Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Code Angels Unipessoal, Lda. ("Processor", "we") and the business customer using adRobin ("Controller", "you"). It applies where we process personal data on your behalf in the course of providing the Service, in accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR").

It does not cover personal data that we process as controller, such as the account and billing data of your users. That processing is described in the Privacy Policy.

2. Details of the processing

• Subject matter and purpose: providing the Service. This means storing and processing the content you provide, generating marketing content and analyses with artificial intelligence, publishing to the social accounts you connect, collecting performance metrics, and providing support.
• Duration: the term of the contract, plus the export and deletion period set out in the Terms.
• Nature of the processing: hosting, storage, organisation, adaptation, transmission to AI model providers and social platforms, retrieval, deletion.
• Types of personal data: any personal data included in Customer Content. This may include names, images and likenesses, contact details, business information about individuals, and content of messages and instructions.
• Categories of data subjects: your employees and collaborators, your customers and prospects, and any person who appears in the content you upload.
• Special categories: not expected. You must not upload special categories of data, or data about criminal convictions, unless strictly necessary and lawful. If you do, you are responsible for ensuring there is a valid legal basis.

3. Our obligations

We will:

• process personal data only on your documented instructions. The Terms, your configuration of the Service and your use of its features are your instructions. We will inform you if we believe an instruction infringes data protection law;
• ensure that anyone authorised to process the data is bound by confidentiality;
• implement the technical and organisational measures described in section 9;
• respect the conditions in section 5 for engaging sub-processors;
• assist you, taking into account the nature of the processing, in responding to requests from data subjects, and in meeting your obligations on security, breach notification, impact assessments and prior consultation;
• notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information available at the time;
• at the end of the Service, delete or return the personal data as set out in the Terms, unless the law requires us to keep it;
• make available the information needed to demonstrate compliance with this DPA, and allow audits as set out in section 8.

4. Your obligations

You are responsible for:

• the lawfulness of the processing and of your instructions;
• having a legal basis for the personal data in Customer Content, including consents or permissions from people shown in images;
• informing data subjects as required by law.

5. Sub-processors

You give us general authorisation to engage sub-processors. The current sub-processors are listed in Annex 1. We will inform you at least 30 days before adding or replacing a sub-processor, by email or in the app. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may terminate the affected Service and receive a refund of any prepaid period not yet used.

We impose on each sub-processor data protection obligations equivalent to those in this DPA, and we remain responsible for their performance.

6. International transfers

Some sub-processors process data outside the European Economic Area. Each such transfer is based on an adequacy decision (including the EU-U.S. Data Privacy Framework, for certified recipients) or on the Standard Contractual Clauses approved by the European Commission, with additional measures where necessary.

7. Artificial intelligence providers

Content sent to AI model providers is used only to produce the outputs you request. Where the provider offers the option, we choose configurations that do not allow your content to be used to train their models.

8. Audits

We will answer reasonable written questions about our compliance and provide relevant documentation. If that is not enough to demonstrate compliance, you may carry out an audit, at your own cost and no more than once a year, or at any time if required by a supervisory authority. The audit is carried out by an independent auditor bound by confidentiality, with at least 30 days' notice, and without disrupting our operations or compromising the security of other customers.

9. Security measures

• Encryption of data in transit (TLS). Encryption at rest where offered by the hosting and database providers.
• Access to production systems limited to authorised personnel on a need-to-know basis, with two-factor authentication for administrative access.
• Logical separation of each customer's data. Access controls in the application.
• Logging of access and of administrative actions.
• Regular backups and restore procedures.
• Protection against automated attacks and abuse, including rate limiting and bot protection.
• Keeping systems and dependencies up to date, and reviewing security changes.
• Procedures for detecting and responding to incidents.

10. Liability and precedence

The limitations of liability in the Terms apply to this DPA, to the extent permitted by law. If there is a conflict between this DPA and the Terms regarding personal data, this DPA prevails.

Annex 1: Sub-processors