Data processing agreement

1. Who this is for

This agreement is between the owner of Bennu (available on request from help@heybennu.com), called “we” or “us”, and the business that uses Bennu, called “you”.

It is written mainly for agencies that use Bennu to run social media for their clients. It also applies to any business customer whose content in Bennu includes personal data about other people.

Words such as controller, processor, personal data, processing and data subject have the meanings given in the UK GDPR, or the EU GDPR where that applies. Together we call these laws “data protection law”.

2. Roles

• For personal data in the content you put into Bennu, and in the posts we make from it (“your data”), you are the controller and we are your processor.
• If you are an agency, your client is usually the controller, you are their processor, and we are your subprocessor.
• For your own account, billing and how we run and improve Bennu, we are a controller. Our privacy policy covers that, not this agreement.

3. Your instructions

• We only process your data on your documented instructions. Your instructions are our terms, this agreement, the choices you make in Bennu (such as what to post, where and when) and anything else you tell us in writing that we agree to.
• If the law requires us to process your data in another way, we will tell you first, unless the law stops us.
• If we think an instruction breaks data protection law, we will tell you straight away.
• We never sell your data, and we never use it for another customer.

4. Our people

Only people who need access to provide Bennu can see your data. Each of them is bound to keep it confidential.

5. Security

We use appropriate technical and organisational measures to protect your data, as Article 32 requires. Annex 2 describes them. We may improve them over time, but we won’t make them weaker overall.

6. Subprocessors

• We use subprocessors to provide Bennu. You give general authorisation for this. We’ll send you the current list on request, and we’ll tell you before we add or replace one, so you can object.
• We will email you at least 30 days before we add or replace a subprocessor. You can object on reasonable data protection grounds within that time. We will try to find a solution. If we can’t, you can end the affected part of your plan and we will refund what you have paid for time you haven’t used.
• Each subprocessor is bound by a written contract with data protection terms that protect your data at least as well as this agreement.
• We remain responsible to you for our subprocessors.

7. Helping you meet your duties

• Requests from people. If someone asks us directly to see, correct or delete their data, we will pass the request to you without delay and won’t answer it ourselves unless you ask us to. You can delete photos, clips and posts in Bennu at any time. For anything you can’t do yourself, we will help.
• Risk assessments. We will give you reasonable help with data protection impact assessments and with any consultation with a regulator, based on the information we have.

8. Data breaches

If we become aware of a breach affecting your data, we will tell you without undue delay and in any case within 48 hours. We will tell you what happened, what data and people are likely to be affected, what we are doing about it and who you can contact. We will send more information as we get it, and we will help you meet your own duty to report it.

9. When your plan ends

• You can download or copy your content until your plan ends, and for 90 days after.
• After 90 days we delete the photos, clips and media in your account. We delete or anonymise the rest of your data as our privacy policy describes.
• If you ask, we will delete your data sooner.
• We may keep data where the law requires us to, and only for as long as it does. This agreement keeps protecting that data.
• Backups are overwritten on their normal cycle.

10. Information and audits

• We will give you the information you reasonably need to show that we meet this agreement, including answers to reasonable security questionnaires.
• If that isn’t enough, or a regulator asks, you can audit our compliance once a year, with at least 30 days’ notice, during working hours, under a confidentiality agreement and at your own cost. Our subprocessors’ own independent certifications and reports may be used for their part.

11. International transfers

• We store your data in London. Some subprocessors may process it outside the UK, and the current list we send on request shows where. We only allow that with a lawful safeguard in place, such as a UK adequacy decision or the UK-US data bridge, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.
• For data from the EU, the European Commission recognises the UK as adequate. Where an onward transfer outside the UK involves EU data, we use the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
• If a transfer from you to us ever needs Standard Contractual Clauses, the EU clauses (Module 2 where you are a controller, Module 3 where you are a processor), with the UK Addendum where relevant, form part of this agreement, using the details in Annexes 1 to 3.

12. Extra terms for agencies

• You confirm you have a written contract with each client that allows you to use Bennu, and us as your subprocessor, for their data.
• You pass on your clients’ instructions to us. Your clients don’t instruct us directly, and we deal with you.
• If a client asks to see our safeguards or this agreement, you can share it with them.
• You are responsible for each client’s content meeting our terms and acceptable use policy.
• When a client leaves you, remove their brand from Bennu or ask us to, and we will delete their data as section 9 describes.

13. Your responsibilities

• You make sure you have a lawful basis for the data you put into Bennu, and that the people concerned have been told how it will be used.
• You get permission from everyone who can be recognised in photos and clips before they are used in posts, and from a parent or guardian for anyone under 18.
• You don’t put special category data into Bennu, such as information about someone’s health, unless you have the person’s explicit consent. For example, before and after photos from a clinic can reveal health information.
• Your instructions to us must follow data protection law.

14. General

• This agreement lasts as long as we process your data for you.
• The limits on responsibility in our terms apply to this agreement, as far as the law allows.
• If this agreement and our terms disagree on data protection, this agreement wins. If Standard Contractual Clauses apply, they win over both.
• This agreement is governed by the law of England and Wales.

Annex 1: details of the processing

Annex 2: security measures

• All data travels encrypted (TLS). Our storage provider encrypts data at rest.
• The database and files are stored in London.
• Every table has row level security. Each business can only read its own rows, and every change goes through a server check of ownership.
• Photos and videos are in private storage, shown only through links that expire after an hour.
• Secret keys are kept only on our servers, with automatic scanning to stop them leaking into code.
• Social media logins are handled by our publishing partner’s secure page. We never see or store social media passwords.
• Payment webhooks are signature-checked. Card details are held by Stripe only.
• Bot protection, rate limits and spending limits on every paid service.
• Text from websites and search results is treated as untrusted, so it can’t instruct our AI tools.
• Staff access is limited to the people who need it, at the moment the founder, with admin access checked on every request.
• Daily database backups by our storage provider.

Annex 3: subprocessors

We use subprocessors to provide Bennu. You give general authorisation for this. We’ll send you the current list on request, and we’ll tell you before we add or replace one, so you can object. Email help@heybennu.com to ask for it.