Privacy Policy Postiz

1. Scope and nature of the service

This Privacy Policy applies to the self-hosted Postiz instance available at
https://postiz.base.the-corona.net
(the “Service”).

The Service is operated solely for the operator’s own company and internal organizational
purposes. It is not offered to the general public, external clients, consumers, or paid
subscribers. Registration is not publicly available. Access is limited to personnel and
other persons who have been specifically invited or authorized by the operator.

This is an independently operated, self-hosted deployment of the open-source Postiz
software. It is distinct from any Postiz.com, Gitroom, or other third-party hosted service.
The providers or maintainers of the underlying software do not become controllers of data
held in this deployment merely because their software is used.

This policy covers personal data processed through the Service, including account and
authentication information, connected social-media accounts, OAuth credentials, scheduled
content, uploaded media, analytics, and operational logs. Other websites or systems operated
by xFHEngineering may be covered by separate privacy information.

2. Controller and contact

The controller responsible for the processing described in this policy is:

Privacy inquiries and requests to exercise data-protection rights may be sent to the email
address above. No data protection officer has been designated where the legal requirements
for mandatory designation do not apply.

3. Personal data we process

3.1 Account and authorization data

Depending on how access is configured, this may include:

• name, display name, username, and business contact details;
• email address and organizational affiliation;
• account identifiers, assigned roles, permissions, and invitation status;
• authentication records and password-verification data, where local authentication is used;
• login times, failed login attempts, session information, and security events; and
• records concerning the creation, modification, suspension, or deletion of an account.

Passwords, where used, are intended to be stored in a protected, non-plain-text form. Users
must not share credentials or allow unauthorized persons to use their accounts.

3.2 Connected social-media account data

When an authorized user connects a social-media account through OAuth or another supported
authorization mechanism, the Service may process:

• platform name and platform-specific account, page, profile, channel, or organization identifiers;
• profile names, handles, profile images, and other information returned by the platform API;
• OAuth access tokens, refresh tokens, granted permissions, token status, and expiry information;
• lists of pages, profiles, channels, organizations, or other publishing destinations available to the authorized account; and
• information required to publish, retrieve, update, or delete content through the applicable platform API.

The exact information received depends on the connected platform, the permissions approved
during authorization, and the platform’s API.

3.3 Content and media

The Service may process:

• drafts, captions, posts, comments, titles, descriptions, links, tags, and scheduling instructions;
• images, video, audio, documents, thumbnails, and associated metadata;
• publication status, scheduled and actual publication times, destination accounts, and platform responses;
• collaboration, approval, revision, and content-management information; and
• personal data included by users in content or uploaded media.

Authorized users are responsible for ensuring that content entered into the Service may
lawfully be used and published. Users should not upload unnecessary personal data, sensitive
information, or content for which the operator lacks an appropriate legal basis or required
permissions.

3.4 Analytics and engagement data

Where supported by a connected platform, the Service may retrieve and display performance
information such as impressions, reach, views, reactions, clicks, shares, comments, follower
statistics, engagement rates, and similar metrics. Some platform responses may contain
identifiers or other information relating to individual users of that platform.

3.5 Technical, usage, and log data

The Service and its supporting infrastructure may process:

• IP addresses, timestamps, request paths, response status, and browser or device information;
• session identifiers and authentication events;
• application errors, diagnostic information, API responses, and job-processing records;
• audit information about account, content, permission, and configuration changes; and
• security, availability, backup, and abuse-prevention records.

3.6 Support and communications data

If a user contacts the operator about the Service, the operator may process the sender’s
contact details, the content of the communication, attachments, and information needed to
investigate and respond.

3.7 Special categories of personal data

The Service is not intended for the routine processing of special categories of personal
data under Article 9 GDPR or data concerning criminal convictions and offences under
Article 10 GDPR. Users must not enter such data unless doing so has been expressly authorized
and a valid legal basis, appropriate safeguards, and any necessary approvals have been
established.

4. Purposes and legal bases

The operator processes personal data for the following purposes and on the following legal bases:

Where processing is based on Article 6(1)(f) GDPR, the operator balances its stated
legitimate interests against the rights and interests of affected individuals. The internal,
access-restricted nature of the Service, role-based authorization, limited purposes, and
security measures are taken into account in that assessment.

Consent is not used where it would not be freely given, including where an imbalance of
power in an employment relationship would make consent inappropriate. Withdrawal of consent
does not affect the lawfulness of processing carried out before withdrawal.

5. Sources of personal data

Personal data may be obtained:

• directly from the affected person, such as during account setup or support communication;
• from the operator or authorized administrators who create invitations, accounts, roles, or publishing workflows;
• from connected social-media platforms and their APIs after an authorized user grants access;
• from content and media supplied by authorized users; and
• automatically from browsers, devices, servers, applications, and supporting infrastructure when the Service is used.

