Data Processing Addendum (DPA)

Processor processes personal data on behalf of Controller exclusively for the purpose of providing the platform service described in the Order Form: reporting, audit, and analytics on advertising and ecommerce data the Controller chooses to connect. Processing operations include storage, structuring, retrieval, and erasure.

The DPA takes effect on the Order Form effective date and ends 30 days after the subscription terminates (the export-grace window). Article 28 obligations continue for any period during which residual personal data is retained — e.g. in time-limited backups.

Data subjects:

• Controller's authorised users (your employees).
• Controller's end-users (visitors / customers of Controller's websites), to the limited extent their identifiers are exposed by the connected advertising platforms.

Categories of personal data:

• Account data (email, name, locale, timezone, hashed password, 2FA enrolment status).
• Authentication credentials (OAuth refresh tokens, API keys; envelope-encrypted at rest).
• Audit-log entries (IP address, user agent, action metadata).
• Aggregated daily metrics by campaign — no individual end-user PII is ingested.

• Comply with applicable data protection laws as Controller.
• Ensure a lawful basis for any personal data made available to Processor.
• Provide accurate and lawful processing instructions through the Order Form, this DPA, and the standard product interfaces.
• Respond to data-subject rights requests, with Processor's assistance under §6.

Processor will:

• process personal data only on documented Controller instructions and the necessary operations described in §1;
• ensure persons authorised to process are bound by confidentiality;
• implement the technical and organisational measures in Annex 2;
• not engage a new sub-processor without Controller's prior general authorisation per §7;
• assist Controller, taking the nature of processing into account, in fulfilling its Article 32–36 obligations;
• at Controller's choice, delete or return all personal data after termination, subject to retention required by law (e.g. tax records);
• make available all information necessary to demonstrate compliance and allow audits per §9;
• inform Controller without delay if an instruction infringes data-protection law.

Processor assists Controller, by appropriate technical and organisational measures and to the extent reasonably possible, in responding to requests for the exercise of data-subject rights (Articles 15–22), including via self-service endpoints such as GET /api/v1/auth/me/export/. Processor also assists with security (Art. 32), breach notification (Art. 33–34), DPIA (Art. 35), and prior consultation (Art. 36).

Controller grants Processor general authorisation to engage the sub-processors listed at the public sub-processors page, which forms Annex 3. Processor will notify Controller at least 30 days before adding or replacing a sub-processor. Controller may object on reasonable data-protection grounds; if the parties cannot agree on a remedy, Controller may terminate the affected services without penalty for the remainder of the term.

Processor remains fully liable to Controller for any sub-processor's performance of its data-protection obligations.

Production data stays within the European Economic Area. Where a sub-processor processes data outside the EEA, Processor relies on:

• Standard Contractual Clauses (Commission Implementing Decision 2021/914), incorporated by reference; and
• the EU-US Data Privacy Framework where applicable (for US-based recipients certified under the Framework).

Processor will make available the information necessary to demonstrate compliance with Article 28, including recent third-party audit reports (when available) under NDA. Controller may, with at least 30 days' written notice and no more than once per 12 months, conduct an audit at its own cost, during normal business hours, in a manner that does not disrupt operations and respects the confidentiality of other customers. Regulator-mandated audits are permitted without these limits.

Processor will notify Controller without undue delay — and in any event within 72 hours of becoming aware — of a personal data breach affecting Controller's data. The notification will include the categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed.

Within 30 days of termination, Controller may export Customer Data via the standard product interfaces. After that window Processor deletes all personal data from production systems within 30 days and from backups by their natural expiry (max 6 months). Processor will confirm deletion in writing on request, subject to statutory retention requirements (e.g. tax invoices retained 10 years per Czech law).

Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service. For a signed DPA (countersigned PDF), contact dpa@advisio.cz.