GDPR and Data Protection Notice

1. Scope

This Notice applies when Socialman processes personal data subject to Regulation (EU) 2016/679 (“EU GDPR”), the GDPR as incorporated into United Kingdom law (“UK GDPR”), or substantially equivalent European data-protection requirements. “Personal data,” “processing,” “controller,” and “processor” have the meanings given by applicable data-protection law.

2. Identity and contact details

The controller for Socialman account administration, direct customer relationships, payments, security, and our own product operations is:

Unless we separately identify a Data Protection Officer or European representative to you, the privacy contact above is the primary contact for all European data-protection requests and will route requests to any applicable representative.

3. Our role when customers use the Service

For personal data in a customer’s User Content, social messages, audience information, or connected-account workflows, the customer generally determines why and how the information is processed and acts as controller. Socialman processes that data on the customer’s instructions and generally acts as processor. Socialman remains an independent controller for account, billing, security, support, and legal-compliance data.

Customers acting as controllers are responsible for a valid lawful basis, required notices, data minimisation, configuring access, and responding to individuals. We will reasonably assist customers with rights requests, security information, deletion, and data-protection assessments. Business customers may request a data processing agreement by emailing us.

4. Data-protection principles

Socialman’s policy is to process personal data lawfully, fairly, and transparently; collect it for specified purposes; limit it to what is necessary; keep it accurate; retain it no longer than needed; protect it with appropriate safeguards; and remain accountable for these practices. We apply privacy by design and by default when developing or materially changing features.

5. Processing activities and lawful bases

6. Legitimate interests

Where we rely on Article 6(1)(f), our interests include protecting accounts and networks, preventing fraud and abuse, maintaining and improving reliability, supporting customers, enforcing agreements, and communicating about the Service. We assess whether processing is necessary and balance those interests against the individual’s interests, rights, reasonable expectations, and potential impact. You may object as described below.

7. Contractual and required information

Account identifiers, authentication information, and information needed for a selected feature are generally required to provide the Service. If you do not provide them, we may be unable to create an account, connect a provider, process a purchase, or perform the requested function. Optional profile fields and marketing consent are not required unless clearly stated.

8. Special-category data and children

Socialman is not intended for special-category data under Article 9, criminal-conviction data, or children’s personal data. Do not upload such data unless you have an applicable Article 9 condition or other express legal authority, have completed any required assessment, and have our written approval. The Service is not directed to anyone under 18.

9. Recipients and processors

Depending on the features used, recipients may include infrastructure and hosting providers, email and support services, payment and merchant-of-record providers, professional advisers, AI and design-generation providers, and social networks you direct us to connect. Current integrations may include Meta services, Google/YouTube, TikTok, X/Twitter, LinkedIn, OpenAI, Stripe, WarriorPlus, and PayKickstart. A provider receives only the information reasonably required for the relevant function.

We assess processors for appropriate safeguards and enter into data-protection terms where required. A business customer may request current subprocessor information and notification arrangements through support@socialman.app.

10. International transfers

Personal data may be processed in the United States and other countries outside the EEA or UK. Where a destination is not recognised as adequate, we rely on safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another mechanism allowed by law. Where appropriate, we evaluate transfer risks and use supplementary technical or organisational measures. You may request information about the applicable safeguard or a copy with confidential terms redacted.

11. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• Be informed about how your personal data is processed.
• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete personal data.
• Erase personal data when the legal conditions are met.
• Restrict processing in specified circumstances.
• Data portability for data you provided that we process by automated means based on consent or contract.
• Object to processing based on legitimate interests and at any time to direct marketing.
• Withdraw consent at any time, without affecting prior lawful processing.
• Not be subject to solely automated decisions producing legal or similarly significant effects, subject to statutory exceptions.
• Complain to a competent supervisory authority.

12. How to exercise a right

Email support@socialman.app with the subject “GDPR Request.” Include your account email, the right you wish to exercise, and enough detail to locate the relevant information. You may also delete your account through the Account Deletion section in Settings.

We may request proportionate information to confirm your identity and authority. We ordinarily respond without undue delay and within one month. We may extend by up to two additional months for a complex or numerous request and will explain the extension within the first month. Requests are generally free; where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it as permitted by law.

Erasure is not absolute. We may retain limited data required by tax, accounting, legal-claims, fraud-prevention, security, freedom-of-expression, or other statutory obligations. Retained data will be restricted to the applicable purpose and deleted when that purpose ends.

13. Requests involving a business customer

If your data was submitted or controlled by a Socialman business customer, contact that customer first. When Socialman acts as processor, we cannot independently decide the request and will forward it to the customer or assist the customer in responding. We may still respond directly regarding personal data for which Socialman is an independent controller.

14. Consent, marketing, and cookies

Consent requests will be distinguishable, specific, informed, and capable of withdrawal. Refusing optional consent will not prevent use of unrelated Service features. You may opt out of direct marketing at any time. Socialman currently uses essential authentication, session, workspace, and security cookies. If optional analytics or advertising cookies are introduced, they will remain disabled until consent where European law requires it.

15. Automated decision-making

Socialman may automate content generation, scheduling, analytics, recommendations, abuse detection, and rate limiting. These functions do not make solely automated decisions intended to produce legal or similarly significant effects about individuals. If that changes, we will provide the information and safeguards required by Article 22 before the processing begins.

16. Security and personal-data incidents

We use risk-appropriate technical and organisational measures designed to protect confidentiality, integrity, availability, and resilience, and to restore access following an incident. Access is limited according to role and need. We assess suspected personal-data breaches and will notify the competent supervisory authority and affected individuals when Articles 33 and 34 or equivalent law require it.

17. Accountability

As appropriate to our role and risk, we maintain records of processing, use processor agreements, apply data-minimisation and retention controls, assess high-risk changes, train authorised personnel, and review safeguards. Where a proposed activity is likely to create a high risk to individuals, we will complete a data-protection impact assessment before beginning that processing.

18. Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the supervisory authority in the EEA country of your habitual residence, place of work, or the alleged infringement. A list is available from the European Data Protection Board. In the UK, you may contact the Information Commissioner’s Office. In Switzerland, you may contact the Federal Data Protection and Information Commissioner.

19. Updates

We will update this Notice when our processing, safeguards, or legal obligations materially change. The current version and effective date will remain available at this URL. We will provide additional notice when required by law.

20. Contact