For consumers in Romania the Romanian version prevails.Versiunea in limba romana
GPTpostLLM Legal

Data Processing Addendum

This Data Processing Addendum ("DPA") sets out the terms on which TRIIVON S.R.L. processes personal data on behalf of a business customer of GPTpostLLM at https://app.oraglegpt.org. It gives effect to GDPR (Regulation (EU) 2016/679) art. 28, read with Legea nr. 190/2018 implementing the GDPR in Romania.

It is incorporated by reference into Terms of Service and applies automatically to every business customer whose use of the Service involves personal data. You do not need to sign anything for it to bind us. Section 16 explains how to obtain a countersigned copy if your procurement process requires one.

This DPA describes the arrangement as it actually is. Where a control is limited, the limit is stated here in the same words as in Security rather than softened for a contract.

1. Parties and roles

PartyRole
You, the business customerController of the personal data you put into the Service and of the personal data of your own end users
TRIIVON S.R.L.Processor, acting on your documented instructions, in respect of that data

TRIIVON S.R.L. is a Romanian company; its identification data, registered office and supervisory authorities are in Company Identification.

Where TRIIVON S.R.L. is a controller in its own right. For a defined and narrow set of records, we determine the purposes ourselves and act as controller rather than processor. This covers: the account and identity records of the individuals who sign in, billing and entitlement records, security and audit records, and correspondence sent to us. Our processing of those records is governed by Privacy Policy, not by this DPA, and the rights available in respect of them are set out in Your Data Protection Rights.

Where you are a controller and we are not involved at all. When you publish content to a social platform, that platform receives it as an independent controller under its own terms with you. It is not our subprocessor. See Subprocessors section 5.

2. Subject matter, duration, nature and purpose

Subject matter. The provision of GPTpostLLM, a social media publishing application, to you under Terms of Service.

Duration. For the term of your agreement, plus the retention and deletion periods in section 11.

Nature and purpose. Processing is limited to what is necessary to operate the Service for you: storing and organising the content and contacts you enter, scheduling and transmitting posts to the destination accounts you have connected, recording the result, storing the analytics observations you yourself submit, maintaining the audit trail, providing support you request, and keeping the Service secure and available.

What the Service does not do, which bounds the processing. Every connector on this deployment is publish-only. The Service cannot read comments, mentions, direct messages, replies or any inbox from any platform. It cannot fetch analytics or insights from any platform. It cannot like, repost, edit, delete or moderate anything on any platform. The only route by which analytics data enters is your own authenticated request to POST /api/v1/analytics/observations; nothing is fetched, scraped or received from a provider. The Service sends no email. The Service processes no payments. These are properties of the deployed code, and they are what limits the categories of personal data in section 3.

3. Types of personal data and categories of data subjects

Categories of data subjects:

Types of personal data:

CategoryExamples
Account and identityName, email address, workspace role, authentication and MFA state, session records
Content you enterPost text, drafts, campaigns, schedules, media files and their metadata, and any personal data those contain
Contact recordsWhatever fields you choose to store in them
Connected account dataThe identifier and display name of a connected social account, and the OAuth tokens or pasted credentials for it
Operational recordsPublication results, job and outbox records, audit entries, security events
Analytics observationsOnly the values you submit yourself

Special categories. The Service is not designed for, and you should not enter, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data processed to identify a person, health data, or data about sex life or sexual orientation, nor data relating to criminal convictions and offences. If your intended use involves any of these, tell us at contact@oraglegpt.org before you start so the position can be assessed rather than assumed.

4. Documented instructions

We process personal data only on your documented instructions, including as regards transfers, unless required to do otherwise by EU or Romanian law, in which case we will inform you of that requirement before processing unless the law prohibits it on important grounds of public interest (art. 28 alin. (3) lit. a)).

Your instructions are: this DPA, Terms of Service, the configuration you set in the application, and the actions your authorised users take in it. Any other instruction must be agreed in writing, and we may charge for work that goes beyond the Service if that is reasonable.

We will inform you if, in our opinion, an instruction infringes the GDPR or Legea nr. 190/2018 (art. 28 alin. (3), final paragraph).

