DRAFT FOR OWNER AND LEGAL REVIEW · Updated 10 November 2026. Not yet offered for contractual acceptance. Operator details and business-only scope are owner-confirmed. Final processing agreements, transfer arrangements and operational retention/deletion/backup handling still need verification before general release.
1. Who operates Entire Socials
Entire Socials, Bercylaan 395, 1031 KP Amsterdam, The Netherlands. Chamber of Commerce (KvK): 81858647. VAT identification number: NL003611782B93. Privacy contact: contact@entiresocials.com. The service is intended for business customers worldwide. Personal data of business contacts, account users and people appearing in workspace content may still be covered by privacy law.
2. Our role and the workspace customer’s role
Entire Socials determines the purposes of account administration, its own billing, support and platform security. A workspace customer may determine the purposes of personal data in its client content and instructions; where Entire Socials processes that content on the customer’s behalf, the applicable processing agreement must describe those instructions and responsibilities. This privacy notice is not itself a data-processing agreement.
3. Information used by the service
The authenticated service handles account and business contact details, workspace membership and permissions, posts/captions/reviews/tasks, uploaded media and import records, subscription and payment references, support conversations and security/audit records. Connected social-service records are used only for the relevant authorised connection and enabled workflow. Stripe processes payment details; Entire Socials does not store complete payment-card details. Avoid uploading unnecessary sensitive personal data, passwords or access keys.
4. Purposes and processing grounds
Information is used to provide the requested account/workspace service, follow authorised customer instructions, administer subscriptions and invoices, answer support requests, protect accounts, investigate abuse and meet applicable legal obligations. Depending on the activity and relationship, the relevant grounds may be contractual necessity, a legal obligation or a documented legitimate interest such as service security and business support. Where consent is required for an optional activity, it must be obtained for that activity and may be withdrawn. A business subscription is not blanket consent for unrelated processing.
5. Service providers and connected platforms
The configured service uses Supabase for its database/authentication/private media, Cloudflare for application hosting, Resend for configured email delivery, Stripe for payment processing and Zernio for enabled social-account connections/publication workflows. Connected social networks may also receive information when an authorised workflow actually sends it. Access is limited to the relevant service purpose. A connection or planning preview does not establish that automatic publication is enabled or accepted. The owner reports no additional analytics, advertising or marketing services for this configuration; any future optional use must be assessed and reflected in the notice first.
6. International processing
Business customers may be located worldwide. Depending on the service provider and processing path, information may be handled outside the European Economic Area. The final provider-specific processing agreements, locations and applicable transfer arrangements must be verified before this draft becomes the release notice. No EEA-only processing, completed transfer assessment or particular safeguard is claimed as verified by this draft.
7. Retention and deletion
Different records have different purposes. Basic Dutch financial/tax administration is normally retained for seven years after the records cease to be current; a specific statutory exception can require longer retention. This is not a blanket seven-year period for media or account data. Workspace/account records are needed while supplying the service and handling the customer’s instructions; support/security records are limited to resolving requests, necessary incident investigation, documented legal claims and applicable legal duties. Other personal data must be deleted or anonymised when no longer necessary for those purposes. Ending a subscription is separate from requesting erasure or return of data. Operational workspace deletion, backup expiry and any export window remain subject to release verification; this draft does not promise a fixed or immediate automated deletion capability.
8. Rights, requests and complaints
Contact contact@entiresocials.com for access, correction, deletion, restriction, objection or portability requests, where applicable. A person whose information is controlled by a workspace customer may need to address that customer; Entire Socials should assist within its processing role. Identity and authority must be checked proportionately without asking for account passwords or verification codes. A request may be limited by applicable law or a legal retention obligation. Individuals may complain to the relevant supervisory authority, including the Dutch Autoriteit Persoonsgegevens.
9. Security, local storage and notice changes
The service uses access controls and requires MFA for platform administrators; customer MFA is recommended and optional unless enrolled. Account access uses necessary authentication/session technology and browser storage. No verified uptime, recovery completion or absolute security guarantee is made. Important changes to purposes, providers or retention must be reflected in an updated notice and any required customer information or consent before the changed activity begins.