Data processing agreement

Last updated: 23 October 2026

This data processing agreement (the "DPA") applies between the customer as controller (the "controller") and Internet am Dornbusch, owner Sajjad Hanifa, Eschersheimer Landstraße 297, 60320 Frankfurt am Main, Germany, as processor (the "processor"). It supplements the terms and conditions for the use of Blog Automation (the "main contract").

How to conclude the DPA

You do not need to do anything: this DPA applies in every plan, including the Free plan. It is part of the main contract (§ 13 of the terms) and is deemed concluded on sign-up. No signature on paper is required; under Art. 28 (9) GDPR, electronic form is sufficient.

For your data protection records you can save or print this page. On request, you receive a copy as a document: in the app under Settings, Privacy ("Request DPA or data export"), by e-mail to info@blog-automation.com or through the contact form.

§ 1 Subject matter and duration

1. The subject matter of this DPA is the processing of personal data that the processor carries out for the controller when providing the online application Blog Automation under the main contract.
2. The DPA applies as long as the processor processes personal data for the controller, and at least for the term of the main contract.

§ 2 Nature and purpose of processing

1. The processor processes the data exclusively to provide the service under the main contract, in particular to
   • manage user accounts, roles and rights of the controller's team,
   • store and edit topics, ideas, notes, brand voice settings and posts,
   • create and revise texts and images with the help of AI providers,
   • review, schedule and publish posts on the controller's WordPress websites in the approval workflow,
   • send e-mail notifications and record actions in the activity log.
2. Processing includes in particular collecting, storing, organising, altering, retrieving, transmitting to the sub-processors listed in annex 2 and to the controller's WordPress websites, and erasing the data.

§ 3 Types of data and data subjects

Special categories of personal data (Art. 9 GDPR), for example health data, and data relating to criminal convictions (Art. 10 GDPR) are not intended to be processed. The controller does not enter such data into the service.

§ 4 Instructions

1. The processor processes the data only on documented instructions from the controller, including with regard to transfers to third countries, unless it is required to do otherwise by the law of the European Union or a member state. In that case, it informs the controller of this requirement before processing, unless the law prohibits this.
2. Instructions are the main contract, this DPA and the settings the controller makes in the app, for example for approvals, automations and connected websites. The controller gives further instructions in text form.
3. If the processor considers an instruction to be unlawful, it informs the controller without delay.

§ 5 Confidentiality

The processor only uses people who have committed themselves to confidentiality or are under a statutory obligation of confidentiality. They process the data exclusively on the controller's instructions.

§ 6 Technical and organisational measures

1. The processor takes the technical and organisational measures required under Art. 32 GDPR to ensure a level of security appropriate to the risk. Annex 1 describes the measures.
2. The processor may adapt the measures to technical progress as long as the level of protection is not reduced.

§ 7 Sub-processors

1. The controller gives the processor general authorisation to engage other processors (sub-processors). Annex 2 lists the sub-processors engaged at conclusion.
2. The processor informs the controller in advance of any intended addition or replacement of a sub-processor. The information is given by e-mail to the owners of the account and by updating the sub-processors page, as a rule at least four weeks before the change. The controller may object to the change within four weeks of receiving the information for an important data protection reason. If the parties find no solution, the controller may terminate the services concerned or the main contract.
3. The processor contractually binds each sub-processor to the same data protection obligations as set out in this DPA, in particular to appropriate technical and organisational measures.
4. If the controller stores its own AI keys in the Pro plan, the respective AI provider processes the data under the contract the controller itself has concluded with it. That provider is then not a sub-processor of the processor.

§ 8 Transfers to third countries

1. Processing outside the European Union or the European Economic Area only takes place if the conditions of Art. 44 et seq. GDPR are met.
2. The processor uses OpenAI for the AI features. The processor's contracting party is OpenAI Ireland Ltd., Dublin, Ireland; OpenAI's data processing addendum is part of the OpenAI Services Agreement that the processor has concluded for API use. Requests go to OpenAI's general API without a fixed data region. OpenAI may therefore also process the data outside the European Economic Area, in particular in the USA. Where OpenAI Ireland Ltd. transfers data to affiliates or third parties outside the European Economic Area, it does so under the addendum on the basis of standard contractual clauses (Art. 46 (2) (c) GDPR) or an adequacy decision of the European Commission (Art. 45 GDPR).

