Data processing agreement

This data processing agreement (agreement) under Art. 28 of the General Data Protection Regulation (GDPR) is concluded between the customer as controller (hereinafter “customer”) and Melo Designer GmbH, Zum Wallgraben 50b, 49696 Molbergen, Germany, as processor (hereinafter “Looky” or “we”). It supplements the contract for the use of Looky under our terms and conditions (main contract) and is part of it. The customer accepts it together with the terms at the order step of the Looky app or, for a contract concluded by a separate offer (Section 2(6) of the terms), with the acceptance of that offer. When the customer orders at the order step, we store the accepted version with the order. This agreement is version 2026-11-06.

Section 1 Subject and duration

1. The subject of this agreement is the processing of personal data by Looky on behalf of the customer when providing Looky as described in the main contract: storing and analysing the customer's brand knowledge, creating drafts with AI models, approving, scheduling and publishing content to connected channels, reading and answering reviews and comments, maintaining directory listings, and analysing the visibility of the customer's website and brand.
2. This agreement applies as long as Looky processes personal data on behalf of the customer. It ends with the main contract; Section 10 continues to apply until the data has been deleted or returned.
3. Where Looky processes personal data for its own purposes (for example the customer's account, billing and payment data, abuse protection and the security of the service), Looky is the controller itself. The privacy policy describes this processing; this agreement does not apply to it.

Section 2 Nature and purpose of processing, data and data subjects

1. Nature of processing: collecting, storing, organising, analysing, transmitting to AI providers and to channels the customer connects, publishing at the customer's instruction, and deleting.
2. Purpose: providing the functions of Looky that the customer uses under the main contract.
3. Types of personal data, depending on what the customer and its users enter, upload or connect:
   • names, email addresses, roles and activity of the customer's users and team members, and of the external reviewers the customer invites
   • content of the knowledge base, documents, website pages, voice recordings and their transcripts, notes and comments, insofar as they contain personal data
   • drafts and published posts, articles and scripts, including names and statements of persons mentioned in them
   • reviews, comments and messages on connected channels, with names, profile information and content of the authors, and the replies
   • contact data in directory listings and in the customer's contact lists
   • usage and performance statistics of connected accounts (for example Search Console, Analytics, social media insights), insofar as they relate to persons
4. Categories of data subjects: the customer's employees, team members and other users; clients of the customer (for agencies, also their clients' employees); the customer's customers, prospects and business partners; authors of reviews and comments; persons named in the customer's content; external approvers invited by the customer.
5. Special categories of personal data (Art. 9 GDPR) are not required for the use of Looky. The customer only enters them where necessary and lawful, and is responsible for doing so.

Section 3 Instructions

1. Looky processes the personal data only on documented instructions from the customer, unless Union or Member State law requires otherwise; in this case Looky informs the customer of that legal requirement before processing, unless that law prohibits such information.
2. The instructions are set out in the main contract and this agreement and are given by the customer through the settings and functions of Looky (for example approval settings, connected channels, deletion of content). Further instructions are given in text form.
3. Looky informs the customer without delay if it believes that an instruction infringes data protection law. Looky may suspend the implementation of the instruction until the customer confirms or changes it.

Section 4 Confidentiality

Looky only grants access to the personal data to persons who need it to provide the service and who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The obligation continues after their work ends.

Section 5 Security of processing

1. Looky takes the technical and organisational measures under Art. 32 GDPR described in Annex 1.
2. The measures are subject to technical progress. Looky may replace them with adequate alternative measures, provided the level of protection is not reduced. Material changes are documented.

Section 6 Sub-processors

1. The customer gives Looky general authorisation to engage further processors (sub-processors). The sub-processors engaged when this agreement is concluded are listed in Annex 2, part A; the customer agrees to their engagement.
2. Looky informs the customer by email at least 4 weeks before a sub-processor is added or replaced, and updates Annex 2. The customer may object to the change in text form within these 4 weeks for an important reason relating to data protection. If the parties do not reach an agreement, both parties may terminate the main contract with effect from the date of the change.
3. Looky concludes a contract with each sub-processor that imposes the same data protection obligations as this agreement, in particular sufficient guarantees for appropriate technical and organisational measures. Looky remains responsible to the customer for the sub-processors.
4. Looky only transfers personal data to a third country outside the EU and the EEA if the requirements of Chapter V GDPR are met, for example on the basis of an adequacy decision, including the EU-US Data Privacy Framework for certified recipients, or EU standard contractual clauses. Annex 2 states the basis for each sub-processor.
5. The platforms, Google services and directories that the customer connects to Looky, and the payment service providers for the Looky fees, are not sub-processors (Annex 2, part B). Data reaches connected platforms at the customer's instruction and under the customer's own contract with them.

Section 7 Rights of data subjects

1. Taking into account the nature of the processing, Looky supports the customer with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12 to 22 GDPR). Most requests can be handled by the customer directly in Looky, for example by viewing, correcting, exporting or deleting content.
2. If a data subject contacts Looky directly about data that Looky processes on behalf of the customer, Looky forwards the request to the customer without delay and does not answer it itself without the customer's instruction.

