This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Toksta Solutions LTD (company number 13018428, 124 City Road, London, England, EC1V 2NX) (“we”, “us”) and the business customer that has agreed to them (“you”). It applies automatically when you use Flypost for business purposes and we process personal data on your behalf. You do not need to sign anything. If your organisation needs a countersigned copy, email [email protected].
In this DPA, “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, and, where they apply, the EU GDPR and other laws on the processing of personal data. Terms such as “controller”, “processor”, “personal data” and “personal data breach” have the meanings given in Data Protection Law.
1. Roles
For personal data contained in the content you and your team put into Flypost, or that we generate or collect for you (“Customer Personal Data”), you are the controller and we are your processor. Where you act for your own clients, for example as an agency, you may be a processor and we are your sub-processor; you are responsible for having your client's authority to instruct us.
We are a controller, not a processor, for the personal data we need to run our own business: your account, login and billing details, support conversations, security logs and product analytics. Our Privacy Policy covers that data.
2. Details of the processing
| Subject matter and purpose | Providing the Flypost service: storing and analysing your source material, generating content, scheduling and publishing to LinkedIn, post analytics, team collaboration and support. |
|---|---|
| Duration | For as long as you use Flypost, and then until deletion under section 9. |
| Data subjects | Your team members; your clients and their staff; people named or quoted in your source material and posts; people who engage with your LinkedIn posts (for example commenters and reactors), where you use analytics; LinkedIn creators you choose to follow for inspiration. |
| Types of personal data | Names, job titles, employers and professional profile information; content of documents, notes, transcripts and posts; LinkedIn post and engagement data; images you upload. We do not ask for special category data, and you should only include it where it is necessary and lawful. |
| Nature of processing | Collection, storage, organisation, indexing (including creating text embeddings), analysis, AI generation, transmission to LinkedIn and other services you connect, retrieval and deletion. |
3. Our obligations
We will:
- process Customer Personal Data only on your documented instructions, which are these Terms, this DPA and your use and configuration of Flypost, unless the law requires otherwise (in which case we will tell you first, unless the law prohibits that);
- tell you if we believe an instruction breaks Data Protection Law;
- not use Customer Personal Data to train AI models, and not sell it or use it for our own marketing;
- make sure everyone we authorise to process it, including staff and contractors, is bound by confidentiality, and give access only to those who need it;
- keep the security measures in section 5 in place;
- help you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights, and to carry out data protection impact assessments and consult regulators where required;
- make available the information you reasonably need to show compliance with this DPA (section 8).
4. Sub-processors
You authorise us to use the sub-processors listed in our Privacy Policy. We impose data protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.
We will give at least 30 days' notice before adding or replacing a sub-processor that processes Customer Personal Data, by updating the list and emailing account owners who have asked to be told (email [email protected] with the subject “Sub-processor updates”). If you object on reasonable data protection grounds, we will discuss it with you in good faith. If we cannot resolve it, you may cancel and we will refund any prepaid fees for the period after cancellation.
5. Security
We maintain technical and organisational measures appropriate to the risk, including:
- encryption in transit (TLS) for all connections, and encryption at rest by our hosting providers;
- access controls in the database (row-level security) so that each workspace's data is only available to its members, and connected-account tokens are stored server-side;
- staff access to customer accounts limited to support, done-for-you work you have asked for, and incident investigation, and restricted to named members of our team;
- bot protection on sign-up and public forms;
- automated backups by our database provider;
- dependency and security reviews of our code, and prompt fixing of identified vulnerabilities.
6. Personal data breaches
If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and in any event within 48 hours, and give you the information you reasonably need to meet your own obligations, including to notify regulators and affected people. We will take reasonable steps to contain and investigate the breach and to prevent it happening again.
7. International transfers
Our primary database is hosted in the United States (AWS us-east-2, Ohio), and some sub-processors process data in other countries. Where Customer Personal Data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, we rely on an appropriate safeguard, such as the UK-US data bridge for certified US companies, the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum to them. To the extent needed for transfers from you to us, those clauses are incorporated into this DPA by reference (Module 2 where you are a controller, Module 3 where you are a processor), with you as data exporter and us as data importer.
8. Audits
On request, we will answer reasonable security and data protection questionnaires (for example for Cyber Essentials, ISO 27001 or supplier due diligence) and provide the relevant information we hold, including our sub-processors' certifications. If that does not reasonably satisfy a legal requirement you are subject to, we will allow an audit by you or an independent auditor bound by confidentiality, on at least 30 days' notice, no more than once a year, during business hours and at your cost.
9. Deletion and return
You can delete content and projects at any time in the app. When your account is deleted, we delete Customer Personal Data from our live systems within 30 days, and it is removed from backups as they are overwritten. Before deletion, you can copy or download your content from the app, or ask us to help export it. We may keep data where the law requires us to.
10. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow it. If this DPA conflicts with the Terms, this DPA wins for matters about personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the clauses win.
11. Contact
Data protection questions, sub-processor notifications and requests for a signed copy: [email protected].