Data Processing Addendum

1. Definitions

In addition to terms defined elsewhere in this DPA, the following definitions apply:

• "Applicable Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including the GDPR, UK GDPR, CCPA, and other national or state privacy laws.
• "Controller" means the entity that determines the purposes and means of Processing Personal Data.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "GDPR" means the General Data Protection Regulation (EU) 2016/679.
• "Personal Data" means any information relating to an identified or identifiable natural person that is Processed by Adbridge in connection with providing the Service to Customer.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Processing" (and "Process") means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Processor" means the entity that Processes Personal Data on behalf of the Controller.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of Personal Data to third countries approved by the European Commission.
• "Sub-processor" means any third party engaged by Adbridge to Process Personal Data on behalf of Customer.

2. Roles and Responsibilities

2.1 Controller-Processor Relationship

With respect to the Processing of Personal Data under this DPA:

• Customer is the Controller of Personal Data that Customer provides to Adbridge or instructs Adbridge to Process (e.g., conversion data from webhooks).
• Adbridge is the Processor when Processing Personal Data on behalf of Customer to provide the Service.
• Adbridge is the Controller of Personal Data it collects independently for its own purposes (e.g., Customer account information, platform analytics).

2.2 Customer Responsibilities

Customer agrees to:

• Comply with Applicable Data Protection Laws in its use of the Service
• Ensure it has a lawful basis for providing Personal Data to Adbridge
• Provide any required notices to, and obtain any required consents from, Data Subjects
• Only transmit data that is necessary for the Service (see our Acceptable Use Policy)
• Respond to Data Subject requests and notify Adbridge when assistance is needed

2.3 Adbridge Responsibilities

Adbridge agrees to:

• Process Personal Data only on documented instructions from Customer
• Ensure personnel authorized to Process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist Customer in responding to Data Subject requests
• Notify Customer of Personal Data Breaches without undue delay
• Delete or return Personal Data upon termination, subject to legal retention requirements

3. Scope of Processing

3.1 Categories of Personal Data

Adbridge may Process the following categories of Personal Data on behalf of Customer:

• Transaction Data: Order identifiers, transaction amounts, currency, timestamps
• Attribution Data: Coupon codes, promo codes, UTM parameters, referral identifiers
• Creator Data: Creator names, email addresses, payout information (for commission processing)
• Contract Metadata: Deal terms, deliverables, campaign information

3.2 Categories of Data Subjects

• Customer's employees and authorized users
• Content creators participating in Customer's campaigns
• End consumers (only to the extent attribution data is provided)

3.3 Purposes of Processing

Personal Data is Processed solely for the following purposes:

• Providing the Service as described in the Terms of Service
• Conversion tracking and attribution analysis
• Commission calculation and payout processing
• Generating analytics and performance reports
• Maintaining audit logs for compliance and security
• Customer support and troubleshooting

3.4 Duration of Processing

Personal Data will be Processed for the duration of the Agreement plus any retention periods required by Applicable Data Protection Laws or as specified in our Data Retention Policy.

4. Security Measures

Adbridge implements appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage. These measures include:

4.1 Technical Measures

• Encryption: TLS 1.2 or higher in transit; AES-256 server-side encryption for stored files, with additional application-layer AES-256-GCM encryption for integration credentials, two-factor authentication secrets, and payout-recipient contact details
• Access Controls: Role-based permissions and workspace isolation, with re-authentication required for sensitive actions including changes to payment settings, payout execution, and rotation of integration secrets
• Account Security: Two-factor authentication and passkey sign-in available to all users, password complexity requirements, and automatic lockout after repeated failed sign-in attempts
• Network Security: Cloud provider network controls, including a web application firewall and DDoS protection at the load balancer
• Logging and Monitoring: Audit logging of security-relevant events, including access to unmasked webhook payload data and exports of financial records
• Vulnerability Management: Automated dependency and secret scanning in our development pipeline, malware scanning of uploaded files, and prompt patching of identified issues
• Rate Limiting: Request rate limits on authentication, export, and payout operations

4.2 Organizational Measures

• Personnel: Personnel with access to Personal Data are bound by written confidentiality obligations, and access is limited to those who need it to operate and support the Service
• Access Management: Administrative access is restricted, and sensitive administrative actions require re-authentication and are recorded in our audit log
• Physical Security: The Service runs on cloud infrastructure provided by Amazon Web Services; physical security of the underlying data centers is AWS's responsibility and is covered by its own certifications
• Business Continuity: Managed database backups through our cloud provider

4.3 Security Certifications

Adbridge does not currently hold a SOC 2, ISO 27001, or equivalent certification of its own. Our infrastructure provider, Amazon Web Services, maintains SOC 2 Type II, ISO 27001, and other certifications covering the infrastructure on which the Service runs; those reports are published by AWS and are available through its compliance program. We are glad to complete security questionnaires and to describe our controls in detail on request.

5. Sub-processors

5.1 Authorized Sub-processors

Customer authorizes Adbridge to engage the following categories of Sub-processors:

5.2 Sub-processor Obligations

Adbridge ensures that each Sub-processor is bound by data protection obligations no less protective than those in this DPA.

