When AdGranted handles personal data for you.

This Data Processing Agreement (DPA) forms part of the Master Service Agreement (MSA) between Conflorens d.o.o., operating the AdGranted brand (Processor or Conflorens), and the Client identified in the applicable Order Form (Controller or Client) where Conflorens processes Personal Data on the Client’s behalf.

The Client accepts this DPA together with the MSA and the Order Form, through the same acceptance on the AdGranted offer page (MSA section 2). No separate signature is required.

1. Definitions

Applicable Data Protection Law means the GDPR and any other data-protection law applicable to the relevant Processing.

Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach, and Supervisory Authority have the meanings given in Applicable Data Protection Law.

Client Personal Data means Personal Data processed by Conflorens on behalf of the Client under an applicable Order Form.

Subprocessor means another processor engaged by Conflorens to process Client Personal Data on behalf of the Client.

2. Scope and documented instructions

2.1 Conflorens will process Client Personal Data only on documented instructions from the Client, including the MSA, applicable Order Form, this DPA, and lawful documented service instructions, unless Union or Member State law requires other Processing.

2.2 Where law requires Processing outside the Client’s documented instructions, Conflorens will inform the Client of that legal requirement before Processing unless the law prohibits that information on important grounds of public interest.

2.3 Conflorens will immediately inform the Client if, in Conflorens’ opinion, a Client instruction infringes the GDPR or another applicable Union or Member State data-protection provision. Conflorens may suspend the affected Processing to the extent reasonably necessary to avoid carrying out an instruction it considers unlawful while the parties address the issue.

2.4 If the Client insists on an instruction after receiving notice under section 2.3 and Conflorens reasonably concludes that performing the instruction would breach Applicable Data Protection Law, Conflorens may refuse the instruction and, where the issue prevents lawful continuation, suspend or terminate the affected processor service without limiting any mandatory rights of either party.

2.5 The subject matter, nature, purpose, duration, categories of Personal Data, and categories of Data Subjects are described in Schedule 1.

3. Personnel and confidentiality

3.1 Conflorens will ensure that persons authorized to process Client Personal Data are subject to appropriate confidentiality obligations or an applicable statutory duty of confidentiality.

3.2 Access to Client Personal Data will be limited to persons and systems that reasonably require access for the authorized Processing.

4. Security

4.1 Conflorens will implement and maintain appropriate technical and organizational measures designed to provide a level of security appropriate to the risk, taking account of the state of the art, implementation costs, nature, scope, context and purposes of Processing, and the risk to Data Subjects.

4.2 The baseline categories of measures are described in Schedule 2. Specific controls may evolve over time provided the overall level of protection is not materially reduced without a lawful reason.

4.3 Nothing in this DPA constitutes a guarantee that a security incident can never occur.

5. Subprocessors

5.1 The Client gives Conflorens general written authorization to engage the Subprocessors identified in the current AdGranted Client Subprocessor Register for the processor activities covered by this DPA.

5.2 Conflorens will impose data-protection obligations on each Subprocessor that are no less protective, in substance, than the obligations applicable to the relevant Processing under this DPA, as required by Article 28 GDPR.

5.3 Conflorens remains responsible to the Client for the performance of its Subprocessors’ processor obligations to the extent required by Applicable Data Protection Law.

5.4 Conflorens will notify the Client of an intended addition or replacement of a Subprocessor at least 30 calendar days in advance where reasonably practicable. Notice may be provided by email to the Client’s contractual/privacy contact or through another durable written notice mechanism identified by Conflorens.

5.5 Where 30 days’ advance notice is not reasonably practicable because an urgent change is necessary for security, legal compliance, service continuity, or the unexpected unavailability of an existing provider, Conflorens may make the change sooner and will notify the Client without undue delay with an explanation of the reason for shorter notice.

5.6 The Client may object to a new or replacement Subprocessor on reasonable documented data-protection grounds. For a standard 30-day notice, the Client should submit any objection within 15 calendar days after receiving notice. For an urgent change, the Client should object as soon as reasonably practicable after notice.

5.7 The parties will work in good faith to address a valid objection, including considering a commercially and technically reasonable alternative where available. If no reasonable alternative exists and the objection cannot be resolved, Conflorens may discontinue the affected Processing or either party may terminate only the affected processor service where lawful continuation is not reasonably possible. This section does not create a refund entitlement beyond the applicable MSA or Order Form.

