Data Processing Terms

1. Parties, scope and instructions

The customer is the person or organisation identified when ordering the workspace; the processor is OptiNext Kft. Processing covers social planning, uploads, media processing/security checks, AI creation, approval, scheduling, authorised publishing, reporting and related storage/communication for the service duration.

Subjects may include customer/client contacts, staff, reviewers and people lawfully depicted. Data includes names/contact details, roles, profile IDs/connection data, briefs, captions, images/video, brand data, decisions/comments, metrics and technical metadata. Special-category data, biometric identification, targeted profiling of children and criminal-offence data are outside the standard order.

Documented instructions are the accepted contract and actions of authorised users through the interface/API. Content must not be used for other purposes, including the processor’s own advertising profiles or training its own general AI model. Legally required processing beyond instructions is disclosed beforehand unless prohibited. We flag potentially unlawful instructions and suspend the affected processing as necessary pending clarification.

2. Confidentiality, security and incidents

Only authorised persons bound by confidentiality may access data. Risk-based measures include HTTPS, roles/workspace isolation, password hashing, protected connection tokens, upload checks, restricted download/review links, logging, restricted backups and restore checks. These reduce risk but are not absolute security guarantees.

We notify the workspace contact without undue delay after becoming aware of a personal-data breach affecting customer data. We provide available facts, affected categories, likely consequences and measures taken/proposed, and supplement them later. The controller decides statutory authority/data-subject notifications, assisted by us.

3. Subprocessors and transfers

The customer gives general authorisation for the listed subprocessors needed for ordered features: HOSTINGER INTERNATIONAL LIMITED for application/database/email, media VPS and backups; the OpenAI entity under the applicable agreement solely for requested AI processing. Separately authorised external assistants and selected publishing platforms connect on customer instructions and do not receive blanket access to all workspaces.

Stripe and Tacito receive the provider’s own payment/billing data, not client creatives for that reason. Consent-based public-site Google/Meta measurement must not use client-workspace content. The Privacy Notice identifies providers and their privacy links.

Subprocessors must be bound by applicable data-protection obligations; the provider remains responsible under GDPR. We directly notify customers of an additional/replacement subprocessor at least thirty days beforehand and allow reasoned objections at info@optinext.hu. Pending resolution we discuss restriction/termination of the affected feature and data return. Non-EEA processing requires applicable GDPR safeguards; an instruction does not replace them.

4. Assistance, audit and closure

Considering the nature of processing and information available, we assist with data-subject requests, security obligations, impact assessments and prior consultation. Direct requests are referred to the controller; we clarify lawful procedure instead of releasing/deleting data without appropriate instruction.

We provide information necessary to demonstrate compliance and allow audits by the controller or its independent auditor while protecting trade secrets, other customers and security. Agreed timing and proportionate scope must not exclude GDPR audit rights or urgent incident investigation.

At service end, at the customer’s choice we return or delete processed client data and unnecessary copies unless law requires retention. Clarified live-system requests are normally completed within thirty days. The Privacy Notice describes backup limits and approximately twelve-month ageing. Prior deletion instructions must be reapplied after restoration. We arrange secure delivery rather than implying a nonexistent one-click export of all data.

The controller is responsible for lawful collection, notices, permissions and instructions; the processor for its own GDPR and contractual obligations. For data-protection conflicts this appendix prevails over general service terms, without affecting mandatory law.