Data processing agreement
Last updated: 1 November 2026
This agreement under Art. 28(3) GDPR between the customer (“controller”) and DMowl, Michel Ruchti, Pfisters Reben 13, 3210 Kerzers, Switzerland (“processor”) is part of the terms of service and is concluded when the customer accepts them. It applies to all personal data the processor processes on behalf of the controller.
1. Subject matter and duration
The processor provides the DMowl service (Instagram automation, inbox, CRM, campaigns, giveaways, AI agent, API) as described in the terms of service. The agreement lasts as long as the customer’s contract.
2. Nature and purpose of processing
Receiving, storing, organising, analysing and sending messages and comments through the Instagram API; running the controller’s automations, campaigns and the optional AI agent; providing exports, the API and webhooks configured by the controller.
3. Types of data and data subjects
- Data subjects
- People who interact with the controller’s Instagram account (followers, commenters, people who send messages or mentions); the controller’s team members.
- Types of data
- Instagram-scoped ID, username, name, profile information; follow status; content of messages, comments, story replies and mentions; data collected in conversations (e.g. email address, phone number, answers); folders, properties and notes; link clicks; giveaway entries; order ID, amount and currency of attributed sales.
The controller ensures that no special categories of data (Art. 9 GDPR) are collected deliberately through DMowl, unless a suitable legal basis exists.
4. Instructions
The processor processes the data only on documented instructions of the controller — given through these terms and through the settings and actions in DMowl — unless required to do so by EU or member state law; in that case it informs the controller beforehand unless the law prohibits this. The processor informs the controller if it believes an instruction infringes data protection law.
5. Confidentiality
Everyone authorised to process the data is bound to confidentiality.
6. Security of processing (Art. 32 GDPR)
The processor takes appropriate technical and organisational measures, in particular:
- encryption in transit (TLS) and of Instagram access tokens at rest (AES-256-GCM); passwords as salted scrypt hashes; API keys as hashes
- database in Cloudflare’s EU jurisdiction; serverless infrastructure without manually administered servers
- role-based access within each account (owner, admin, member, viewer); separation of customer data by account
- rate limiting and bot protection on login, sign-up and API
- least-privilege access to production systems for the processor’s staff; access only where needed for operation or support
- automatic backups by the hosting provider; deletion of data on account deletion
- regular review and improvement of these measures
7. Sub-processors
The controller grants general authorisation for the sub-processors listed below. The processor informs the controller by email at least 30 days before adding or replacing a sub-processor; the controller may object for important data protection reasons and, if no solution is found, terminate the contract. The processor imposes the same data protection obligations on its sub-processors.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database (EU jurisdiction), email delivery, bot protection (Turnstile), rate limiting | USA / global network; database in the EU | EU-U.S. Data Privacy Framework, Standard Contractual Clauses |
| OpenRouter, Inc. | AI features (AI agent replies, drafts, rewrites) — only when enabled. Routed only to providers with zero data retention; no training on the data | USA; model hosting by selected providers in the USA/EU | Standard Contractual Clauses |
Meta Platforms Ireland Limited is not a sub-processor: the controller connects its Instagram account itself and Meta acts under its own responsibility.
8. Transfers to third countries
Transfers outside the EU/EEA only take place where the requirements of Chapter V GDPR are met, in particular based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
9. Assistance
The processor assists the controller with appropriate technical and organisational measures in responding to data subject requests (e.g. through exports, editing and deleting contacts in DMowl) and in meeting the obligations under Art. 32 to 36 GDPR. Requests sent directly to the processor are forwarded to the controller without undue delay.
10. Personal data breaches
The processor notifies the controller without undue delay, where possible within 48 hours, after becoming aware of a personal data breach, and provides the information needed for the controller’s notification obligations.
11. Deletion and return
At the end of the contract the processor deletes the controller’s personal data, unless EU or member state law requires storage. Before that, the controller can export its contacts. Backups are overwritten within 30 days.
12. Audits and information
The processor makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the controller or an auditor mandated by it. Audits are to be announced with reasonable notice, carried out during business hours without disrupting operations and are, as a rule, limited to once a year. Current certifications of sub-processors can be used as evidence.
13. Final provisions
Liability is governed by the terms of service. In case of contradictions between this agreement and other agreements, this agreement prevails with regard to data protection.