Data Processing Agreement (GDPR Art. 28)

1. Parties and conclusion

This agreement is concluded between the customer as controller and MAD Consulting L.L.C-FZ (Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.) as processor, and forms part of the Terms.

The workspace owner accepts it in the app on behalf of the business by ticking a checkbox: they enter the name of the business and confirm that they are authorised to act for it. We log the acceptance with the name of the business, the version and language of the agreement and the time (see section 3 of the Privacy Policy). A signed copy is available on request: hello@sayweek.com.

2. Subject matter and duration

The processor processes the personal data that the customer and its users put into Sayweek or make available from their connected accounts solely to provide the Sayweek service. The agreement runs for the term of the contract under the Terms and remains in force until the data has been deleted (section 11).

3. Nature and purpose of the processing

Storage, organisation, retrieval, AI-assisted writing and analysis, scheduling and – after the customer’s approval – publishing on social networks, statistics, notifications, export and erasure, so that we can write, prepare for approval, schedule and measure the posts of the customer’s brands.

4. Types of personal data

• Names, e-mail addresses, roles, sign-in and activity data of users and team members.
• Posts, ideas, transcribed voice notes, images, videos, stories and any data about people mentioned in them.
• Excerpts from connected calendars, mailboxes (Gmail, Outlook), CRMs, Notion, Drive and OneDrive / SharePoint, and masked excerpts of meeting transcripts – connected or added by hand (pasted, uploaded, forwarded) – processed in memory only; of a transcript only the ideas and a hash of its words are stored (limited as described in the Privacy Policy).
• The transcribed text of messages, links and voice notes sent to the Telegram or WhatsApp bot, the chat id and the display name.
• Comments under the posts on social networks (author name, text – 48 hours at most) and statistics.
• Names and comments that the customer’s clients enter on review links.

5. Categories of data subjects

The customer’s users and team members; the customer’s clients and contacts; people mentioned in content, calendars, e-mails and CRM records; people who comment on the customer’s posts. Processing special categories of data is not intended; the customer does not knowingly enter such data.

6. The controller’s instructions

The processor processes the data only on the customer’s documented instructions – including with regard to transfers to a third country – unless required to do otherwise by law; in that case it informs the customer beforehand, unless the law prohibits this. Instructions are the Terms, this agreement and every setting and action of the customer in the app (e.g. connecting, approving, deleting).

If the processor considers that an instruction infringes the GDPR or other data protection law, it informs the customer without delay. It never uses the data for its own purposes and never uses it to train AI models.

7. Confidentiality

Only people who need access to provide the service, for support or to fix faults, and who have committed themselves to confidentiality or are under a statutory obligation of confidentiality, have access to the data.

8. Security of processing (Art. 32 GDPR)

The processor implements technical and organisational measures appropriate to the risk; they are listed in Annex 1, and a plain-language summary is on the Security page. We may update the measures as technology develops, but the level of protection will not decrease.

9. Sub-processors

The customer gives general authorisation to engage sub-processors. The current list – purpose, data, location – is on the Sub-processors page, which forms part of this agreement.

• We notify the workspace owner by e-mail at least 30 days in advance of any new or replaced sub-processor.
• During that time the customer may object on reasonable data protection grounds. If we cannot find a solution, the customer may terminate free of charge before the change takes effect, and we refund any prepaid, unused period.
• We impose on every sub-processor, in writing, data protection obligations at least equivalent to those in this agreement, and remain liable to the customer for their performance.

Services the customer connects itself (e.g. Google – including Meet and Business Profile –, Microsoft 365, LinkedIn, Meta – including Threads –, TikTok, Bluesky, Zoom, Fireflies.ai, Fathom, tl;dv, Telegram, Unsplash, Pexels, Zapier, Make, AI assistants) are not sub-processors: the customer uses them under its own contract with them, and the processor exchanges data with them only on the customer’s instruction.

10. Assistance and personal data breaches

• The processor assists the customer with data subject requests (access, rectification, erasure, export), primarily through the app’s features, and forwards any such request it receives to the customer.
• It assists the customer in meeting the obligations of Articles 32–36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the information available to it.
• It notifies the workspace owner of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it: what happened, which data and roughly how many people may be affected, the likely consequences, and what we have done or recommend. Missing information follows as soon as it is available.

11. Deletion or return of data

When the contract ends, the customer may first download an export (Settings → Data & privacy → Export, JSON). The processor then deletes all personal data from the database, and from backups within 30 days, unless the law requires it to be kept. Issued invoices are kept not as a processor but under our own legal obligation (see Data deletion).

12. Information and audits

The processor makes available the information needed to demonstrate compliance with this agreement. Once a year (and additionally after a breach or at a supervisory authority’s request) the customer may request written information about the security measures; on-site audits – by an auditor appointed by the customer and bound by confidentiality – are possible with at least 30 days’ notice, during business hours, protecting other customers’ data and at the customer’s cost.

13. International transfers

The processor is established in the United Arab Emirates; the database is located in the EU (Frankfurt). Transfers outside the EU/EEA – to the UAE and to sub-processors in the USA – rely on the European Commission’s Standard Contractual Clauses (SCCs) or another safeguard under Chapter V GDPR, which the parties treat as part of this agreement. [specify the SCC module(s) (Module 2: controller → processor; Module 3: processor → sub-processor), the completed annexes, governing law and forum, and the transfer impact assessment]

14. Liability and precedence

The parties’ liability is governed by the liability provisions of the Terms, having regard to Art. 82 GDPR. In matters of data protection this agreement takes precedence over the Terms. [align the limitation of liability with the Terms and Art. 82 GDPR]

15. Contact

MAD Consulting L.L.C-FZ, Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. · hello@sayweek.com

Annex 1 – Technical and organisational measures

• Encryption: all connections over HTTPS/TLS; third-party access tokens, two-factor secrets and webhook addresses stored encrypted with AES-256-GCM; passwords stored as scrypt hashes.
• Access control: data isolated per workspace (every query is bound to the workspace); roles (owner, editor) and optional two-step approval; passkeys and TOTP two-factor sign-in; re-authentication for operator functions.
• Logging: workspace activity log (approvals, connections, deletions), error log kept 30 days, the contract acceptance log.
• Availability and backups: managed database (Neon, EU) with continuous backups and point-in-time restore; managed hosting (Vercel, EU region).
• Data minimisation: integrations are mostly read-only; e-mail bodies and CRM records are not stored; names, e-mail addresses and amounts are masked before anything is sent to the AI; other people’s comments are deleted after 48 hours.
• Secure development: code review, automated tests, regular dependency updates, security headers (e.g. X-Frame-Options, nosniff), secrets only in the server environment.
• Organisational measures: confidentiality obligations, access limited to the necessary minimum, an incident response procedure (48-hour notice), a vulnerability disclosure policy.
• [to be completed: audits / certifications, penetration test, staff training, device security]