Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the Customer and Metro Source Co., Ltd., 228/61 Ruammit Pattana, Tarang, Bangkhen, Bangkok 10220, Thailand (“Processor”). It applies when the Processor processes personal data on the Customer's behalf that is subject to the GDPR, the UK GDPR, the Swiss FADP, Thailand's PDPA or similar laws. It takes effect automatically when the Customer accepts the Terms; a countersigned copy is available from legal@admizar.com.
1. Roles and scope
The Customer is the controller and the Processor is a processor of personal data contained in Customer Data. Subject matter: providing the Service. Duration: the term of the subscription plus the deletion period below.
- Categories of data subjects: the Customer's users; people named in campaign names or account names; contacts the Customer enters for alerts.
- Categories of personal data: names, email addresses, platform user IDs, and any personal data the Customer places in campaign or account names. The Service does not request audience or end-user data from ad platforms.
- Special categories: none are intended; the Customer will not submit them.
2. Processor obligations
- Process personal data only on the Customer's documented instructions, including these Terms and the Customer's configuration of the Service.
- Ensure that personnel with access are bound by confidentiality.
- Implement the technical and organisational measures in Annex A.
- Assist the Customer, taking into account the nature of processing, with data subject requests, security, breach notification and data protection impact assessments.
- Notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data.
- At the end of the Service, delete Customer Data within 30 days (and from backups within 35 days thereafter), unless law requires storage.
- Make available information necessary to demonstrate compliance, and allow audits by the Customer or its auditor no more than once a year, on 30 days' notice, at the Customer's cost, primarily through documentation and questionnaires.
3. Subprocessors
The Customer authorises the subprocessors listed on our subprocessors page. We will give at least 30 days' notice of a new subprocessor by updating that page and emailing workspace owners. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining term. We impose data protection terms on each subprocessor that are no less protective than this DPA.
4. International transfers
Where personal data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 controller-to-processor, and Module 3 for onward transfers to subprocessors), with Clause 7 included, Clause 9 option 2 (general authorisation, 30 days' notice), Clause 11 optional language excluded, Clause 17 governed by Irish law and Clause 18 courts of Ireland, completed with the details of this DPA. For UK transfers the UK International Data Transfer Addendum applies; for Swiss transfers the SCCs apply with the FADP adjustments. Transfers out of Thailand comply with sections 28 and 29 of the PDPA.
5. Annex A: security measures
- Encryption in transit (TLS 1.2+) and encryption at rest; platform tokens and API keys additionally encrypted with AES-256-GCM.
- Role-based access in the product; production access limited to authorised personnel; least-privilege OAuth scopes.
- Audit log of changes made to connected ad accounts.
- Managed infrastructure with automated backups; dependency and vulnerability updates applied regularly.
- Payment card data handled solely by Stripe (PCI DSS Level 1).
- Incident response procedure with customer notification as set out above.
6. Precedence
If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the SCCs conflict with this DPA, the SCCs prevail.