Data processing agreement

Controller: the customer who takes out a Magnifi subscription, the Customer.

Processor: Superworkx B.V., acting as Magnifi, registered with the Dutch Chamber of Commerce under number 27252119, located at Bruistensingel 500, 5232 AH 's-Hertogenbosch, the Netherlands, Magnifi.

This agreement forms part of the Magnifi subscription and the terms and conditions. It applies as long as Magnifi processes personal data for the Customer and ends automatically when the subscription ends and all data has been deleted or returned.

Magnifi processes personal data only to provide the service: collecting and answering reviews, sending review requests, handling social inbox messages, updating the business profile, preparing reports and weekly digests and measuring visibility in search engines and AI assistants.

Magnifi does not use the data for its own purposes, does not sell it and does not train AI models with it.

Guest data from bookings and reviews: name, visit date, review text, rating and reviewer profile name.

Contact details: email address and phone number of guests and of the Customer's staff.

Website data: content of the Customer's website and business profile, including any personal data shown there.

Message data: content and sender of messages via Facebook, Instagram and email.

Guests and customers of the Customer, reviewers, message senders, and the Customer's staff and contacts.

Magnifi processes personal data only on the Customer's documented instructions. The settings the Customer selects in the dashboard count as instructions. Magnifi informs the Customer immediately if it considers an instruction to infringe the GDPR.

Everyone with access to personal data on behalf of Magnifi is bound by confidentiality, by contract or by law. Access is limited to staff who need it for their work.

Storage in the European Union.

Encryption in transit (TLS) and at rest; sensitive connection data such as website passwords is encrypted separately (AES-GCM) and API keys are stored only as hashes.

Access control with roles and row level security per account, so each customer sees only its own data.

Logging of administrative access, regular security scans and backups.

The Customer gives general authorisation for the following subprocessors:

Lovable Cloud (Supabase, hosting in de EU): database, storage and sign in.

Cloudflare: application hosting and network security.

Stripe: payments and invoicing.

Google (Google Bedrijfsprofiel, Maps, Gemini): business profile connection, map data and AI text processing.

OpenAI: AI text processing for replies and measurements.

Meta (Facebook, Instagram, WhatsApp): social inbox messages and the weekly digest.

Lovable e-maildienst (notify.gomagnifi.com): sending service emails.

Magnifi imposes at least the obligations of this agreement on every subprocessor. Magnifi informs the Customer by email at least 30 days before adding or replacing a subprocessor. Within that period the Customer may object on reasonable grounds and, if no solution is found, cancel the subscription free of charge.

Where a subprocessor processes data outside the EU, this is based on an adequacy decision or the European Commission's standard contractual clauses.

Magnifi notifies the Customer of a personal data breach within 48 hours of discovery, describing its nature, the data involved, the likely consequences and the measures taken. The Customer decides on notifying the supervisory authority and data subjects; Magnifi assists.

Magnifi assists the Customer with requests for access, rectification, erasure, restriction, portability and objection. Requests Magnifi receives directly are forwarded to the Customer within five working days.

The Customer may verify compliance with this agreement once a year or after a data breach. Magnifi provides the necessary information. An on-site audit is announced at least 14 days in advance and is at the Customer's expense, unless it shows that Magnifi materially breached this agreement.

After the subscription ends the data stays available for export for 90 days. Magnifi then deletes all of the Customer's personal data, including at subprocessors, unless a legal retention duty applies. Backups are overwritten within 30 days after that. On request Magnifi confirms the deletion in writing.

The liability provisions and limitations of the Magnifi terms and conditions apply.

This agreement is governed by Dutch law. Disputes are submitted to the competent court in the district of Oost-Brabant, the Netherlands.

The Customer accepts this agreement automatically when starting a subscription. A signed copy is available on request via magnifi@socialroots.nl.