Scope and roles#
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Client") and [to be completed: company name] ("AdTomato"). It applies when AdTomato processes personal data on the Client's behalf while providing the Service, mainly the data of the Client's leads and site visitors.
- The Client is the controller (in Brazil, controlador; in Latin American laws, responsable) of that data.
- AdTomato is the processor (operador; encargado) and processes it only for the Client.
- For its own account, billing and website data, AdTomato is a separate controller under the Privacy Policy.
The DPA is written to meet GDPR art. 28, UK GDPR art. 28, LGPD arts. 37–40 and the equivalent rules of the other laws named in the Privacy Policy.
Details of the processing#
| Subject matter | Hosting the Client's sites and forms, collecting and showing leads, tracking visits and conversions, sending conversions to the ad accounts the Client's campaigns run on (its own or a partner agency's) when the Client turns it on |
|---|---|
| Duration | For the term of the Terms, plus the deletion period below |
| Data subjects | Visitors of the Client's sites, people who submit the Client's forms and ad lead forms, the Client's customers |
| Categories of data | Contact details a person enters (name, email, phone, message), form answers, source page and campaign, ad click identifiers, IP address, browser and device data, visit events |
| Special categories | None intended; the Client must not collect them through the Service |
AdTomato's obligations#
AdTomato will:
- process the data only on the Client's documented instructions, which are these Terms, this DPA and the Client's settings in the dashboard, unless the law requires otherwise (in which case it will tell the Client, unless the law forbids that);
- make sure that people authorised to process the data are bound by confidentiality;
- apply the security measures described below;
- help the Client, as far as possible, to answer requests from data subjects and to meet its obligations on security, breach notification, impact assessments and consultation of authorities;
- notify the Client without undue delay after becoming aware of a personal data breach affecting the Client's data, with the information available;
- delete or return the data at the end of the Service, as described below;
- make available the information needed to show compliance with this DPA, and allow reasonable audits (see Audits).
Client's obligations#
The Client is responsible for having a lawful basis for the processing, for giving people the information the law requires (for example a privacy notice and, where needed, a consent checkbox on its forms), for answering data subjects, and for the lawfulness of its instructions.
Security measures#
AdTomato applies technical and organisational measures appropriate to the risk, including encryption of data in transit, access control on a need-to-know basis, separation of the Client's data from other clients' data in the application, logging of administrative access and a process for handling incidents. It reviews these measures as the Service evolves.
Subprocessors#
The Client gives a general authorisation for AdTomato to use subprocessors. The current list is in Subprocessors. AdTomato will inform the Client of a new or replaced subprocessor at least 30 days in advance by email or in the dashboard; the Client may object on reasonable data protection grounds and, if no solution is found, terminate the affected Service. AdTomato imposes on each subprocessor data protection obligations equivalent to this DPA and remains responsible for it.
International transfers#
Where Client data is transferred out of the EU/EEA, the UK, Brazil or another country that restricts transfers to a country without an adequacy decision, the parties agree that the relevant standard contractual clauses apply: the European Commission's clauses (Decision 2021/914, Module 2 or 3 as appropriate), the UK Addendum, the ANPD's standard contractual clauses in Brazil, and the equivalent instruments of the other applicable laws.
Deletion and return#
The Client can export its leads at any time. When the Service ends, AdTomato deletes the Client's personal data within [to be completed: retention period], unless the law requires it to keep some of it; copies in backups are deleted on their normal rotation.
Audits#
AdTomato will answer reasonable written questions about its compliance. Where that is not enough, the Client may audit once a year, with at least 30 days' notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and without access to other clients' data.
Liability and order of precedence#
Liability under this DPA is subject to the limits in the Terms, as far as the law allows. If this DPA conflicts with the Terms on data protection, this DPA prevails; the standard contractual clauses prevail over both.
Contact#
Data protection questions: [to be completed: privacy contact].