Data Processing Agreement (DPA)
Version: 2026-07-09
Convenience translation. This English version is provided for convenience only. Only the German version is legally binding; in the event of any discrepancy, the German version shall prevail. German original: AVV.
Preamble
This Data Processing Agreement (hereinafter the “DPA” or “AVV”) specifies the parties’ obligations under data protection law within the framework of the user agreement for the Tidefall service. With regard to the data of its LinkedIn environment, the customer is the controller within the meaning of Art. 4(7) GDPR; Detinker, owner Andreas Bernhardt, Suttkamp 13, 59229 Ahlen (hereinafter the “Contractor”) is, to that extent, the processor within the meaning of Art. 4(8) GDPR. In the event of conflicts between this DPA and the Terms of Service, the provisions of this DPA take precedence in matters of data protection law.
§ 1 Subject matter, nature, purpose and duration
(1) The subject matter is the processing of personal data by the Contractor on behalf of the customer for the purpose of providing the services described in the user agreement (in particular the creation, scheduling and publication of content and, once activated by the customer, automated interaction with the customer’s network and with third-party posts).
(2) Nature of the processing: collection, recording, storage, retrieval/reading, analysis (including AI-based analysis), use, transmission to the recipients/platforms provided for in the user agreement, erasure.
(3) The duration of the processing corresponds to the term of the user agreement. Erasure obligations under § 10 continue to apply after its termination.
§ 2 Categories of data subjects and types of data
(1) Categories of data subjects: the customer’s contacts, persons in the customer’s LinkedIn network, authors of comments and posts, potential contacts with whom the customer interacts.
(2) Types of data: profile and identity data (name, headline, company, profile picture), post and comment texts visible in the network, publicly visible metrics, and assessments derived from these (e.g. suitability score).
(3) The customer does not transmit any special categories of personal data (Art. 9 GDPR) for processing unless this has been separately agreed.
§ 3 Customer’s right to issue instructions
(1) The Contractor processes the data exclusively within the scope of the agreements made and in accordance with the customer’s documented instructions, unless it is required by law to carry out other processing. The customer’s use of the Service’s features is deemed a documented individual instruction.
(2) If the Contractor considers that an instruction infringes data protection provisions, it must inform the customer accordingly; it is entitled to suspend execution of the instruction concerned until it is confirmed or amended.
§ 4 Confidentiality
The Contractor obliges the persons involved in the processing to maintain confidentiality, unless they are already subject to an appropriate statutory obligation of confidentiality. This obligation continues to apply after termination of the contract.
§ 5 Technical and organisational measures
The Contractor takes the technical and organisational measures required under Art. 32 GDPR to ensure a level of protection appropriate to the risk. The measures are described in Annex 1.
§ 6 Further processors (subcontractors)
(1) The customer grants general authorisation to engage further processors (Art. 28(2) GDPR). The subcontractors engaged at the time the contract is concluded are listed in Annex 2.
(2) The Contractor informs the customer of any intended changes concerning the addition or replacement of further processors. The customer may object to a change within four weeks for good cause relating to data protection. If the cause cannot be remedied, either party is entitled to extraordinary termination.
(3) The Contractor imposes on each further processor the same data protection obligations as set out in this DPA (Art. 28(4) GDPR).
§ 7 Transfers to third countries
Transfers of personal data to a third country take place only in compliance with the requirements of Art. 44 et seq. GDPR, in particular on the basis of the Standard Contractual Clauses (Art. 46 GDPR), supplemented, where applicable, by an adequacy decision or the EU-US Data Privacy Framework (Art. 45 GDPR).
§ 8 Assistance with data subject rights
The Contractor assists the customer with appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights (Chapter III GDPR). If a data subject contacts the Contractor directly, the Contractor forwards the request to the customer without undue delay.
§ 9 Assistance with security and notification obligations
The Contractor assists the customer in complying with the obligations under Art. 32 to 36 GDPR. It notifies the customer of personal data breaches without undue delay after becoming aware of them and provides the information required to fulfil the notification and communication obligations (Art. 33, 34 GDPR).
§ 10 Erasure and return
Upon completion of the processing, the Contractor, at the customer’s choice, erases all personal data or returns it and erases existing copies, unless a statutory retention obligation applies. Upon request, the Contractor confirms the erasure in text form (Textform).
§ 11 Inspection and audit rights
The Contractor makes available to the customer all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for inspections. These may take place after reasonable prior notice and without disrupting business operations; proof may also be provided by means of suitable certificates, attestations or reports.
§ 12 Responsibility and liability
Responsibility for the lawfulness of the processing and for safeguarding the rights of data subjects lies with the customer. Liability towards third parties (external relationship) is governed by Art. 82 GDPR; as between the parties (internal relationship), the liability provisions of the Terms of Service apply in addition.
§ 13 Electronic conclusion of the contract
This DPA is concluded in electronic form pursuant to Art. 28(9) GDPR. Acceptance by the customer (consent during onboarding) is documented together with the respective version and a timestamp.
Annex 1 — Technical and organisational measures (Art. 32 GDPR)
- Encryption: transport encryption (TLS) for all connections; interface/API keys issued by customers are stored exclusively as hashes.
- Access control: role-based authorisation concept, tenant separation at database level by means of row-level security, access based on the principle of least privilege.
- Authentication: password-based login with hashed passwords; API/MCP access via hashed, revocable keys.
- Location: processing and storage in data centres in Germany or the EU (Hetzner, Germany; database Frankfurt am Main).
- Availability and recoverability: regular backups of the database by the database/hosting service provider.
- Logging: access and error logs with limited retention (7 days).
- Review: regular review and adjustment of the measures.
Annex 2 — List of subcontractors
| Subcontractor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, operation, queue | Germany | EU |
| Supabase Inc. | Database, authentication, storage | Data in Frankfurt (EU); provider USA | EU storage; SCC for residual access |
| Unipile SAS | Connection to LinkedIn; holds the LinkedIn session | EU | Art. 28 |
| Google (Gemini) | AI-powered text/image generation | Ireland / USA | SCC (Art. 46), DPF where applicable |
| Perplexity (via OpenRouter) | AI-powered research | USA | SCC (Art. 46) |
| Stripe | Payment processing | USA / Ireland | SCC (Art. 46), DPF where applicable |
| Slack | Optional approval/notification channel | USA | SCC (Art. 46), DPF where applicable |
| Clearbit | Company logos based on the domain | USA | SCC (Art. 46) |