Data processing agreement

This agreement forms part of our terms of service. It applies when we process personal data for you through Ad Intel. It is made between you ("the customer", the controller) and Cyber Investments Ltd, trading as Ad Intel, company number 17510180, 6 Hill Rise, Seaford, East Sussex, BN25 2UA, United Kingdom ("we", "us", the processor). It takes effect when you accept the terms and lasts for as long as we process that personal data.

"Data protection law" means the UK GDPR, the Data Protection Act 2018 and, where it applies to you, the EU GDPR. Words such as "personal data", "controller", "processor", "processing" and "personal data breach" have the meanings they have in that law.

1. What this covers

We do not need personal data about your customers, and ask you not to upload it. Where it appears in a file, our imports are built to leave it out or to turn it into a hashed value.

2. Roles

You are the controller of the personal data in your account and we process it as your processor. You must have a lawful basis to give us that data and to have us process it, and you must give people any notices that the law requires. For the personal data we use for our own purposes, such as managing your account, billing and keeping Ad Intel secure, we are a controller and our privacy notice applies.

3. Our promises as your processor

We will:

1. process the personal data only on your documented instructions, which are these terms, this agreement and your use of Ad Intel's settings and features, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it);
2. tell you if we think an instruction breaks data protection law;
3. make sure everyone who is allowed to handle the data is bound by a duty of confidentiality;
4. keep the data secure with the measures in section 5;
5. only use sub-processors as set out in section 6;
6. help you answer requests from people exercising their rights (see section 7);
7. help you meet your security, breach notification, impact assessment and prior consultation duties, taking into account the nature of the processing and the information we hold (see section 8);
8. delete or return the data when the services end (see section 9); and
9. give you the information you reasonably need to show we are following this agreement, and allow audits (see section 10).

4. What we do not do

We do not sell the personal data, use it for advertising, or use it to train AI models. Where we use AI, it is given aggregated business and performance facts, not personal data, and what it writes is checked against your figures before you see it. The AI provider is listed on our sub-processors page.

5. Security

We use appropriate technical and organisational measures to protect the data, including:

• separation of each customer's data from every other customer's;
• encryption in transit, and encryption of the access tokens that connect to your ad accounts;
• two-step sign-in, role-based permissions, and a tamper-evident record of who changed what;
• scanning of uploaded files, and limits on the sizes and types accepted;
• secure development and review practices, automated tests and security monitoring;
• regular off-site backups, kept for about 30 days; and
• a process to find, contain and report security problems.

We may improve these measures. We will not reduce the overall level of protection.

6. Sub-processors

You give us general permission to use sub-processors. The ones we use today, with what each does and where, are on our sub-processors page. We have a written contract with each that requires it to protect the data to the same standard as this agreement, and we are responsible for what it does with your data.

We will update the page before adding or replacing a sub-processor that handles your personal data, and tell account owners by email at least 30 days before the change takes effect. If you object on reasonable data protection grounds within that time, we will work with you to find a solution. If we cannot, you may end the affected service and we will refund the part of any prepaid fees that covers the period after it ends.

7. Requests from people

If someone asks us about their personal data in your account, we will pass the request to you and not answer it ourselves unless you ask us to or the law requires. We will give you the tools, and reasonable help, to find, correct, export and delete the data. Account owners can also use the privacy tools in the service.

8. Breaches and assessments

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and aim to do so within 48 hours of becoming aware. We will give you the information we have about what happened, what data and people are affected, the likely effects, and what we are doing, so that you can meet your own duties. We will keep you informed as we learn more.

We will give you reasonable help with data protection impact assessments and consultations with the regulator that relate to your use of Ad Intel.

9. When the service ends

When your account is closed, or you ask us to, we will delete or anonymise the personal data in it within a reasonable period, and in any case in line with the retention periods in our privacy notice. Backups are overwritten within about 30 days. Before closing the account you can export your data. We may keep data that the law requires us to keep, and we will keep it secure and use it only for that purpose.

10. Audits and information

On reasonable written request, and not more than once a year (unless a breach or a regulator requires it), we will give you the information needed to show we follow this agreement, such as a description of our security measures. If that does not satisfy you, we will allow an audit by you or an independent auditor you appoint, under a confidentiality agreement, on reasonable notice and in working hours, without disrupting our service or other customers. You pay your own costs and our reasonable costs of helping.

11. Transfers outside the UK

We are based in the United Kingdom. We will not transfer the personal data outside the UK (or outside the EEA, if EU GDPR applies to your data) unless there is a lawful safeguard in place, such as an adequacy decision or the UK International Data Transfer Agreement or Addendum, or the EU standard contractual clauses. Our sub-processors page shows where each sub-processor works and which safeguard we rely on. Where a transfer needs it, you authorise us to enter into those clauses with the sub-processor on your behalf.

12. Responsibility

Each of us is responsible for what the law makes it responsible for. Liability under this agreement is subject to the limits in the terms of service, except where the law does not allow that.

13. Changes

We may update this agreement if the law changes or we change how the service works. A material change will be notified as set out in the terms of service. If there is a conflict between this agreement and the terms of service about personal data, this agreement wins.

14. Law

This agreement is governed by the law of England and Wales, and its courts have exclusive jurisdiction.

15. Contact

For questions about this agreement or data protection, use the contact form. Cyber Investments Ltd is registered with the Information Commissioner's Office under reference ZC270114.