§ 9 Assistance to the controller

1. The processor assists the controller with appropriate measures in responding to requests from data subjects exercising their rights (Art. 12 to 23 GDPR). If a data subject contacts the processor directly, it forwards the request to the controller without delay.
2. The processor also assists the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular security of processing, notification of personal data breaches and data protection impact assessments, to the extent the necessary information is available to it.

§ 10 Notification of personal data breaches

The processor notifies the controller of a personal data breach without undue delay after becoming aware of it. As far as known, the notification contains the information under Art. 33 (3) GDPR. The processor takes measures without delay to limit the consequences.

§ 11 Deletion and return

1. On request, the processor provides the controller with an export of its data.
2. After the end of the services, the processor deletes the controller's data 30 days after the end of the contract, unless the law of the European Union or a member state requires storage. On request, it confirms the deletion in text form.

§ 12 Evidence and audits

1. The processor makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
2. It allows for audits, including inspections, by the controller or an auditor mandated by the controller who is bound to confidentiality. Inspections must be announced with reasonable notice and take place during normal business hours without unnecessarily disrupting operations.

§ 13 Obligations of the controller

1. The controller is responsible for the lawfulness of the processing, in particular for being allowed to enter the data into the service and have it processed by AI providers.
2. If the controller notices errors or irregularities in the processing, it informs the processor without delay.

§ 14 Liability and final provisions

1. Liability is governed by Art. 82 GDPR. Otherwise, the liability rules of the main contract apply.
2. In case of conflict between this DPA and the main contract, this DPA takes precedence in matters of data protection.
3. Changes and additions require text form. The law of the Federal Republic of Germany applies.
4. If a provision is invalid, the remaining provisions remain valid.

Annex 1: Technical and organisational measures

The following measures apply (as of 23 October 2026):

• Location: the app and its database run on servers operated by the processor itself in a data centre of STRATO GmbH in Germany. STRATO is responsible for physical access and security of the data centre.
• Transport encryption: the app is only reachable via HTTPS (TLS). Connections to WordPress websites, AI providers and the mail server are encrypted.
• Passwords: stored only as a hash using Argon2.
• Encrypted credentials: WordPress credentials are stored encrypted with AES-256. Own AI keys (Pro plan) are stored encrypted; only the last 4 characters are visible in the interface.
• Login: password with at least 10 characters, passkey or login code by e-mail. The "stay signed in" option lasts at most 30 days.
• Login control: the app shows a list of signed-in devices and the login history.
• Separation of customer data: each customer's data is separated at database level (row level security).
• Access control: six system roles (owner, administrator, editorial team, author, reviewer, read only), custom roles with a rights matrix per area and individual rights per person.
• Approval before publication: posts go through the statuses draft, in review, approved, scheduled and published. Posts are only scheduled or published automatically after approval by an authorised person.
• Activity log: actions in the account are recorded in a log.
• Data minimisation for AI: texts are only sent to the AI provider for the respective action, and the app asks OpenAI not to store the responses (parameter "store: false"). OpenAI states that data sent via its API is not used to train the models; OpenAI keeps abuse monitoring logs for up to 30 days by default, unless the law requires longer retention.
• WordPress connection: only to websites with HTTPS, via an application password that the controller can revoke in WordPress at any time. A user with the role Editor instead of Administrator is recommended.
• Protection against misuse: requests to the app, in particular sign-in attempts, are rate limited.
• Backup: the database is backed up before every update of the app; if an update fails, the previous version is restored.
• Deletion: after the end of the contract, data is deleted under § 11. When a website is disconnected, its credentials are no longer used.
• Data export: on request.
• Review: the processor reviews the measures with every major change of the app, at least once a year, and adapts them.
• Two-factor login with an authenticator app: as long as the app shows it as not yet available, the processor recommends signing in with a passkey.

Annex 2: Sub-processors

The current list with purpose, location and legal basis is on the page sub-processors. It forms part of this DPA.

Questions about the DPA

If you have questions about the DPA or data protection, contact us by e-mail at info@blog-automation.com, by phone at +49 69 34 87 77 44 or via the contact form. The page GDPR & security gives an overview of hosting and data flow.