Data processing agreement

1. The parties and how this applies

This agreement is between Nexborne Ltd ("we", the processor), which runs Helio Posts, and the business that holds a Helio Posts account ("you", the controller). It forms part of our terms of service and applies automatically when you use the service. No signature is needed. If this agreement and the terms disagree about personal data, this agreement wins.

Words such as controller, processor, personal data, data subject and personal data breach have the meaning given in the UK GDPR.

2. What we process

• Subject matter: personal data in the content you and your team put into Helio Posts workspaces, and data from LinkedIn company pages you connect.
• Duration: for as long as you use the service, and until deletion under section 10.
• Nature: storing, organising, reading, analysing with AI models, drafting from, emailing, scheduling and publishing to LinkedIn.
• Purpose: to provide Helio Posts to you: writing, approving and publishing posts for your company pages, and showing how they perform.
• Types of personal data: names, work email addresses and job roles; names and details of people mentioned in your notes, brand material, uploaded files and posts; approval records; LinkedIn page tokens and post-level performance figures.
• Data subjects: your staff and the reviewers you add; your clients, partners and other people you mention in workspace content.
• Special category data: the service is not designed for it. Please do not put it into a workspace unless you have a lawful basis and need to.

3. Your instructions

We process this personal data only on your documented instructions. Those instructions are these terms, this agreement, and the settings and actions you and your team take in the service. If we are required by law to process it any other way, we will tell you first, unless the law forbids that. We will tell you if we think an instruction breaks data protection law.

You are responsible for having a lawful basis for the personal data you put into the service, and for telling the people concerned what is done with it.

4. Our people

Only people who need access to run or support the service can reach your data. Each of them is bound to keep it confidential. Every time our support team opens a workspace that is not their own, the visit and what was done are logged.

5. Security

We take appropriate technical and organisational measures to protect your data, including:

• encrypted connections (HTTPS) for all traffic to and from the service;
• passwords stored only as a salted scrypt hash, never in plain text;
• session cookies that scripts cannot read and that are sent only over secure connections, expiring after 30 days;
• sign-in attempts limited per address, to slow down password guessing;
• access checked against each person's role and workspace on every request;
• each LinkedIn token stored against one workspace and used only for it, with only the organisation permissions requested;
• a log of every support visit to a customer's workspace;
• screening of text sent to the writing model for attempts to misuse it;
• hosting in a professional data centre in the European Economic Area.

6. Sub-processors

You give general authorisation for us to use these sub-processors:

Each sub-processor is bound by a written contract with data protection duties equivalent to these. We remain responsible to you for what they do.

We will give you at least 30 days' notice by email to the account owner before adding or replacing a sub-processor. If you have a reasonable data protection objection, tell us within that time. We will work with you to find a fix. If we cannot, you may end your subscription and we will refund any amount paid for the period after the change.

Paddle, our online reseller, and LinkedIn are not our sub-processors. Paddle handles payment as a controller in its own right. LinkedIn receives what you choose to publish, at your direction, under its own terms.

7. Transfers outside the UK

Our hosting is in the European Economic Area, which the UK recognises as adequate. Where personal data goes to the United States, we rely on the European Commission's standard contractual clauses with the UK International Data Transfer Addendum, or another safeguard that UK law accepts.

8. Helping you

• People's rights. If someone asks us directly to exercise their rights over data in your workspace, we will pass the request to you without undue delay and not answer it ourselves unless you ask. We will help you respond, as far as the service and the information we hold allow.
• Assessments. We will give you reasonable help with data protection impact assessments and any prior consultation with the Information Commissioner's Office that relate to the service.
• Security duties. We will help you meet your own duties on security and breach notification, taking into account the information we hold.

9. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any case within 48 hours of becoming aware of it. We will email the account owner with what we know: what happened, the data and people likely to be affected, the likely consequences, and what we are doing about it. We will send more detail as we learn it, and we will take reasonable steps to contain the breach and limit the harm.

10. When the service ends

When your account ends, you choose whether we return or delete your data. You can ask us for a copy of your workspace content, which we will send in a common format. You can delete a workspace or the whole account yourself at any time from the Account page, which removes it from the service straight away. Copies in our hosting provider's server backups are overwritten as those backups roll over. We keep nothing after that unless the law requires it.

11. Audits and information

On request, we will give you the information you reasonably need to show that we meet the duties in this agreement and in Article 28 of the UK GDPR. If that information is not enough, we will allow and contribute to an audit by you or an auditor you appoint, on reasonable notice, at reasonable times, and under a duty of confidentiality. Audits are at your cost and not more than once a year, unless a regulator requires one or there has been a breach.

12. Liability and law

The liability terms in our terms of service apply to this agreement. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

13. Contact

For anything about this agreement, or to receive sub-processor notices at a different address, email hello@helioposts.com.

Nexborne Ltd. Registered in England and Wales. Company number 17375877. ICO registration ZC240034. hello@helioposts.com

Terms · Privacy · Cookies · Data processing agreement · Refunds