Data Processing Agreement

Summary of the Romanian version · Art. 28 GDPR

If the Romanian and English versions differ, the Romanian version prevails.

This agreement under Art. 28 GDPR applies when a business uses Postero and uploads personal data of other people (such as its clients). The customer is the controller; RANKO HUB SRL (Vulcan, Romania, tax ID 51588879) is the processor. It forms part of our Terms of Service.

Purpose: storing content, scheduling and publishing it to the networks chosen by the customer, statistics and collaboration, for as long as the Service is used.
Processor duties: processing only on documented instructions, confidentiality of authorized staff, appropriate security measures (TLS, bcrypt password hashing, databases isolated from the internet, restricted administrative access), assistance with data subject requests and Art. 32-36 obligations.
Sub-processors: Hetzner Online GmbH (hosting, Finland, EU), Cloudflare, Inc. (DNS, protection, HTTPS delivery, email forwarding; USA), OpenAI, L.L.C. (AI features only when used; USA). Transfers outside the EEA rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses. 15 days' email notice before adding or replacing a sub-processor, with a right to object. The connected social networks are independent controllers, not sub-processors.
Breach notification: without undue delay and within 48 hours of discovery.
End of service: deletion within 30 days, export available on request beforehand. Backups are overwritten within 12 months.
Audit: written answers within 30 days. On-site audit once a year with 30 days' notice, at the customer's cost.
Law: Romanian law. A signed copy is available at [email protected].