1. Introduction

This Privacy Policy explains how Trendlytic processes personal data on behalf of its customers (the Data Controllers) when providing the Services. At Trendlytic, we process personal data strictly as a Data Processor in accordance with Article 28 GDPR.

2. Data Controller and Processor Roles

• • The Data Controller is the subscription owner or authorized user of the Service.
• • Trendlytic acts solely as the Data Processor.

3. Types of Personal Data Processed

Data processed may include, depending on the customer's configuration:

• • Social media data retrieved via the Meta API (e.g., account name, post insights, engagement metrics)
• • Account and usage data related to the customer's use of our Service (e.g., logins, account settings)

We process this data strictly to provide the contracted Service.

4. Purpose of Processing

We process personal data only on documented instructions of the Data Controller, for the following purposes:

• • To provide the social media analytics Services as configured by the Controller
• • To ensure the functionality, security, and improvement of the Service
• • To comply with legal obligations

We do not determine the purposes or means of processing; this is the Controller's responsibility.

5. Legal Basis for Processing

As Processor, we rely on the Controller to determine and ensure the appropriate legal basis for data collection under Article 6 GDPR.

6. Data Sharing and Subprocessors

We may engage subprocessors necessary to carry out our Service (e.g., cloud hosting providers). In the case of a change of subprocessors, we will do our commercially reasonable efforts to inform the Controller in advance. A list of subprocessors is available upon request. We do not share or sell personal data for independent purposes.

7. International Data Transfers

If subprocessors are located outside the EEA, such transfers will be safeguarded by EU Standard Contractual Clauses or other lawful mechanisms under GDPR.

8. Data Security

We implement appropriate technical and organizational security measures, including access control and regular security audits, to ensure the protection of processed data.

9. Data Subject Rights

As Processor, we will assist the Controller in fulfilling its obligations regarding data subject rights (access, rectification, erasure, etc.) under GDPR, upon documented instruction.

10. Data Retention

We retain personal data only for the duration of the Service, as instructed by the Controller, unless legally required otherwise. Upon termination, data will be deleted within 30 days.

11. Cookies and Tracking Technologies

We may use cookies on our website or platform for necessary functionality. Separate consent may be required for such use, as applicable.