5.3 New Sub-processors

Adbridge will notify Customer at least 30 days before engaging a new Sub-processor by updating this page and notifying Customer via email. To be added to the notification list, or to confirm the recipient address for these notices, email us at legal@adbridge.com. Customer may object to a new Sub-processor within 14 days of notification by contacting legal@adbridge.com. If Customer reasonably objects and Adbridge cannot address the objection, Customer may terminate the affected Service without penalty.

6. International Data Transfers

6.1 Transfer Mechanisms

Adbridge is based in the United States. When Personal Data is transferred from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States or other third countries, we rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): We incorporate the EU Commission's Standard Contractual Clauses (Module 2: Controller to Processor) into our agreements with customers located in the EEA, UK, or Switzerland.
• UK Addendum: For UK transfers, we supplement SCCs with the UK International Data Transfer Addendum.
• Supplementary Measures: We implement additional technical and organizational safeguards as needed.

6.2 Transfer Impact Assessments

Customer is responsible for its own transfer impact assessment. Adbridge will provide the information reasonably necessary to support that assessment, including the identity and location of Sub-processors, the categories of Personal Data involved, and a description of the safeguards we apply.

6.3 Government Access Requests

If Adbridge receives a legally binding request for access to Personal Data from a government authority, we will:

• Notify Customer (unless legally prohibited)
• Challenge the request if there are grounds to do so
• Provide only the minimum data legally required
• Maintain an internal record of such requests

7. Data Subject Rights

Adbridge will assist Customer in fulfilling its obligations to respond to Data Subject requests exercising rights under Applicable Data Protection Laws:

7.1 Types of Requests

• Access: Providing copies of Personal Data
• Rectification: Correcting inaccurate Personal Data
• Erasure: Deleting Personal Data ("right to be forgotten")
• Restriction: Limiting Processing of Personal Data
• Portability: Providing Personal Data in a portable format
• Objection: Objecting to certain types of Processing

7.2 Response Process

• Customer is responsible for receiving and validating Data Subject requests
• Adbridge will respond to Customer requests for assistance within 10 business days
• If Adbridge receives a request directly, we will redirect the Data Subject to Customer (unless legally required to respond directly)

7.3 Costs

Adbridge will provide reasonable assistance at no additional charge. For requests requiring substantial effort, Adbridge may charge reasonable fees based on administrative costs.

8. Personal Data Breach Notification

8.1 Notification Timeline

Adbridge will notify Customer of a confirmed Personal Data Breach without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

8.2 Notification Content

The notification will include (to the extent known):

• Description of the nature of the breach, including categories and approximate number of Data Subjects affected
• Name and contact details of Adbridge's point of contact
• Description of likely consequences of the breach
• Description of measures taken or proposed to address the breach

8.3 Cooperation

Adbridge will cooperate with Customer's investigation and, upon request, assist Customer in meeting its own breach notification obligations to supervisory authorities and Data Subjects.

8.4 Notification Method

Breach notifications will be sent to Customer's designated security contact via email and, for critical breaches, by phone if contact information is available.

9. Audit Rights

9.1 Documentation

Upon Customer's written request (no more than once per year), Adbridge will provide:

• Copies of relevant policies and procedures
• A description of the security measures in place
• Pointers to our infrastructure provider's audit reports (for example, the AWS SOC 2 report available through its compliance program)
• Responses to reasonable security questionnaires

9.2 On-Site Audits

If documentation is insufficient to verify compliance, Customer may request an on-site audit subject to:

• Reasonable advance notice (at least 30 days)
• Execution of appropriate confidentiality agreements
• Audits conducted during normal business hours
• Customer bearing its own audit costs
• No more than one audit per 12-month period (unless required by a supervisory authority)

10. Data Deletion and Return

10.1 Upon Termination

Upon termination or expiration of the Agreement, Customer may request that Adbridge:

• Return: Provide a copy of Personal Data in a commonly used format
• Delete: Permanently delete Personal Data from Adbridge systems

10.2 Deletion Timeline

• Deletion requests will be completed within 90 days
• Adbridge will provide written confirmation of deletion upon request
• Data may persist in encrypted, access-controlled backups until those backups expire on their normal cycle

10.3 Exceptions

Adbridge may retain Personal Data where required by Applicable Data Protection Laws (e.g., tax records, transaction records). In such cases, Adbridge will inform Customer of the retention requirement and continue to protect the data under this DPA.

11. Liability

Each party's liability under this DPA is subject to the limitations of liability set forth in the Terms of Service. Nothing in this DPA limits either party's liability for:

• Gross negligence or willful misconduct
• Violations of Applicable Data Protection Laws caused by the party's breach of this DPA
• Liability that cannot be limited under applicable law

12. Conflict

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the Processing of Personal Data. In the event of a conflict between this DPA and the SCCs (if applicable), the SCCs shall prevail.

13. Updates to This DPA

Adbridge may update this DPA from time to time to reflect changes in our data processing practices or Applicable Data Protection Laws. We will notify Customer of material changes at least 30 days before they take effect. Continued use of the Service after changes become effective constitutes acceptance of the updated DPA.

14. Contact Information

For questions about this DPA or data processing matters, please contact: