Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer," the data controller) and IPE Projects (Pty) Ltd, trading as LazyRelay, a company registered in South Africa (registration number 2021/003176/07) ("LazyRelay," the data processor). It applies whenever LazyRelay processes personal data on your behalf as part of providing the Service, and reflects our obligations under Article 28 of the EU General Data Protection Regulation (GDPR) and equivalent UK GDPR requirements. By using LazyRelay, you and LazyRelay agree to this DPA — no separate signature is required, though a countersigned copy is available on request (email [email protected]).

Subject matter and duration

LazyRelay processes personal data on your behalf for as long as you have an active LazyRelay account, solely to provide the scheduling, publishing, and related features described in our Terms of Service.

Nature and purpose of processing

LazyRelay processes personal data to: connect to and publish content on the social media accounts you authorize; verify that published posts are genuinely live; show you comments and direct messages sent to your connected accounts; classify comments/messages that may need your attention using AI; generate caption, hashtag, and content suggestions using AI; and provide customer support, including through our AI support assistant.

Types of personal data processed

• Your own account details: email address, business/display name.
• Access tokens for the social media accounts you connect (encrypted at rest, never stored as plain text — see Security below).
• Content and media you upload to schedule for publishing.
• Comments and direct messages sent by people who interact with your connected social accounts — these are read from each platform and kept by LazyRelay for up to 30 days, then deleted, so they can be shown in your dashboard. After that, only an AI-generated classification remains (a category, e.g. "needs attention," plus a short summary reason of eight words or fewer) — never the verbatim message.
• Basic technical/usage data (e.g. error logs) needed to operate the Service reliably.

Categories of data subjects

• You and anyone else with access to your LazyRelay account.
• People who comment on, or send direct messages to, the social media accounts you connect to LazyRelay — your own audience, not LazyRelay's.

LazyRelay's obligations as processor

LazyRelay agrees to:

• Process personal data only on your documented instructions, including regarding international transfers, unless required to do otherwise by law.
• Ensure anyone authorized to process personal data (including LazyRelay's own operator) is bound by confidentiality.
• Implement appropriate technical and organizational security measures (see Security below).
• Only engage a sub-processor with your general authorization (see Sub-processors below), and impose the same data protection obligations on any sub-processor it uses.
• Assist you, to the extent reasonably possible, in responding to requests from data subjects exercising their GDPR rights.
• Assist you in meeting obligations around the security of processing, breach notification, and data protection impact assessments, taking into account the nature of processing and information available to LazyRelay.
• At the end of the relationship, delete or return all personal data processed on your behalf, per the Data return and deletion section below.
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for reasonable audits, subject to confidentiality and not disrupting the Service for other customers.

Sub-processors

You give LazyRelay general authorization to engage the sub-processors below, each of which is bound by its own data protection agreement with LazyRelay incorporating GDPR Standard Contractual Clauses for any transfer outside the EU/UK:

• Supabase (database and authentication) — EU-hosted (Ireland), SOC 2 Type II certified.
• Render (application hosting) — US-hosted (Oregon), SOC 2 Type II certified.
• Cloudflare (content delivery network and edge security, proxying all traffic to lazyrelay.com) — SOC 2 Type II and ISO 27001 certified.
• Anthropic (AI features: support assistant, caption/hashtag suggestions, comment classification) — SOC 2 Type II certified; does not train its models on this data, and API inputs/outputs are deleted within 30 days by default.
• Resend (transactional email) — US-hosted, SOC 2 Type II certified.
• Paddle.com (billing, as merchant of record) — SOC 2 Type II and PCI-DSS certified; card details are handled entirely by Paddle and never reach LazyRelay's own systems.
• PostHog (product analytics, session replay, error tracking; only if you accept analytics cookies) — SOC 2 Type II and ISO 27001 certified; EU-hosted, with sensitive dashboard fields masked by default.

If LazyRelay adds or replaces a sub-processor that would materially change how your personal data is handled, we'll update this page and, where appropriate, notify you directly at least 14 days in advance. You may object on reasonable data-protection grounds within that period; if we can't resolve your objection, either you or LazyRelay may terminate the affected part of the Service without penalty.

International transfers

Personal data processed under this DPA may be transferred to and processed in the United States (via Render, Anthropic, Resend, and Paddle), the EU (via Supabase and PostHog), and, for Cloudflare's edge network, a range of countries worldwide as needed to route traffic efficiently. Each such transfer is covered by Standard Contractual Clauses under that sub-processor's own data processing agreement, as referenced above.

Security

Social media access tokens are encrypted and stored separately from ordinary database records, accessible only through LazyRelay's own backend — never as plain text in any table. Connections between your browser, LazyRelay, and our infrastructure providers use encrypted connections. Comments and direct messages are kept for up to 30 days, then deleted; after that only a short classification tag remains. See our Privacy Policy for further detail.

Data subject rights

If someone contacts LazyRelay directly with a GDPR request about data you control (e.g. someone who commented on your connected account), we'll forward it to you rather than act on it ourselves, since you're the controller of that relationship. If you receive a request you need our help with, email [email protected].

Personal data breach notification

If LazyRelay becomes aware of a personal data breach affecting your data, we'll notify you without undue delay, with what we know at the time (nature of the breach, likely consequences, and measures taken or proposed) — promptly enough for you to meet your own regulatory notification deadlines. Where POPIA applies (see South Africa / POPIA below), we'll notify you immediately of any actual or reasonably suspected unauthorized access to, or acquisition of, personal information, as section 21(2) of POPIA requires.

Data return and deletion

When you delete your LazyRelay account, we remove your stored content and connected-account access tokens within a reasonable time, per our Data Deletion page. If you need a copy of your data returned before deletion, email [email protected].

Liability

Liability under this DPA is subject to the limitations set out in our Terms of Service. If LazyRelay materially breaches this DPA and doesn't fix it within a reasonable time after you notify us, you may terminate the affected Service at no further cost, regardless of your plan's usual cancellation terms.

South Africa / POPIA

Where the Protection of Personal Information Act 4 of 2013 ("POPIA") applies to personal information processed under this DPA — including because IPE Projects (Pty) Ltd, trading as LazyRelay, is a South African company — this DPA also serves as the written contract required by section 21 of POPIA. In this context, "Customer" is the responsible party and "LazyRelay" is the operator, and the commitments above under "LazyRelay's obligations as processor," "Security," and "Personal data breach notification" apply equally as LazyRelay's obligations as operator — including the security measures required by section 19 of POPIA, and immediate notification of any actual or reasonably suspected unauthorized access to or acquisition of personal information, as required by section 21(2) of POPIA.

Governing law

This DPA is governed by the laws of South Africa, where IPE Projects (Pty) Ltd is registered, without prejudice to any mandatory data protection rights you have under the GDPR, UK GDPR, or other law that applies to you directly.