Data Processing Agreement

This agreement is between the customer (controller) and Anastasios-Nikolaos Kosulin, Bravio (processor). It forms part of the Terms of Service and applies whenever Bravio processes personal data on the customer's behalf.

Subject: creating, storing and publishing social media content. Nature: collection from the customer's website, storage, AI-based generation and editing, publishing. Purpose: providing the Bravio service.

Duration: the term of the Terms of Service, plus the deletion period in section 8.

Data subjects: the customer's staff and representatives, people shown on the customer's website or in uploaded material, and people who appear in or interact with published content.

Data: names, images, likenesses, voices, contact details visible on the website, content of texts and media, and account and usage data of the customer's users. Bravio does not process special categories of data (Art. 9 GDPR) on purpose and does not create biometric templates.

Bravio processes the data only on documented instructions of the customer. The Terms of Service and the customer's settings in Bravio (such as automatic publishing) are the instructions. Bravio informs the customer if it believes an instruction breaks data protection law.

Persons authorised to process the data are bound to confidentiality. Bravio takes appropriate technical and organisational measures (Art. 32 GDPR), in particular: encrypted transmission (TLS); private storage without public links; access only after sign-in and only to the customer's own data; administrative access limited to the operator; separation of customer data by account; regular backups by the database provider; secrets kept server-side; prompt security updates.

The customer authorises the subprocessors listed in the dashboard under Settings (the Subprocessors page shows their types). Bravio informs customers by email at least 14 days before adding or replacing a subprocessor; the customer may object for good reason and, if no solution is found, terminate the affected service. Bravio imposes data protection obligations on each subprocessor equivalent to this agreement, and ensures a transfer safeguard under Art. 44 ff. GDPR for transfers outside the EU/EEA.

Bravio supports the customer with data subject requests, security, breach notifications, data protection impact assessments and consultations (Art. 32-36 GDPR), as far as possible given the nature of the processing. Bravio informs the customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting customer data.

When the contract ends, Bravio deletes customer data within 30 days, unless the law requires retention. The customer can export content before that. Backups roll off within a further 30 days.

Bravio provides the information needed to show compliance with Art. 28 GDPR and allows audits by the customer or an auditor bound to confidentiality, after reasonable notice, normally once a year and at the customer's cost.

In case of conflict, this agreement takes precedence over the Terms of Service on data protection matters. German law applies.