Data Processing Agreement
Last updated 2026-08-25
This agreement applies where HempScale processes personal data on behalf of a customer, for example the audience data of a connected Instagram account.
Roles
The customer is the controller. HempScale is the processor and acts only on documented instructions from the customer, which includes operating the service as described in the terms.
Subject matter and duration
Processing lasts as long as the subscription, plus the retention periods stated in the privacy policy. The subject matter is the production, review and publication of social media content for the customer brand.
Categories of data and data subjects
Contact details of the customer staff, aggregate audience metrics of the connected account, and any personal data the customer chooses to put into their own content.
Security
Access tokens for connected accounts are encrypted at application level. The database is not exposed to the public internet. Access to production is limited to the operator. Backups are encrypted and stored separately from media.
Sub-processors
The list in the privacy policy applies. The customer is told before a new sub-processor is added and may object.
Assistance and deletion
HempScale assists with data subject requests and with breach notification. On request at the end of the agreement, customer data is deleted or returned, subject to the 12 month content retention the customer is entitled to.