Effective date: October 20, 2026

This Data Processing Addendum ("DPA") applies when you ("Customer") put personal data about other people, such as your own clients, contacts or audience, into Social Studio OS, and McFarlane Marketing LLC ("we," "us") processes that data for you. It is part of our Terms of Service. Words not defined here have the meanings in the Terms and in applicable data protection laws.

1. Roles

For personal data of others that you place in the Service ("Customer Personal Data"), you are the controller (or "business") and we are your processor (or "service provider"). You decide why and how the data is used. We process it only on your documented instructions.

2. What we process

• Subject matter and purpose: providing the Service, including hosting your workspace, drafting content with AI, publishing content you approve, and producing analytics and reports.
• Duration: while your membership is active and for the retention period in the Terms and Privacy Policy.
• Types of data and people: names, contact details, social account names, content and similar business information about your clients, contacts, audience and team members.
• Special categories: the Service is not designed for sensitive personal data. Please do not put it in.

3. Our commitments

We will:

• process Customer Personal Data only to provide the Service to you and as you instruct (your use of the Service, and these terms, are your instructions), unless the law requires otherwise, and tell you if we believe an instruction breaks the law;
• keep it confidential, and make sure people who handle it are bound to confidentiality;
• protect it with appropriate technical and organizational measures, including encryption of sensitive credentials, database-enforced separation between workspaces, access controls and monitoring;
• not sell it, and not use it for our own marketing or to train AI models;
• help you respond to requests from the people the data is about, taking into account the nature of the Service, and refer any request we receive directly to you;
• tell you without undue delay, and within seventy-two (72) hours of confirming it, if a personal data breach affects Customer Personal Data, with the information we have to help you meet your own obligations;
• on request, give you the information reasonably needed to show our compliance with this DPA.

4. Providers (sub-processors)

You authorize us to use service providers to run the Service, in the categories listed in our Privacy Policy. Each is bound by written terms that protect the data. A current list is available on request at info@mcfarlanemarketing.com. We will tell the workspace administrator at least fourteen (14) days before adding a new provider that will process Customer Personal Data; if you reasonably object on data protection grounds and we cannot accommodate you, you may cancel without penalty.

5. Returning and deleting data

While your workspace is active, you can export your posts and delete content yourself. When your membership ends, your data is handled under the retention schedule in the Terms and Privacy Policy: kept for at least ninety (90) days, then deleted after notice, with copies in routine backups removed in their normal cycle. Certain files are deleted earlier under the automatic schedules described in the Privacy Policy. We may keep what the law requires us to keep.

6. Your responsibilities

You confirm you have a lawful basis and any needed notices and consents to put Customer Personal Data into the Service, and that your instructions follow the law. You are responsible for the accuracy of the data and for how you use the output.

7. International transfers

We are based in the United States, and Customer Personal Data is processed there. Where European or UK data protection law requires a transfer mechanism for data you send us, we will enter into the standard contractual clauses approved for that purpose with you on request, and this DPA applies together with them.

8. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as we process Customer Personal Data for you. If this DPA conflicts with the Terms on how Customer Personal Data is processed, this DPA controls.

Contact

info@mcfarlanemarketing.com · McFarlane Marketing LLC, 5245 Elmore Ave., #1112, Davenport, IA 52807