Data Processing Agreement

1.1 This DPA is between Herman Foundry Oy, Business ID 3636930-1, Äijinpolku 1, 99140 Kittilä, Finland, which runs FeedSquad ("FeedSquad", "we"), and the person or organisation that has accepted the Terms ("Customer", "you").

1.2 For Customer Personal Data (section 2) you are the controller and FeedSquad is your processor. If you use FeedSquad for your own clients, for example as an agency, you act as their processor and FeedSquad is your sub-processor; this DPA then applies in the same way, and you are responsible for passing on to your clients what it says.

1.3 FeedSquad is the controller of the personal data it processes for its own purposes: your account and the accounts of your team, billing, support, security, product analytics and its own legal obligations. That processing is described in the privacy policy and is not covered by this DPA.

1.4 Some platforms bind FeedSquad directly with rules about their members' data, for example LinkedIn's limits on how long comment data may be kept and what it may be used for. FeedSquad applies those rules to Customer Personal Data from that platform (Annex 1 lists them), and an instruction from you cannot widen them.

"GDPR" means Regulation (EU) 2016/679. "Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings the GDPR gives them. "Data Protection Law" means the GDPR, the Finnish Data Protection Act (1050/2018) and any other data protection law that applies to the processing.

"Customer Personal Data" means personal data about people other than FeedSquad's own account holders that you submit to the Service, or that the Service collects because you asked it to, as described in Annex 1. "Service" and "Terms" have the meanings in the Terms of Service. "Sub-processor" means another processor FeedSquad engages to process Customer Personal Data. "SCCs" means the standard contractual clauses in the annex to Commission Implementing Decision (EU) 2021/914.

3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3.2 FeedSquad processes Customer Personal Data only to provide the Service to you, to keep it secure and working, and to comply with the law.

3.3 FeedSquad does not sell Customer Personal Data, does not use it to build profiles for its own purposes, does not combine it with data from other customers, and does not use it to train AI models.

4.1 FeedSquad processes Customer Personal Data only on your documented instructions, including for transfers to a third country, unless EU or Member State law requires otherwise. In that case FeedSquad will tell you about the legal requirement before processing, unless the law forbids it.

4.2 Your instructions are: the Terms and this DPA; the features you switch on and the settings you choose; and the actions you take in the Service, in a connected messaging channel or through an AI assistant you have authorised. Further instructions must be in writing and consistent with the Service as offered.

4.3 FeedSquad will tell you immediately if, in its opinion, an instruction infringes Data Protection Law. FeedSquad may then refuse to follow it until you confirm or change it.

You are responsible for:

• having a lawful basis for the processing you instruct, including consent where it is needed (for example, for newsletter subscribers you import);
• giving the people concerned the information Articles 13 and 14 of the GDPR require, for example in your own privacy notice or newsletter sign-up form;
• not submitting special categories of personal data (Article 9) or data about criminal convictions (Article 10), which the Service is not designed for;
• following the terms of the platforms you connect;
• the accuracy of the Customer Personal Data you provide.

FeedSquad ensures that every person it authorises to process Customer Personal Data is bound by confidentiality, by contract or by law, and processes it only as this DPA allows.

7.1 FeedSquad implements the technical and organisational measures in Annex 2 to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing and its risks (Article 32 GDPR).

7.2 FeedSquad may change these measures as technology and risks change, provided the overall level of protection does not decrease.

8.1 You give FeedSquad general written authorisation to engage sub-processors. The current list is at feedsquad.com/privacy/subprocessors and forms Annex 3.

8.2 FeedSquad imposes on each sub-processor, by contract, data protection obligations that give at least the protection this DPA requires, in particular sufficient guarantees of appropriate technical and organisational measures. FeedSquad remains fully liable to you for the performance of each sub-processor's obligations.

8.3 FeedSquad will tell you about any intended addition or replacement of a sub-processor at least 14 days before it starts processing Customer Personal Data, by email to account owners or by a notice in the app, and by updating the list.

8.4 You may object on reasonable grounds relating to data protection by emailing privacy@feedsquad.com within that period. We will then try in good faith to find a solution, for example by not using the new sub-processor for your data. If we cannot, you may terminate the affected part of the Service before the change takes effect, and we will refund any fees you have prepaid for the period after termination.

9.1 If FeedSquad receives a request from a data subject about Customer Personal Data, it will pass it to you without undue delay and will not answer it itself except to tell the person that it has passed the request on, unless you authorise otherwise.

9.2 Taking into account the nature of the processing, FeedSquad helps you answer requests to exercise data subjects' rights. In the Service you can look up and erase newsletter subscribers (erasure also redacts their consent records) and remove team members. For anything the Service does not let you do yourself, email privacy@feedsquad.com and we will do it within a reasonable time.