6. Connected social-media platforms

The Service can interact with third-party social-media platforms only when an authorized
user connects an account and grants the permissions required by that platform. The platform
may display its own authorization screen and explain which permissions and data are involved.

Connected platforms are separate services governed by their own terms, privacy policies, API
rules, and retention practices. Depending on the activity, the platform provider may act as
an independent controller for its processing. The operator does not control how a platform
processes data within its own systems.

When content is published, the destination platform may make it public or otherwise
distribute it according to the account settings and platform functionality. Public content
may be viewed, copied, indexed, shared, archived, or otherwise processed by platform users,
search engines, and unrelated third parties. The operator cannot fully retrieve or delete
those independent copies.

Disconnecting a platform from the Service stops future use of the connection after the
disconnection has taken effect, but it may not automatically:

• delete content already published on the platform;
• delete data retained independently by the platform;
• revoke every active session or authorization held by the platform; or
• remove copies made by third parties.

Users should also use the relevant platform’s account or application settings to revoke
authorization where appropriate. Requests concerning processing performed independently by a
platform should be directed to that platform.

7. Recipients and service providers

Personal data may be disclosed or made accessible, as necessary, to:

• authorized personnel and administrators who require access for their assigned duties;
• the connected social-media platforms selected by authorized users;
• hosting, infrastructure, storage, backup, network, security, monitoring, or technical-support providers engaged by the operator;
• professional advisers, auditors, insurers, or legal representatives where necessary;
• public authorities, courts, or other recipients where disclosure is required by law or necessary to protect legal rights; and
• a successor or restructuring party where this is necessary in connection with a lawful organizational transfer, subject to appropriate safeguards.

Service providers acting as processors are engaged under data-processing terms as required
by Article 28 GDPR and may process personal data only on documented instructions, subject to
applicable confidentiality and security obligations.

Use of the self-hosted Postiz software does not, by itself, mean that account or content data
is sent to the operators of Postiz.com or Gitroom. A separate disclosure would require an
enabled integration, external service, support arrangement, or other documented transfer.

8. International data transfers

The Service may cause personal data to be transferred outside Germany or the European
Economic Area when an authorized user connects to a social-media platform, API, or other
provider whose systems or personnel are located in another country. Such transfers may also
occur if a supporting service provider uses infrastructure or subprocessors outside the
European Economic Area.

Where the operator is responsible for a transfer to a country that does not benefit from an
adequacy decision under Article 45 GDPR, the operator will use an applicable safeguard, such
as the European Commission’s standard contractual clauses under Article 46 GDPR, together
with supplementary measures where required. In limited cases, a derogation under Article 49
GDPR may apply.

Transfers made independently by a connected social-media platform are governed by that
platform’s privacy information and transfer arrangements. Users should review the privacy
policy and authorization information of each platform before connecting it.

Information about the safeguard applicable to a transfer for which the operator is
responsible may be requested using the contact details above. Portions of documents may be
redacted where necessary to protect confidential information or the rights of others.

9. Retention and deletion

Personal data is retained only for as long as reasonably necessary for the purpose for which
it was collected, to operate and secure the Service, or to comply with legal obligations.
Retention is determined by the type of data, the status of the account or connection,
operational requirements, legal limitation periods, and the need to establish, exercise, or
defend legal claims.

In particular:

• Account and authorization data is generally retained while the person is
  authorized to use the Service. Following withdrawal of access, it is deleted or anonymized
  when it is no longer needed for account administration, security, audit, or legal purposes.
• OAuth tokens and connection credentials are retained while the relevant
  connection remains active. They are removed or rendered unusable when the connection or
  account is deleted, subject to technical processing time, backup cycles, security records,
  and any continuing legal obligation.
• Drafts, scheduled content, uploaded media, and publication records are
  retained while needed for the applicable workflow and are deleted when users or
  administrators remove them or when they are no longer required for business, audit, or
  legal purposes.
• Analytics data is retained while it remains useful for legitimate
  reporting and comparison, after which it is deleted or aggregated where reasonably
  possible.
• Technical and security logs are retained for periods appropriate to
  troubleshooting, system integrity, incident investigation, and abuse prevention. Relevant
  records may be retained longer where they relate to a suspected incident or legal claim.
• Support communications are retained until the request has been resolved
  and thereafter for any period necessary for documentation or legal claims.
• Backups are overwritten or deleted according to the operator’s backup
  cycle. Data deleted from the active system may remain in protected backups until the
  relevant backup is overwritten, unless restoration or longer preservation is legally
  required.

Statutory recordkeeping duties or legal holds may prevent immediate deletion. Data retained
solely for such purposes will be restricted from ordinary use where appropriate.

Instructions for requesting deletion or disconnecting data are available at
Deletion of User Data Instructions.
Deleting data from this Service does not necessarily delete content or data already held by a
connected social-media platform.

