Data Processing Agreement (DPA)

1. Definitions

Terms including personal data, processing, controller, processor, sub-processor, data subject, personal data breach and supervisory authority have the meanings given to them in the GDPR.

“Data Protection Laws” means the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended, India’s Digital Personal Data Protection Act 2023, and any other data protection or privacy law applicable to the processing under this DPA.

“Standard Contractual Clauses” or “SCCs” means the clauses annexed to European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor).

2. Scope & order of precedence New

This DPA applies where GBPPromote processes personal data on behalf of the Controller in the course of providing the Services.

In the event of a conflict, the following order of precedence applies:

1. The Standard Contractual Clauses, where they apply to a transfer
2. This DPA, including its Annexes
3. The Terms & Conditions and any order form

Except as modified by this DPA, the Terms & Conditions remain in full force.

3. Roles of the parties

• The Customer is the Data Controller, and determines the purposes and means of processing.
• GBPPromote is the Data Processor, and processes personal data on the Controller’s behalf.
• Where the Customer is itself a processor acting for a third party — for example an agency acting for its clients — the Customer warrants it has authority to instruct us on that third party’s behalf, and this DPA applies as though the Customer were the Controller.

GBPPromote acts as an independent controller in respect of limited data processed for its own purposes, such as billing records, account administration and platform security. That processing is governed by our Privacy Policy rather than this DPA.

4. Processing instructions Art 28(3)(a)

GBPPromote shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to process by Union, Member State or other applicable law to which GBPPromote is subject.

Where such a legal requirement applies, GBPPromote shall inform the Controller of that legal requirement before processing, unless the law prohibits doing so on important grounds of public interest.

The Controller’s instructions comprise this DPA, the Terms & Conditions, the configuration choices made in the platform, and any further written instructions agreed between the parties.

5. Confidentiality of personnel Art 28(3)(b)

GBPPromote shall ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Access to personal data is limited to personnel who require it to perform their role, and is granted on a least-privilege basis. Confidentiality obligations survive the end of a person’s engagement with GBPPromote.

6. Sub-processors Art 28(2), 28(3)(d) Rewritten

The Controller gives general written authorisation for GBPPromote to engage sub-processors to provide infrastructure, payment processing, email delivery, analytics, AI-assisted features and support services.

Current sub-processors

The sub-processors engaged as at the date of this DPA are listed in Annex III.

Changes and right to object

• GBPPromote will give the Controller at least 30 days’ notice before engaging a new sub-processor or replacing an existing one, by email to the account’s registered address or by updating Annex III with notice through the platform.
• The Controller may object on reasonable data protection grounds within that 30-day period.
• If the parties cannot resolve the objection, the Controller may terminate the affected Services without penalty, with a pro-rata refund of prepaid fees for the unused period.
• Where no objection is raised within 30 days, the new sub-processor is deemed authorised.

Sub-processor obligations

GBPPromote imposes on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA. Where a sub-processor fails to fulfil those obligations, GBPPromote remains fully liable to the Controller for the performance of that sub-processor’s obligations.

7. Security measures Art 28(3)(c), Art 32

GBPPromote implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, implementation costs, and the nature, scope, context and purposes of processing.

Those measures are set out in Annex II. GBPPromote may update them provided the level of protection is not materially reduced.

8. International transfers Expanded

GBPPromote is established in India and processes personal data in India, and may process data in other countries including the United States and the European Union depending on infrastructure and sub-processors.

EEA transfers

Where personal data is transferred from the EEA to a country without an adequacy decision, the transfer is governed by the Standard Contractual Clauses, Module Two (controller to processor), which are incorporated into this DPA by reference and completed as follows:

• Clause 7 (docking): applies
• Clause 9 (sub-processors): Option 2, general written authorisation, with the 30-day notice period in section 6
• Clause 11 (redress): the optional independent dispute resolution provision does not apply
• Clause 17 (governing law): the law of the Republic of Ireland
• Clause 18(b) (forum): the courts of Ireland
• Annexes I, II and III to the SCCs: the Annexes to this DPA serve as the corresponding SCC annexes

UK transfers

For transfers subject to the UK GDPR, the SCCs apply as supplemented by the UK International Data Transfer Addendum issued by the Information Commissioner’s Office, with the relevant tables completed by reference to this DPA.