9.3 LinkedIn members who comment on your Company Page may also write to us directly, as the privacy policy invites them to. We will act on such a request for erasure or objection and tell you that we have done so.

Taking into account the nature of the processing and the information available to it, FeedSquad helps you meet your obligations under Articles 32 to 36 GDPR: security, breach notification, data protection impact assessments and prior consultation with a supervisory authority. Most of what you need is in this DPA, its annexes and the privacy policy. For anything more, email privacy@feedsquad.com. FeedSquad may charge a reasonable fee for assistance that goes beyond providing the documentation it already has.

11.1 FeedSquad will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Our target is to notify you within 48 hours, so that you can meet the 72-hour deadline in Article 33 GDPR.

11.2 The notice goes to your account's email address. It describes, as far as we know at that point, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot give everything at once, we give it in stages without further undue delay.

11.3 FeedSquad will take reasonable steps to contain the breach and reduce its effects, and will cooperate with you. Notifying a breach is not an admission of fault.

12.1 While your account is active you can delete Customer Personal Data in the Service, and export it where the Service offers an export (for example the newsletter consent log). On request we will send you a copy of Customer Personal Data in a common machine-readable format.

12.2 When the Service ends, or when you ask us to delete your account, FeedSquad deletes Customer Personal Data without undue delay, and within 30 days, unless EU or Member State law requires it to keep it. If you want a copy first, ask before the deletion is processed.

12.3 Copies in our providers' backups are removed as those backups expire in the normal cycle, and are not used in the meantime except to restore the Service after an incident.

13.1 FeedSquad makes available to you the information needed to demonstrate compliance with Article 28 GDPR. In the first place that is this DPA, its annexes, the sub-processor list, and written answers to your reasonable security questionnaire, no more than once a year unless a breach or a supervisory authority makes another necessary.

13.2 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, you may audit FeedSquad, yourself or through an independent auditor bound by confidentiality. You give at least 30 days' written notice, the audit takes place during business hours with minimal disruption, it does not give access to other customers' data or to our providers' systems, and it is at your cost.

14.1 FeedSquad stores Customer Personal Data primarily in the EU. Some sub-processors process it outside the European Economic Area, as Annex 3 shows. FeedSquad makes those transfers only under Chapter V of the GDPR: under an adequacy decision, which for a US recipient means the EU–US Data Privacy Framework where Annex 3 shows the recipient is certified under it, or under the SCCs in the sub-processor's data processing terms. Annex 3 names the safeguard for each sub-processor.

14.2 To the extent the processing under this DPA involves a transfer from you to FeedSquad, or from FeedSquad to you, that is not covered by an adequacy decision, the SCCs are incorporated into this DPA by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. For the SCCs: the optional docking clause (Clause 7) applies; under Clause 9 option 2 (general written authorisation) applies with the notice period in section 8.3; the optional wording in Clause 11 does not apply; under Clauses 17 and 18 the law of Finland and the courts of Finland apply; the supervisory authority is the one Clause 13 designates, or otherwise the Finnish Data Protection Ombudsman; and Annexes I to III of the SCCs are completed by Annexes 1 to 3 of this DPA. If the SCCs conflict with this DPA, the SCCs prevail.

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability in section 10 of the Terms, including the cap of the fees paid to FeedSquad in the 12 months before the event that gave rise to the claim. Those limits do not apply to damage caused intentionally or through gross negligence, or where Data Protection Law (including Article 82 GDPR) does not allow liability to be limited. Nothing in this DPA limits the rights of data subjects.

16.1 This DPA applies for as long as FeedSquad processes Customer Personal Data for you, and ends when that data has been deleted under section 12.

16.2 If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. If the SCCs apply and conflict with either, the SCCs prevail.

16.3 We may update this DPA to reflect changes in the law, in the Service or in our sub-processors. We will give at least 30 days' notice, by email to account owners or by a notice in the app, of any change that reduces your protection. The version in force is always at feedsquad.com/dpa, with the date it was last updated.

This DPA is governed by the laws of Finland. Disputes are resolved in the courts of Finland, as the Terms provide, without prejudice to a data subject's right to bring a claim where Data Protection Law allows.

These are the technical and organisational measures in place on the date above.

The sub-processors are those listed at feedsquad.com/privacy/subprocessors (last changed October 22, 2026), with the purpose, data, location and transfer safeguard of each. As of that date:

Herman Foundry Oy, Äijinpolku 1, 99140 Kittilä, Finland. Privacy and DPA questions: privacy@feedsquad.com.