Data Processing Addendum

1. Scope and roles

This Addendum applies where Adspayingmedia LLC (“processor”) processes personal data on behalf of a customer (“controller”) in providing UTMCAP. It supplements the Terms of Service and prevails over them on any point about processing personal data.

You are the controller of the click and visitor data you collect through the service. We are your processor for it. For data about your own account we are the controller — see the Privacy Policy.

2. What is processed

3. Our instructions

We process personal data only on your documented instructions, which are given by your configuration of the service and this Addendum, and otherwise where a law we are subject to requires it — in which case we will tell you first unless that law forbids it.

Everyone with access is bound by confidentiality. Access to production data is limited to what is needed to run and support the service.

We will tell you if, in our view, an instruction of yours would break data protection law. We are not obliged to act on it.

4. Security measures

• Encryption in transit for all traffic to and from the service.
• Encrypted backups, verified by restoring them rather than by assuming.
• Passwords stored with a memory-hard hashing function, never reversibly.
• Tenant isolation: each account’s data is separated, and nothing is pooled or aggregated across customers.
• Key-based administrative access; no shared passwords for production systems.
• Rate limiting and abuse detection on authentication.
• Least-privilege credentials between the application and its data stores.

These are measures we maintain, not aspirations. If a specific control is a condition of your own compliance, ask before you rely on it.

5. Sub-processors

You give general authorisation for the sub-processors below. Each is engaged under written terms no less protective than this Addendum.

We will give at least 30 days’ notice by email before adding or replacing one. If you reasonably object on data protection grounds, tell us within that period; if we cannot resolve it, you may end the affected part of the service and be refunded the unused part of any prepaid term.

The Copilot’s AI

When you ask the Copilot a question, the question and the figures its AI looks up to answer it are sent to the AI provider that answers. What it looks up are grouped figures and names — totals by campaign, zone, placement, country or device, and the names of your campaigns, sources and offers. It is never sent a visitor’s IP address, a click ID, or any of your keys, and nothing it is sent identifies a visitor. We do not store the question or the answer: only that one was asked, by whom, when, through which provider, and its size, to count the plan’s monthly questions.

With UTMCAP’s built-in AI, the provider is our sub-processor and is named in the table above. If you connect your own AI with your own API key, that provider is yours: it processes under your contract with it, not ours, and is not our sub-processor.

Advertising accounts you connect

Where you connect an advertising account — Google Ads, Microsoft Advertising, PropellerAds and the others offered under Integrations — we read its spend, send it your conversions, and, when you press a button to apply a Copilot change, make that change in it: blocking a zone, adding a negative keyword, changing a bid or a budget, pausing a campaign. These are your instructions, and the platform is your own supplier, not our sub-processor. One change sends personal data: an IP address exclusion sends that address to the platform, and only when you press the button that asks for it. Every change made in a connected account is logged, and can be undone from the Copilot.

6. Assistance

Taking into account the nature of the processing, we will help you with:

• requests from data subjects — if one reaches us directly we will refer them to you and, where you ask, help you respond;
• data protection impact assessments and prior consultations;
• demonstrating compliance with this Addendum.

7. Breach notification

We will notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting data we process for you. The notice will say what we know at the time — what happened, what data is involved, what we are doing — rather than waiting until the picture is complete.

8. Transfers

Clicks are answered at the Cloudflare location nearest the visitor, so processing is by nature international. Where personal data is transferred out of the EEA, the UK or another jurisdiction with transfer restrictions, it is transferred under the Standard Contractual Clauses or another mechanism recognised for that jurisdiction, with the supplementary measures set out in section 4.

9. Return and deletion

At the end of your plan’s retention period, in the ordinary course, the personal data in click records — IP address, browser string, the full referring address, and query strings in page addresses — is removed. What remains is anonymous and is deleted after two years at most. On termination we retain data for 30 days so an accidental closure can be undone, then delete it, unless a law requires us to keep it — in which case we keep only what that law requires, and keep protecting it.

You can export your data at any time while the account is open, and can ask for an export during the 30 days.

Backups are on a rolling schedule and are deleted as they age out rather than being opened to remove individual records, so data deleted or anonymised in live systems stays in backups until they do. Data in a backup is not restored into service.

10. Audits

On reasonable notice, and no more than once a year unless an authority requires otherwise, we will make available the information needed to demonstrate compliance with this Addendum and will cooperate with an audit. We may satisfy this with existing documentation and written answers where those genuinely address the question.

Contact for anything in this document: [email protected].