Data Processing Agreement

This agreement forms part of the Terms of Service between the customer (“you”) and Konstantin Shchegolev, a sole trader established in Portugal (“we”), and applies to personal data we process for you when we read the Google Ads accounts you connect to AdTattle. It follows Article 28 of the EU General Data Protection Regulation (GDPR).

1. Roles

You are the controller of that data, or a processor acting for your client who is the controller. We are your processor, or sub-processor. We process the data only on your documented instructions, which are these terms and your use of the service.

2. What we process

• Subject matter and purpose: detecting changes made by Google, spend outside its recent range and conversions dropping to zero in the connected accounts, and emailing you alerts.
• Data: the change history of each account, which can name the people who made a change (their email address), and daily spend and conversion totals.
• Data subjects: users of the connected Google Ads accounts — your clients’ staff and agencies.
• Duration: while the account is connected, and up to 30 days after it is removed.

3. Our obligations

• We process the data only to provide the service, and tell you if an instruction appears to break the law.
• People who process the data are bound by confidentiality.
• We keep appropriate technical and organisational measures: read-only access through a Read only user ([email protected]) that the account owner adds and can remove, with no passwords of connected accounts held by us; encryption in transit and at rest; access to the data limited to what the service needs.
• We help you answer requests from data subjects and meet your obligations on security, breach notification and impact assessments, as far as the service allows.
• We tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting the data.
• When an account is removed, or the agreement ends, we delete its data within 30 days, unless the law requires us to keep it.
• We make available the information needed to show compliance with this agreement, and allow reasonable audits on 30 days’ notice, at your cost.

4. Sub-processors

You authorise the sub-processors listed in the privacy policy (hosting, database and email providers). We impose on them obligations equivalent to these, remain responsible for them, and tell you by email before adding or replacing one, so that you can object.

5. Transfers

Where data is transferred outside the European Economic Area, the transfer relies on an adequacy decision or on the European Commission’s standard contractual clauses.

6. Liability and law

The limits of liability in the Terms of Service apply to this agreement. It is governed by the law of Portugal. Contact for data protection matters: [email protected], Avenida Sacadura Cabral, Nº 18, 1º D, 1000-274 Lisboa, Portugal.