Data Processing Addendum

Parties and scope

This addendum supplements the service agreement between the business customer identified in its accepted account/order record (Customer) and Dimitrije Pavlovic, trading as Pavlovic Media, Fischerweg 4, 4222 Zwingen, Switzerland (Provider). The privacy contact is support@marketingapp.io.

It applies to personal data in customer content processed on Customer's instructions. Customer is the controller or an authorised processor for its own controller; Provider correspondingly acts as processor or subprocessor. Provider's own account, security, billing and legal administration is described separately in the Privacy Policy.

The applicable Swiss data protection law and, where applicable, the EU GDPR, UK GDPR and other binding requirements govern the processing. Contract labels do not change actual roles or legal scope.

Processing instructions and details

The service agreement, this addendum, configured functions and lawful requests by authorised users form Customer's documented instructions. Provider processes data only on those instructions unless required by law, and informs Customer before legally required processing unless prohibited. Provider promptly identifies an instruction it considers unlawful and may pause it while the issue is resolved.

The purpose is delivery of Customer's marketing workspace. Operations include receipt, instructed collection, organisation, storage, analysis, retrieval, export, transmission to authorised providers and deletion. Processing continues for the service and applicable return/deletion period, subject to lawful retention.

Data can include adult business contact/profile information, authorised business and client context, permitted public social identifiers/captions/counts, research notes, tests, measurements, planning, scripts and external file links. Data subjects can include adult personnel, client representatives and adults represented in permitted content. Sensitive personal data and data about minors are outside the permitted scope.

Customer is responsible for lawful instructions, necessary notices and its clients' authority. Provider remains responsible for its own obligations. Public research scope and third-party information duties require assessment for the actual collection.

Purpose and access restrictions

Provider will not use customer content for its own training, shared customer benchmarks, public examples or unrelated purposes. It will not sell customer content or combine it with another customer's content for its own use. Where applicable US service-provider/contractor restrictions apply, Provider complies with the relevant limits on sale, sharing, combination and use outside the agreed purposes and informs Customer if it cannot comply.

Access must be limited to authorised people who need it for their tasks, subject to appropriate confidentiality, instructions and access controls. The provider register describes the operator's and German partner's access and the service providers involved. Appropriate written arrangements for a recipient's actual role are required; a website description does not itself establish them.

Security

Provider maintains risk-appropriate technical and organisational measures without materially reducing protection through a notice update. Measures include HTTPS, production PostgreSQL TLS, Clerk session verification, server-side workspace permissions, applicable CSRF/origin checks, revocable credentials, token hashing and redacted diagnostics.

Database protection relies in part on the configured infrastructure provider. The service is not end-to-end encrypted and no application-wide field encryption or unperformed certification/audit is promised. Necessary operational controls include incident handling, access reviews, patching, recovery and deletion/request procedures appropriate to the risk.

Subprocessors and transfers

Provider engages subprocessors only for the relevant authorised processing and imposes appropriate equivalent data protection duties. It remains responsible as required by applicable law. Customer-selected agents are separate connections selected by Customer; optional analytics and independent payment processing are not automatically subprocessors of every customer's marketing content.

Before a proposed subprocessor addition or replacement, Provider will give appropriate advance notice and an opportunity for a reasonable data-protection objection. The parties will address a substantiated objection and applicable remedies rather than assume that a silently edited list grants unlimited permission.

Information can be processed outside Customer's country, including the United States. The transfer arrangement must cover the actual sender, recipient and processing. Applicable adequacy mechanisms or completed contractual safeguards, including required Swiss/UK adaptations, apply as relevant. A generic link does not execute transfer clauses or prove a recipient's current certification.

• Provider schedule and information

Rights, incidents and assistance

Provider assists Customer, taking account of the processing, with access, correction, deletion, portability, restriction, objections, security assessments and required impact assessments. Requests about customer-controlled content are referred to Customer unless instructions or law require otherwise. Assistance must not disclose another workspace's information.

Provider notifies Customer without undue delay after becoming aware of a personal data breach affecting processed customer information. It supplies available details about the incident, data/people affected, likely consequences, mitigation and a contact, and follows with further information as it becomes available. It cooperates on containment, evidence and legally required notifications. Customer remains responsible for its own notification decisions unless otherwise mandated.

Where lawful, Provider informs Customer of binding authority requests, reviews their validity and limits disclosure to what is required.

Return, deletion and evidence

At the end of processing, Provider returns or deletes customer-controlled personal data at Customer's choice, including applicable copies, unless law requires retention. Records retained for a legal duty are protected and limited to that purpose.

The service provides a 30-day export/reactivation period after verified subscription service end, followed by deletion processing. Active complimentary access is not an expired subscription. Provider-copy cleanup and backups follow applicable retention/cleanup cycles; a failed cleanup remains pending and is not reported as successful erasure. Earlier deletion requests are assessed under applicable law and valid instructions.

Provider makes information necessary to demonstrate compliance available and allows and contributes to audits, including inspections, as required by law. Reasonable confidentiality and scheduling safeguards protect other customers and systems but do not defeat mandatory rights. Provider informs Customer if it can no longer meet its applicable duties.

For customer-data processing, this addendum prevails over conflicting general service terms. Mandatory law and valid transfer clauses prevail over conflicting wording. Statutory data-subject rights are not removed by the general terms.