10. Security

The operator applies technical and organizational measures appropriate to the nature and
risks of the processing. Depending on the relevant system and risk, these measures may
include:

• restricted registration and controlled account provisioning;
• role- and permission-based access controls;
• authentication, session management, and credential-protection measures;
• transport protection for access to the Service;
• system updates, vulnerability management, monitoring, and logging;
• backup, recovery, and availability measures;
• access review and prompt withdrawal of access when authorization ends; and
• confidentiality obligations and internal procedures for authorized personnel.

No internet-connected system can be guaranteed to be completely secure. Users must use
appropriate credentials, protect their sessions and devices, connect only accounts they are
authorized to manage, and promptly report suspected unauthorized access or disclosure to
hermine@the-corona.net.

11. Cookies and similar technologies

The Service may use cookies, browser storage, or comparable technologies that are technically
necessary to provide login sessions, remember security-relevant state, maintain user
preferences, support OAuth authorization flows, prevent misuse, and operate the application.

Necessary technologies are used under Section 25(2) of the German Telecommunications and
Digital Services Data Protection Act (TDDDG), where applicable. Subsequent processing of
personal data is based on the legal grounds described in this policy, particularly Article
6(1)(b) or Article 6(1)(f) GDPR.

The Service is not intended to use advertising cookies or public audience-tracking cookies
for marketing to its internal users. Connected platforms may set or read their own cookies on
their domains during login, authorization, or use of platform pages. Those technologies are
controlled by the applicable platform and are governed by its own privacy and cookie
information.

Blocking necessary cookies or browser storage may prevent login, account connection, or other
essential features from functioning correctly.

12. Your data-protection rights

Subject to the conditions and limitations of applicable law, affected individuals may have
the following rights:

• Access: the right to obtain confirmation of whether personal data is being
  processed and to receive information and a copy under Article 15 GDPR.
• Rectification: the right to have inaccurate data corrected and incomplete
  data completed under Article 16 GDPR.
• Erasure: the right to request deletion under Article 17 GDPR where no
  overriding legal ground requires continued processing.
• Restriction: the right to request restriction of processing under Article
  18 GDPR.
• Data portability: the right, in the circumstances described in Article 20
  GDPR, to receive data provided by the individual in a structured, commonly used, and
  machine-readable format or to request its transmission to another controller where
  technically feasible.
• Withdrawal of consent: where processing is based on consent, the right to
  withdraw that consent at any time with future effect under Article 7(3) GDPR.
• Objection: the right to object under Article 21 GDPR to processing based
  on Article 6(1)(e) or Article 6(1)(f) GDPR on grounds relating to the individual’s
  particular situation. Where personal data is processed for direct marketing, the individual
  may object at any time without giving reasons.

Requests may be submitted to
hermine@the-corona.net. The operator may request
information reasonably necessary to confirm the requester’s identity and protect data from
unauthorized disclosure. Authorized internal users should identify the relevant Service
account and, where applicable, the connected platform or content concerned.

These rights may be limited where processing is required by law, necessary to protect the
rights of another person, or subject to another statutory exception. The operator will
explain any applicable limitation in its response.

Requests concerning data controlled independently by a connected social-media platform must
generally be directed to that platform. The operator will provide reasonable assistance where
the operator is responsible for the relevant processing.

13. Complaints to a supervisory authority

Under Article 77 GDPR, individuals have the right to lodge a complaint with a data-protection
supervisory authority, in particular in the EU Member State of their habitual residence,
place of work, or the place of the alleged infringement. This right is available without
prejudice to any other administrative or judicial remedy.

Information about German data-protection supervisory authorities is available from the

Federal Commissioner for Data Protection and Freedom of Information
.
Individuals may also contact the supervisory authority competent for the operator or another
authority permitted under Article 77 GDPR.

14. Requirement to provide data

The personal data needed to create an account, authenticate a user, assign permissions, and
maintain security must be provided if the person is to use the Service. Connecting a
social-media account is optional unless it is required for the person’s assigned internal
duties. If necessary information or platform permissions are not provided, the relevant
account, connection, or publishing functionality may not be available.

15. Automated decision-making

The operator does not use the Service to make decisions based solely on automated processing
that produce legal effects concerning individuals or similarly significantly affect them
within the meaning of Article 22 GDPR. Scheduling, publication queues, analytics
calculations, and automated technical jobs do not, by themselves, constitute such
decision-making.

16. Children

The Service is an internal business tool and is not directed to children. Accounts must not
be created for persons who are not authorized to use the operator’s internal systems. If the
operator learns that a child’s personal data has been entered without an appropriate legal
basis, it will take reasonable steps to delete or restrict that data.

17. Changes to this policy

This policy may be updated when the Service, connected platforms, legal requirements, or
processing practices change. The current version will be published on the operator’s website
with its revision date. Material changes affecting authorized users may also be communicated
through the Service or appropriate internal channels.

18. Related documents

• Terms of Service for the Internal Postiz Service
• Deletion of User Data Instructions