Data Processing Addendum

Last updated: 19 October 2026

This addendum sets out how we handle personal data that you, our customer, manage through IGNIPOST. You decide what happens to that data, and we process it only on your instructions. It covers the terms that article 28 of the GDPR requires, in plain language.

1. Parties and scope

This Data Processing Addendum ("DPA") is between you, the customer who holds an IGNIPOST account ("you"), and IGNITECH SARL AU, 13, Rue Ahmed El Majjati, Résidence Les Alpes, 1er étage N° 8, Quartier Maarif, Casablanca (Anfa), Morocco, ICE 002265699000050, R.C. 432325 (Casablanca), I.F. 34488439 ("we").

It forms part of our Terms of Service and applies when we process personal data for you that is protected by the GDPR, the UK GDPR or Moroccan Law 09-08. You accept it when you accept the Terms of Service. If this DPA and the Terms of Service conflict on a data protection point, this DPA wins.

2. Roles

• You are the controller of the personal data in the content and contacts you manage through IGNIPOST: your social posts, inbox messages and contact lists ("Customer Personal Data").
• We are your processor for that data.
• For your own account data, such as your name, email and billing details, we are a separate controller, and our Privacy Policy applies.

3. Subject matter

We process Customer Personal Data to provide IGNIPOST to you: publishing to the networks you connect, the unified inbox for Facebook Messenger and Instagram Direct, comment-to-DM automation, chat flows, drip sequences, optional AI writing assistance, the media library and team workspaces.

4. Duration

We process Customer Personal Data for as long as your account is open, and then until it is deleted as described in section 11.

5. Nature and purpose

We collect, store, organize, display, send and delete Customer Personal Data, only as needed to run the features you turn on. We do not use it for our own purposes, we do not sell it, and we do not use it to build advertising profiles.

6. Categories of data subjects and personal data

Data subjects

• people who send messages or comments to the Pages and accounts you connect;
• people on your contact lists;
• people who appear in the content and media you upload;
• members of your team workspace.

Personal data

• contact profile data received from Meta: name, profile picture and page-scoped ID;
• the content of messages and comments;
• contact list fields you add;
• posts, images, videos and other media you upload.

IGNIPOST is not designed for special categories of personal data, such as health data. Please do not use it for them.

7. Your responsibilities

• You have a legal basis for the Customer Personal Data you process with IGNIPOST.
• You tell the people you message how you use their data.
• You follow Meta's messaging rules and the terms of every network you connect.
• Your instructions to us comply with the law.

8. Our duties as processor

We will:

• process Customer Personal Data only on your documented instructions, which are these terms and the settings you choose in IGNIPOST, unless the law requires otherwise. If the law requires otherwise, we will tell you first unless the law forbids it;
• tell you if we think an instruction breaks data protection law;
• make sure everyone at IGNITECH who can access the data is bound by confidentiality;
• apply appropriate technical and organizational security measures, including encryption in transit and at rest, AES-256 encryption of access tokens, password hashing and role-based access. See our Security page;
• use sub-processors only as described in section 9.

9. Sub-processors

You authorize us to use these sub-processors:

A current list is available on request at [email protected]. We give each sub-processor data protection duties that are at least as protective as this DPA, and we remain responsible to you for its work.

Before we add or replace a sub-processor, we will give you notice by email. If you have a reasonable data protection objection, tell us within the notice period. We will try to find a solution, and if we cannot, you may stop using the affected feature or close your account.

10. Assistance

Taking into account the nature of the processing, we will help you:

• answer requests from people who use their data protection rights, such as access or deletion. If a request comes to us directly, we will pass it to you and not answer it ourselves unless you ask us to;
• meet your duties on security, breach notification, data protection impact assessments and prior consultation with authorities, using the information available to us.

11. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any case within 72 hours. Our notice will describe, as far as we know at the time, what happened, the data and people affected, the likely consequences and what we are doing about it. We will send further details as we learn them.

12. Deletion and return

While your account is open, you can download or delete your content, messages and contacts. When you delete your account, we erase Customer Personal Data within 30 days, and backups roll off within 35 days, unless the law requires us to keep it. When you disconnect a Page or account, we delete the data we received from Meta for it.

13. Audits

We will give you the information you reasonably need to show that we meet this DPA. Audits are carried out by documentation: on request, we will share a description of our security measures, our sub-processor list and written answers to reasonable security questionnaires. If a supervisory authority requires more, we will cooperate with it.

14. International transfers

We host Customer Personal Data on servers in the European Union (Germany), behind Cloudflare, with files on Cloudflare R2. IGNITECH SARL AU is based in Morocco, and our team may access the data from there to run and support the service. Some sub-processors also operate outside the EEA and the UK.

Where the GDPR or UK GDPR applies and personal data is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses apply between you and us, with the UK addendum where needed, and we put equivalent safeguards in place with our sub-processors.

15. Liability and changes

Liability under this DPA follows the limits in our Terms of Service, except where data protection law does not allow it. We may update this DPA to reflect changes in the law or in our service. We will tell you about significant changes before they apply.

16. Contact

For questions about this DPA, or to request the sub-processor list or our security documentation, email [email protected].