6. International transfers

6.1 Conflorens will not transfer Client Personal Data to a third country or international organization except on documented Client instructions or using an applicable lawful transfer mechanism.

6.2 Where required, Conflorens or a Subprocessor may rely on an adequacy decision, an applicable Data Privacy Framework, Standard Contractual Clauses, another approved transfer mechanism, or another lawful safeguard.

6.3 Conflorens will make information about material transfer mechanisms reasonably available to the Client. Current material arrangements are maintained in the AdGranted International Transfer Register.

6.4 Where Standard Contractual Clauses or another mandatory transfer instrument applies and conflicts with this DPA, that transfer instrument controls for the conflicting transfer issue.

7. Data Subject requests

7.1 Taking into account the nature of the Processing, Conflorens will assist the Client by appropriate technical and organizational measures, insofar as reasonably possible, to enable the Client to respond to Data Subject requests under Applicable Data Protection Law.

7.2 If Conflorens receives a request relating to Client Personal Data for which the Client is Controller, Conflorens will not independently determine the request unless legally required. It will notify or forward the request to the Client without undue delay and follow lawful documented Client instructions.

8. Personal Data Breaches

8.1 Conflorens will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.

8.2 To the extent information is available, the notice will describe:

• the nature of the Personal Data Breach;
• the categories and approximate number of affected Data Subjects and records where reasonably available;
• likely consequences known at that stage;
• measures taken or proposed to contain, investigate, mitigate, or remediate the breach; and
• a contact point for follow-up.

8.3 Information may be supplied in phases where all details are not immediately available.

8.4 Conflorens will provide reasonable assistance to the Client with the Client’s breach-notification and communication obligations, taking into account the nature of Processing and information available to Conflorens.

8.5 A notification under this section is not an admission of fault or liability.

9. Assistance with compliance

Taking into account the nature of Processing and information available to it, Conflorens will provide reasonable assistance to the Client concerning:

• security obligations under Article 32 GDPR;
• Personal Data Breach obligations under Articles 33 and 34 GDPR;
• Data Protection Impact Assessments under Article 35 GDPR where relevant to the Processor service;
• prior consultation under Article 36 GDPR where legally required; and
• information reasonably necessary to demonstrate compliance with Article 28 GDPR.

10. Compliance information and audits

10.1 Conflorens will make available to the Client information reasonably necessary to demonstrate compliance with the processor obligations in Article 28 GDPR and this DPA.

10.2 The Client or an independent auditor mandated by the Client may conduct an audit or inspection reasonably necessary to verify such compliance.

10.3 Except where a shorter period is justified by a Personal Data Breach, material compliance concern, Supervisory Authority requirement, or other urgent legal reason, the Client should provide at least 15 business days’ written notice of an audit.

10.4 Audits should, where reasonably possible:

• occur during normal business hours;
• be limited to systems, records, Processing, and controls relevant to Client Personal Data;
• use an auditor subject to appropriate confidentiality obligations and not reasonably presenting a competitive or security conflict;
• avoid unnecessary disruption; and
• protect other clients’ confidential information and Personal Data.

10.5 Conflorens may first satisfy an audit request through current independent assurance reports, security documentation, written responses, or remote evidence where those materials reasonably address the requested control. This does not remove the Client’s right to an audit where further verification is reasonably necessary.

10.6 Each party bears its own internal costs of an ordinary audit. Conflorens may charge reasonable documented external or extraordinary costs for repetitive or unnecessarily burdensome audits requested more than once in a 12-month period, except where the additional audit is reasonably required by a breach, material non-compliance, a Supervisory Authority, or a material change in Processing. No cost arrangement will be used to prevent an audit right required by Applicable Data Protection Law.

11. Return and deletion

11.1 At the end of the affected processor service, at the Client’s choice, Conflorens will either:

• return the relevant Client Personal Data and then delete remaining copies; or
• delete the relevant Client Personal Data,

unless Union or Member State law requires continued storage.

11.2 The Client should communicate its return/delete choice before the processor service ends or promptly after Conflorens requests the instruction. If the Client does not provide a choice after a written request and reasonable follow-up, Conflorens may give at least 30 calendar days’ written notice of its intention to delete the relevant Client Personal Data under the applicable retention/deletion process.