Section 8 Further support and notification of breaches

1. Looky supports the customer, taking into account the nature of the processing and the information available to it, in complying with the obligations under Art. 32 to 36 GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation).
2. Looky notifies the customer without undue delay after becoming aware of a personal data breach affecting the customer's data. The notification contains, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed.

Section 9 Rights and obligations of the customer

1. The customer is responsible for the lawfulness of the processing, in particular for the legal basis and for informing the data subjects.
2. The customer informs Looky without delay if it finds errors or irregularities in the processing results.

Section 10 Deletion and return at the end

1. After the main contract ends, the customer can export its content for 30 days with the export functions of the app (read-only access). Looky reminds the customer by email before the deletion.
2. After these 30 days Looky deletes the personal data processed on behalf of the customer, including stored files, unless Union or Member State law requires storage (for example retention obligations for invoices). Where backups of the data exist, the copies in them are deleted in the regular backup cycle.
3. During the term, the customer can delete content and workspaces in Looky at any time; Looky then deletes the data concerned. On request in text form, Looky confirms the deletion.

Section 11 Information and audits

1. Looky makes available to the customer all information necessary to demonstrate compliance with Art. 28 GDPR, in particular a description of the measures in Annex 1 and the current list of sub-processors.
2. The customer may carry out audits, including inspections, itself or through an auditor bound to confidentiality, as far as the information under paragraph 1 is not sufficient. Audits are announced at least 4 weeks in advance in text form, take place during usual business hours without disproportionately disturbing operations, and respect the confidentiality of other customers' data. Each party bears its own costs.

Section 12 Liability and final provisions

1. Liability is governed by Art. 82 GDPR. Otherwise the liability provisions of the main contract apply.
2. In the event of contradictions, this agreement takes precedence over the main contract regarding data protection.
3. Changes and additions to this agreement require text form; Section 19 of the terms applies accordingly. The electronic acceptance at the order step, or the acceptance of a separate offer in text form under Section 2(6) of the terms, fulfils the written form under Art. 28(9) GDPR.
4. The law of the Federal Republic of Germany applies. The place of jurisdiction is governed by the main contract.
5. This agreement is concluded in German. An English translation is for information only; the German version is authoritative.

Annex 1 Technical and organisational measures (Art. 32 GDPR)

These measures describe how Looky is built and operated as of 2026-11-05.

Confidentiality

• Physical access control: Looky runs on servers of the hosting provider STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin (Germany). Physical access to the data centres is controlled by the hosting provider. Looky operates no servers of its own on its premises.
• System access control: users sign in with a personal account; passwords are stored only as salted hashes, never in plain text. In production, sign-in and sign-up attempts are rate-limited, new accounts must confirm their email address, and sign-up is protected by a bot check. Sessions use secure, HTTP-only cookies. Looky staff use a separate admin application with mandatory two-factor authentication (TOTP), short sessions and an automatic sign-out after inactivity.
• Data access control: role-based permissions per organization and workspace (organization roles owner, admin, billing and member; workspace roles editor, reviewer and client reviewer). Every API request is checked against the user's membership and role before data is read or changed. Staff access is limited by staff permissions and recorded in an audit log.
• Separation: the data of each organization and workspace is logically separated by identifiers that every query is bound to. Automated tests run on separate test databases.
• Encryption and pseudonymisation: access tokens of connected accounts are stored encrypted (AES-256-GCM with versioned keys). IP addresses are hashed with a secret salt where they are used for rate limits and abuse protection. Of the bank details of a SEPA mandate, Looky stores only the account holder and the last four digits of the IBAN; the full IBAN is passed to the payment provider.

Integrity

• Transfer control: all connections between browsers, apps, the Looky API and the external services Looky uses are encrypted with TLS (HTTPS); the API sends security headers including HSTS.
• Input control: approvals, publications and changes to content are recorded in an audit log with user and time; billing events and staff actions are logged as well. The application writes technical logs for operation and error analysis.

Availability and resilience

• Background work (generation, publishing, synchronisation) runs in queues with automatic retries, so a temporary error of an external service does not lose data.
• Failed publications and failed jobs are shown to the customer or raise an alert to the operators.
• The API refuses to start in production without the required secrets (session secret, encryption key, hash salt) and without bot protection.

Procedures for regular review

• Changes to Looky are checked with automated tests (unit and end-to-end tests) before they are released.
• Deletion of organizations after the end of the contract and of individual content runs as automated jobs, including the stored files, with retries and an alert when files cannot be deleted.
• Sub-processors are selected according to their data protection guarantees and bound by Art. 28 GDPR contracts (Section 6).

Annex 2 Sub-processors and other recipients

Part A: sub-processors

AI providers process the data sent to them only to provide their service to Looky. Looky uses their business interfaces (APIs) and sends only the content needed for the respective task.

Part B: recipients that are not sub-processors