The terms under which Senly processes personal data on behalf of your agency (Article 28 GDPR).
This is a courtesy translation. The Dutch version is the legally binding original. View the Dutch version →
This data processing agreement forms part of the Terms & Conditions and applies as soon as you use Senly as an agency. Senly is the processor; your agency is the controller. In the event of conflict, the EU Standard Contractual Clauses prevail, followed by this agreement.
Senly processes personal data on behalf of your agency when providing the platform (hosting, storage, content planning and publishing, CRM, reporting, support), for as long as the agreement is in force. This includes preparing work that a member of your agency approves: tasks based on email and messages from clients and leads, draft replies, meeting reports, summaries after a meeting and proposals for new leads.
Data subjects: your agency’s end clients and their contacts, client portal users, leads and senders of business enquiries who are not (yet) a relation, participants in meetings and appointments, and your agency’s team members, plus the social media accounts you connect and the followers of your clients who send a DM or comment to them. Data: name and contact details, notes, content and captions, CRM leads, connected account IDs with encrypted access tokens, and statistics; in addition short snippets of email and messages from clients and leads, DMs and comments from followers of your clients (with what they give in them, such as email, phone or answers, also voice messages (transcribed) and the story someone replies to), meeting reports and (temporarily) meeting transcripts, sign-in and usage data of the client portal, billing details a buyer enters when accepting a quote, calendar appointments with clients and leads, and absence and work handover within the team. Followers may mention special categories of personal data on their own initiative (for example about health); do not set up the assistant for that. Which data each feature uses, and for how long, is set out in the privacy statement.
Senly processes personal data solely on your documented instructions (your use of the platform), unless required by law. Connecting a mailbox, calendar or recording service and turning on a feature count as such an instruction. Features that send the content of client email or client messages to an AI service (draft replies) are off by default. Nothing is sent to a client without approval by a member of your agency. Exception, if you turn it on yourself: message funnels and the AI assistant for DMs reply automatically on behalf of your client, without approval per message, to comments and DMs from that client’s followers, telling the follower that it is an automatic reply (AI Act, Article 50), using Google Gemini for the AI replies (privacy statement, 3b).
Everyone with access to personal data is bound by a duty of confidentiality.
Senly takes appropriate technical and organisational measures: encryption at rest (AES-256-GCM) and in transit (TLS 1.3), strict separation per agency with a dedicated key per tenant, access control and roles, two-step verification, audit logging and rate limiting.
You give general authorisation for engaging sub-processors. A current overview is available at /subverwerkers. When a sub-processor is added or replaced, we inform you in good time so you can object. Every sub-processor is bound by the same obligations. Services you connect yourself with your own account or key (such as your mailbox, calendar, a recording service like Fireflies or tl;dv, or an AI service with your own key) are chosen and controlled by you; they are not Senly sub-processors.
Senly helps you with requests for access, rectification, erasure and portability through the export and delete functions in the platform. You export or delete a follower of your client in the message funnel contacts, or delete them from the conversation in the DM inbox (“Delete this person”); this also deletes the conversation, the answers and the notifications about that person. A booked meeting and a lead in your own CRM are deleted there separately.
Senly informs you without undue delay (target: within 24 hours of discovery) of a data breach affecting your data; your agency reports it to the supervisory authority where required.
After termination, Senly deletes the personal data within 90 days, except where a statutory retention obligation applies (such as invoices, which are kept in anonymised form). During the term, the retention periods in the privacy statement apply, for example for meeting transcripts, email text in prepared proposals and the message funnel log (12 months; completed question rounds, appointment requests and notifications 90 days). Disconnecting an Instagram or Facebook account, or switching to another page, deletes the DMs and funnel contacts of that account; Senly also deletes conversations of a connection that has not been active for 90 days.
On request, Senly makes available the information needed to demonstrate compliance, including the sub-processor overview and the security measures.
Transfers outside the EU (including hosting in the United States via Railway) take place on the basis of the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.
This agreement is governed by the Terms & Conditions and Dutch law.
Questions? Contact us via the details in our privacy statement.