11.3 Until return or deletion is completed, Conflorens will continue to protect the retained Client Personal Data under this DPA and limit Processing to lawful closure, security, return/deletion, or mandatory retention purposes.

11.4 For AdGranted-controlled dashboard Personal Data after hosting finally ends:

• new ingestion stops where appropriate;
• obsolete access and source credentials are revoked;
• relevant AdGranted-controlled person-level data is deleted or irreversibly de-identified within 30 calendar days unless limited retention is lawfully required or justified; and
• residual backups are targeted to expire within 90 calendar days.

11.5 Conflorens may retain minimized contractual, billing, security, incident, or legal records in its independent-controller capacity where required or lawfully justified. Those records are not retained for further Client-instructed service Processing.

12. Processing outside Processor role

Nothing in this DPA prevents Conflorens from processing Personal Data as an independent Controller where Conflorens has a separate lawful purpose, such as contract administration, billing, fraud/security management, legal compliance, defense of legal claims, or its own business records. Such Processing is governed by Applicable Data Protection Law and the AdGranted Privacy Policy rather than the Client’s processor instructions.

13. Order of precedence

For conflicts specifically concerning Processing of Client Personal Data by Conflorens as Processor, this DPA takes precedence over the MSA and applicable Order Form unless Applicable Data Protection Law or a mandatory transfer instrument requires otherwise.

14. Governing law

This DPA follows the governing-law and jurisdiction provisions of the MSA, subject to mandatory requirements of Applicable Data Protection Law or applicable Standard Contractual Clauses.

15. Liability

The liability provisions and agreed liability cap in the MSA apply to claims between the Client and Conflorens arising from this DPA to the extent permitted by Applicable Data Protection Law. Nothing in the MSA or this DPA limits rights or remedies of Data Subjects, Supervisory Authorities, or other third parties that cannot lawfully be limited by contract, and any mandatory liability rule or applicable Standard Contractual Clause prevails to the extent of conflict.

Schedule 1: Processing details

A. Subject matter

Provision of accepted AdGranted processor services, including applicable Client reporting/dashboard hosting, approved reporting integrations, approved automation, technical support, and other expressly accepted Processing performed on the Client’s behalf.

B. Duration

For the duration of the applicable processor service plus the limited closure, return/deletion, backup-expiry, audit, and legally required retention periods described in this DPA and the applicable service terms.

C. Nature and purpose

Collection, receipt, access, hosting, organization, transmission, transformation, display, support, troubleshooting, security, return, deletion, and other Processing reasonably required to provide the accepted processor service on documented Client instructions.

D. Categories of Data Subjects

Depending on the accepted integration or service:

• Client personnel and authorized users;
• website visitors;
• donors;
• volunteers;
• applicants;
• event registrants;
• service users; and
• leads or contacts in an approved Client-controlled reporting source.

E. Categories of Personal Data

Depending on the accepted service:

• names and business contact details;
• platform/user identifiers;
• website and analytics identifiers;
• event/conversion information;
• campaign/reporting data linked to an individual where an accepted source exposes such data;
• technical metadata, IP/device/security information;
• account and authorization metadata; and
• other Personal Data expressly included in an accepted integration.

F. Special categories

Special-category or similarly highly sensitive person-level data is not intentionally included in the standard service. If an accepted integration would introduce such data, the Processing must be separately assessed and expressly approved before activation.

Schedule 2: Baseline technical and organizational measure categories

Conflorens maintains technical and organizational measures appropriate to the relevant risk, which may include:

• least-privilege and role-appropriate access controls;
• restriction and review of privileged access;
• individual or otherwise attributable access where reasonably available;
• secure credential storage and handling;
• protection of passwords, API keys, tokens, and service secrets from ordinary documents, public code, and unauthorized disclosure;
• encryption in transit using appropriate secure transport protocols;
• authenticated access to non-public client systems;
• server-side authorization and tenant/client separation for multi-client dashboard environments;
• access revocation and offboarding controls;
• logging and monitoring reasonably appropriate to the system and risk;
• incident identification, containment, escalation, investigation, and documentation procedures;
• data minimization and purpose limitation in integrations and reporting;
• backup, restoration, and continuity measures where appropriate to the relevant service;
• processor/subprocessor due diligence and contractual controls;
• vulnerability, patching, and configuration-management practices appropriate to the relevant infrastructure; and
• periodic review and improvement of security controls in light of changes to risk, technology, and service architecture.