We do not use your personal data for our own purposes. We do not sell it, share it for advertising, or use it to train a model.

5. Confidentiality

Every person authorised by us to process your personal data is bound by an obligation of confidentiality, either contractual or statutory (art. 28 alin. (3) lit. b)). Access is limited to those who need it to operate or support the Service. Company staff accounts on the platform are subject to mandatory multi-factor authentication and to shorter session lifetimes than ordinary users, as set out in section 6.

6. Security measures (art. 32)

The measures below are the controls described in Security. They are stated here with the same limits, because a DPA that describes a stronger system than the one you are buying is worse than no DPA.

Authentication and access

Encryption

Isolation

Integrity and accountability

Network and egress

Resilience and portability

Assurance limits. There is no independent penetration test and no security certification for this service: no ISO 27001, no SOC 2 and no equivalent third-party attestation. The full limitations list is Security section 11 and it forms part of the disclosure you are relying on.

7. Assistance with data subject rights

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests under GDPR arts. 15 to 22 (art. 28 alin. (3) lit. e)).

In practice this means: the application lets your administrators read, correct, export and delete records in your workspace directly, which is the fastest route for most requests; the export in section 6 produces a machine-readable archive suitable for a portability request; and where a request cannot be satisfied through the interface, we will help on request at contact@oraglegpt.org.

If a data subject contacts us directly about data we hold as your processor, we will not respond to the substance. We will tell them to approach you and, where we can identify you, we will inform you without undue delay.

8. Subprocessors

You give general written authorisation for us to engage subprocessors. The current list is published at Subprocessors and is short: Contabo GmbH for hosting, Cloudflare for authoritative DNS for the zone, and Let's Encrypt for certificate issuance.

We will:

If you object and no reasonable accommodation is available, you may terminate the affected part of the Service without penalty for the unused remainder of a prepaid term. Notice is sent by a person from the company mailbox, because the Service sends no email.

Not subprocessors: the optional integrations you may enable with your own credentials (HubSpot, Slack, Google Analytics Measurement Protocol, Zendesk, Shopify, and your own AI provider), which are off by default; and the destination social platforms, which are independent controllers.

9. Assistance with arts. 32 to 36

Taking into account the nature of processing and the information available to us, we assist you in ensuring compliance with your obligations under GDPR arts. 32 to 36 (art. 28 alin. (3) lit. f)). Specifically:

10. Personal data breach

We notify you of a personal data breach affecting your personal data without undue delay after becoming aware of it (art. 33 alin. (2)), by writing to the administrative contact on your account.

We will include, as far as it is known at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where the information is not all available at once, we will provide it in phases rather than delay the first notification.

The 72-hour duty is yours, not ours. As controller, you must notify the competent supervisory authority within 72 hours of becoming aware of the breach unless it is unlikely to result in a risk to individuals (art. 33 alin. (1)), and you must inform affected individuals where the risk is high (art. 34). Our notification and our assistance are designed to let you do that within your deadline.

We will not make a public statement identifying you in connection with a breach without consulting you first, unless we are legally required to.

11. Deletion or return at the end of processing

At your choice, on termination we delete or return your personal data and delete existing copies, unless EU or Romanian law requires storage (art. 28 alin. (3) lit. g)).

Return is by the export described in section 6, which you can run yourself at any time, including after termination during the window described below. Import and restore are not available, so an export is a readable archive rather than something that can be loaded back in.

Workspace closure moves the workspace through the states active, pending deletion and closed, with a 30-day window during which it remains readable and exportable, and the closure can be reversed by reopening during that window. The window and the deletion date are recorded on the workspace record.

State this accurately, because it is the one place where a plausible assumption would be wrong. The automated purge that would carry out the erasure at the end of that window runs in report-only mode on this deployment. The erasure is therefore performed by TRIIVON S.R.L. as an operational commitment, not as an automatic technical guarantee. We commit to carrying it out, and you may ask us at contact@oraglegpt.org to confirm in writing that it has been done.