Swiss transfers

For transfers subject to Swiss law, references in the SCCs to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

9. Data subject rights Art 28(3)(e)

Taking into account the nature of the processing, GBPPromote shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligation to respond to requests to exercise data subject rights — including access, rectification, erasure, restriction, portability and objection.

Where GBPPromote receives a request directly from a data subject relating to the Controller’s data, it will not respond to the request itself except to acknowledge receipt and direct the individual to the Controller, and will inform the Controller without undue delay.

Many rights can be exercised by the Controller directly through the platform, including exporting and deleting records.

10. DPIAs & prior consultation Art 28(3)(f) New

Taking into account the nature of processing and the information available to it, GBPPromote shall provide reasonable assistance to the Controller in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, namely:

• Article 32 — security of processing
• Article 33 — notification of a personal data breach to the supervisory authority
• Article 34 — communication of a breach to data subjects
• Article 35 — Data Protection Impact Assessments
• Article 36 — prior consultation with a supervisory authority

Assistance is provided on request and may be subject to a reasonable charge where the request goes materially beyond providing information GBPPromote already holds.

11. Personal data breach Timeframe added

GBPPromote shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting the Controller’s personal data, so that the Controller can meet its own obligations under Article 33 of the GDPR.

The notification will include, to the extent known at the time and supplemented as further information becomes available:

• The nature of the breach, including categories and approximate numbers of data subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address it and mitigate its effects
• A contact point for further information

GBPPromote will cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation and remediation of the breach. Notification is not an acknowledgement of fault or liability.

12. Audits & inspections Art 28(3)(h) Expanded

GBPPromote shall make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

How audits work in practice

• The Controller gives at least 30 days’ written notice, except where an audit is required by a supervisory authority or follows a personal data breach, in which case notice is as short as reasonably practicable.
• Audits take place during normal business hours, cause minimal disruption, and occur no more than once in any 12-month period unless required by a supervisory authority or following a breach.
• The Controller and any mandated auditor are bound by confidentiality obligations, and the auditor must not be a competitor of GBPPromote.
• GBPPromote may satisfy an audit request by providing existing third-party audit reports, certifications or security documentation where these reasonably address the Controller’s questions.
• Each party bears its own costs. Where an audit requires materially more than reasonable assistance, GBPPromote may charge on a time-and-materials basis, agreed in advance.

13. Deletion or return of data Art 28(3)(g)

On termination of the Services, and at the Controller’s choice, GBPPromote shall delete or return all personal data processed on the Controller’s behalf, and delete existing copies, unless applicable law requires continued storage.

• The Controller may export its data through the platform at any time during the subscription and for a limited period after termination.
• Absent an instruction to return, personal data is deleted within a reasonable period following termination.
• Data may persist in encrypted backups until those backups expire on their normal rotation schedule, during which it remains protected by the measures in Annex II and is not actively processed.
• Where law requires retention — for example tax or accounting records — GBPPromote retains only what is necessary and for no longer than required.

14. California service provider terms New

Where GBPPromote processes personal information subject to the California Consumer Privacy Act as amended by the CPRA, GBPPromote acts as a “service provider” and certifies that it:

• Will not sell or share personal information
• Will not retain, use or disclose personal information other than for the specific business purpose of performing the Services, or as otherwise permitted by the CCPA
• Will not retain, use or disclose personal information outside the direct business relationship between GBPPromote and the Customer
• Will not combine personal information received from the Customer with personal information received from other sources, except as permitted by the CCPA
• Understands these restrictions and will comply with them

GBPPromote will notify the Customer if it determines it can no longer meet these obligations.

15. Liability & governing law

Liability under this DPA is subject to the exclusions and limitations set out in the Terms & Conditions, and the aggregate cap there applies to all claims under the Terms and this DPA taken together, not separately.

This DPA is governed by the law specified in the Terms & Conditions, without prejudice to mandatory Data Protection Laws and to the governing law of the Standard Contractual Clauses where those apply to a transfer.

16. How this DPA is entered into New

This DPA is automatically incorporated into the agreement between the parties and takes effect when the Customer accepts the Terms & Conditions or begins using the Services. No signature is required for it to be binding.

Where the Customer’s procurement process requires a countersigned copy, request one at amit@gbppromote.com with the legal entity name, registered address and signatory details, and we will return an executed version.

This DPA terminates automatically when the Services end and all personal data has been deleted or returned under section 13, except for provisions that by their nature survive.

17. Contact details