this DPA and prior notice to the Customer.

5. Sub-Processors

ScoutSocial engages the sub-processors listed at scoutsocial.ai/legal/sub-processors, which is the authoritative current list and is updated whenever sub-processors are added, replaced or removed. Each sub-processor is engaged under a written processor agreement that imposes data-protection obligations no less protective than those in this DPA. For sub-processors processing Personal Data outside the EEA, the relevant SCCs (Module Two, controller-to-processor) and the UK IDTA are incorporated by reference into this DPA. ScoutSocial's contracts with OpenAI and Anthropic prohibit those providers from training their models on Customer Personal Data, content, prompts or outputs. ScoutSocial will give the Customer at least 14 days' prior written notice of any sub-processor addition, replacement or change. The Customer may object to the change on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate the affected service for convenience.

6. Data Security

ScoutSocial implements appropriate technical and organisational measuresto protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include encryption of data in transit (TLS 1.2+) and at rest, role-based access controls, encrypted storage of OAuth access and refresh tokens, regular security assessments, vulnerability management, and documented incident-response procedures. ScoutSocial does not collect or store Connected Platform login credentials directly — only OAuth tokens granted through the platform's authorisation flow. The full description of measures is published at scoutsocial.ai/legal/security and aligns with widely recognised frameworks (ISO/IEC 27001, NIST CSF, SOC 2 principles); to the extent required by a specific Connected Platform's developer terms, ScoutSocial implements that platform's prescribed Technical and Organisational Measures (TOMs) for incoming Platform Data.

Tenant isolation.All Customer Personal Data and Platform Data is logically isolated by organisation; ScoutSocial does not permit access to one organisation's data by another, and every data-access path is scoped to the organisation that owns the data.

Emergency platform kill switch. ScoutSocial maintains a per-platform kill switch that allows it to immediately halt all outbound API calls to a Connected Platform in response to a compliance or security event; when a platform is disabled, requests are blocked before any data is transmitted.

7. Data Subject Rights

ScoutSocial will assist the Customer (taking into account the nature of the processing and the information available to ScoutSocial) in responding to data-subject requests for access, rectification, erasure, portability, restriction and objection, including by providing a self-service data export in Settings → Workspace & Preferences → Privacy & Cookies. Where a Connected Platform forwards a data-subject request relating to a Customer account to ScoutSocial (notably Meta and LinkedIn — see § 7.1 below), ScoutSocial will notify the Customer within 24 hours. For platform-side data, ScoutSocial routes data subjects to the platform's own rights channel (TikTok webform, Google account permissions, LinkedIn Help, Meta Help, X privacy form) — see Privacy Policy § 9. Standard response SLA: ScoutSocial will fulfil verified data-subject requests within one calendar month (extendable to three months for complex requests, with notification).

DPIAs and prior consultations (Art. 28(3)(f)). Taking into account the nature of the processing and the information available to it, ScoutSocial will provide reasonable assistance to the Customer with data-protection impact assessments and with prior consultations of supervisory authorities under GDPR Articles 35–36.

7.1 Tech Provider obligations

Where ScoutSocial acts as a Tech Provider for the Customer under Meta's Platform Terms or LinkedIn's API Terms, ScoutSocial undertakes to:

• (a) process Platform Data only at the direction of the specific Customer;
• (b) maintain strict per-Customer data segregation, with no cross-tenant access;
• (c) for LinkedIn, maintain a list of all Customer organisations producible to LinkedIn on its request;
• (d) promptly terminate the Customer's access to the affected platform's data on the platform's request, in the platform's stated timeframe;
• (e) notify the affected Customer within 24 hours of any data-subject request the platform forwards to ScoutSocial concerning the Customer's accounts.

YouTube Authorised Data is confined within each Customer's workspace and is exposed only to users the authorising individual has approved.

8. Data Breach Notification

ScoutSocial will notify the Controller of any Personal Data breach without undue delay and no later than 72 hours after becoming aware. Notification will include:

• Nature of the breach
• Categories and number of data subjects affected
• Likely consequences
• Measures taken to address the breach

Where the breach involves Platform Data from a Connected Platform, ScoutSocial will additionally notify the Connected Platform within its required timeframe and through its required channel — including, for LinkedIn, written notification to security@linkedin.com within 24 hours of discovery, and for Meta, submission via the Meta incident form. ScoutSocial will coordinate with the Customer before any public statement to honour platform-specific public-statement embargoes (e.g. LinkedIn requires prior written permission).

9. International Transfers

Where Personal Data is transferred outside the European Economic Area or the United Kingdom to a country not subject to an adequacy decision, ScoutSocial relies on:

• (a) the European Commission's Standard Contractual Clauses (Module One controller-to-controller, or Module Two controller-to-processor, as applicable), incorporated by reference into this DPA and into ScoutSocial's contracts with each non-adequate sub-processor;
• (b) for UK Personal Data, the UK International Data Transfer Addendum (IDTA);
• (c) supplementary technical measures, including encryption in transit and at rest, key management, and identifier redaction before transmission to AI Sub-processors.

As an additional safeguard for X-sourced Personal Data transferred to X Corp. (USA), ScoutSocial relies on X's certification under the EU-US Data Privacy Framework, the Swiss-US DPF and the UK Extension. Transfer documentation is available to the Customer on request.

9.1 Government Requests

ScoutSocial will not disclose Customer Personal Data to a government authority unless required by law. Where legally permitted, we will notify the Customer, attempt to redirect the requesting authority to the Customer, and disclose only the minimum information legally required.

10. Audit Rights

10.1 Customer audits.The Customer may, on reasonable prior written notice and no more than once per year (unless required by a supervisory authority or following a confirmed material breach), audit ScoutSocial's compliance with this DPA. ScoutSocial may discharge audit obligations primarily through any third-party certifications or reports it holds (such as SOC 2 or ISO/IEC 27001, if and when obtained); on-site audits are reserved for situations where third-party reports are insufficient to address a documented concern.

10.2 Platform audits.The Customer acknowledges that several Connected Platforms (notably Meta, with at least 10 business days' notice; YouTube via API Compliance Audits) may audit ScoutSocial's processing of Platform Data. ScoutSocial will cooperate with such audits, including by providing test accounts and documentation, and will inform the Customer of the outcome to the extent permitted.

11. Data Deletion

11.1 Standard deletion.On termination of the service, ScoutSocial will, at the Customer's choice, return or securely delete Customer Personal Data within 30 days of receiving the Customer's written request (which must be submitted within 30 days of the termination date), except where ScoutSocial is required by law to retain a copy. The Customer may also trigger deletion at any time via Settings → Workspace & Preferences → Privacy & Cookies → Request Data Deletion; deletion is completed within 30 days of the request unless platform-specific overrides apply. In both cases, the 30-day completion window operates as a grace period during which a pending deletion may be cancelled; once it elapses, ScoutSocial performs a permanent hard deletion (including media stored in object storage) that is irreversible.

11.2 Platform-specific deletion overrides. Where a Connected Platform requires earlier or differently scoped deletion, that requirement prevails over § 11.1:

• LinkedIn Member Data and OAuth tokens — immediate on Member request;
• LinkedIn Stored Marketing Data — within 10 days of Customer cessation;
• YouTube API Data on user revocation via Google permissions — within 7 days;
• YouTube and TikTok on API-termination — full deletion in all forms across all storage systems, with signed deletion certification provided to Google where YouTube so requires;
• Meta API-fetched content propagating source deletion — within 90 days.

Until deletion is complete, the data remains protected under this DPA. To cancel a pending deletion request, contact legal@scoutsocial.ai before the deletion deadline.

11.3 Agency / multi-client offboarding

Where the Customer is an agency operating multiple end-clients inside a single ScoutSocial workspace, the Customer warrants that:

• (a) it has the authority to act as data controller (or to bind the end-client as controller) for each end-client's data;
• (b) within its workspace, ScoutSocial-side per-client segregation is enforced through workspace, project and access-control settings the Customer configures;
• (c) on offboarding of an individual end-client, the Customer is responsible for triggering deletion of that client's data via the in-product tools, which ScoutSocial will execute within 30 days subject to platform-specific overrides under § 11.2.

12. Term

This DPA is effective for the duration of the service agreement. Obligations regarding data protection survive termination.

14. Contact

For DPA inquiries:

Email: legal@scoutsocial.ai

Annex A — Subject Matter and Details of Processing

Annex B — Technical and Organisational Measures

A summary of the TOMs implemented by ScoutSocial is published at scoutsocial.ai/legal/security and is incorporated by reference into this DPA. Customers requiring an executed copy of the SCCs or a copy of TOMs in a signed appendix format may request one at legal@scoutsocial.ai.