Erasure of an individual account is requested through POST /api/v1/privacy/deletion-requests and is subject to a 30-day grace period which is enforced in code before erasure runs and can be cancelled during the window. The Data Privacy screen does not offer an account-deletion button. A deletion instruction received from Meta through the provider callback has no grace period and is queued immediately.

Retention periods implemented in the application:

Record typePeriod
Publication log24 months
Analytics observations25 months
AI runs12 months
Security events12 months
Sessions24 hours
Inbox records24 months. No provider on this deployment exposes an inbox and the product cannot read one, so no such records are created in practice. The constant exists in the code and is listed for completeness

Audit records are retained for the period necessary to preserve the integrity of the hash chain and to meet our accountability obligations under art. 5 alin. (2).

12. International transfers

Hosting involves no international transfer. Both servers are rented from Contabo GmbH and are inside the EU: the application, database, object storage and media processing in Lauterbourg, France, and this legal site and the company mailbox in Germany. No art. 46 transfer mechanism is needed for hosting, because GDPR arts. 44 to 49 are not engaged where the data does not leave the EEA.

Two qualifications, stated exactly:

We do not represent that Standard Contractual Clauses have been executed between you and us, because on the facts above no transfer between us requires them. If a change to the arrangement creates a transfer that does require them, the current Commission-approved modules are available on request at contact@oraglegpt.org and we will execute them before that transfer begins.

13. Information and audits

We make available to you the information necessary to demonstrate compliance with art. 28 and allow for and contribute to audits, including inspections (art. 28 alin. (3) lit. h)).

Realistically, for a company of this size, that works as follows:

  1. Documentation first. Security, Subprocessors, Privacy Policy and this DPA are published precisely so that most audit questions are answered before they are asked, including the unfavourable ones.
  2. Questionnaires. We answer a reasonable security or data-protection questionnaire in writing, once per twelve-month period, at no charge.
  3. On-site or remote inspection. Available on at least 30 days written notice, during business hours, no more than once per twelve-month period unless a supervisory authority requires otherwise or a breach affecting your data has occurred. It must not disrupt the Service or compromise the confidentiality of other customers, and the auditor must be bound by confidentiality and must not be our competitor. Reasonable costs, including our time, are borne by you.
  4. What we cannot provide. There is no ISO 27001 certificate, no SOC 2 report and no independent penetration test report to send you, because none exists.

14. Liability

Liability under this DPA is subject to the limitations and exclusions in Terms of Service, and the caps there apply to this DPA and Terms of Service in aggregate rather than separately.

Nothing in this DPA or in Terms of Service limits or excludes: liability that cannot be limited under applicable law; the rights of a data subject under the GDPR, including the right to compensation under art. 82; the powers of a supervisory authority; or a consumer's mandatory rights, which are dealt with in Consumer Rights and Dispute Resolution.

Each party is responsible for its own compliance with data protection law in the role it holds. You warrant that you have a lawful basis for the personal data you put into the Service and for the instructions you give us.

15. Governing law and precedence

This DPA is governed by Romanian law, and the Romanian courts have jurisdiction, as set out in Terms of Service. Nothing here removes the mandatory protections of a consumer's law of residence.

If there is a conflict, the order of precedence is: (1) mandatory provisions of the GDPR and Legea nr. 190/2018; (2) this DPA; (3) Terms of Service; (4) any other document.

16. Acceptance and a countersigned copy

This DPA is incorporated by reference into Terms of Service. By entering into Terms of Service and using the Service to process personal data, you accept this DPA in the version published on the date of that agreement, and no separate signature is needed for it to take effect.

If your procurement or audit process requires an executed document, write to contact@oraglegpt.org with:

We will return a countersigned copy. We will not accept an annex that describes security measures we do not actually have, so if your template asserts encryption of all data at rest, mandatory MFA, or a certification, we will amend it to match section 6 and tell you what we changed. That is the whole discipline of this document.

Changes to this DPA are published on this page with a new date at the top. Because the Service sends no email, notice of a material change is sent by a person from the company mailbox to customers who have asked to be notified.