Data Processing Agreement

Draft, pending legal review. This text is a first draft and is not yet in force as reviewed legal advice.

1. Parties, scope, and roles

This Data Processing Agreement (the "DPA") is between Adjira, a sole proprietorship trading as Adjira (26H, H Block, Punjab Small Industries Society, Lahore, Pakistan, 54000), called "Adjira", and the customer that accepted the Terms of Service, called the "Customer". It forms part of those terms.

It applies to personal data that Adjira processes for the Customer when the Customer uses the Adjira service, to the extent the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, or another data protection law applies ("Data Protection Law").

For this personal data the Customer is the controller (or a processor acting for its own client) and Adjira is the processor (or sub-processor). Adjira is the controller of its own account, billing, support, and marketing site data, which the Privacy Notice covers and this DPA does not.

2. Definitions

Terms such as "controller", "processor", "personal data", "processing", "data subject", and "personal data breach" have the meaning given in Data Protection Law. "Customer Personal Data" means the personal data Adjira processes for the Customer under this DPA. "Subprocessor" means a third party Adjira engages to process Customer Personal Data. "Restricted Transfer" means a transfer of Customer Personal Data to a country without an adequacy decision under Data Protection Law.

3. Subject matter, nature, purpose, and duration

Adjira provides website aware ad traffic intelligence: it collects visit data from the Customer's websites through the Adjira tracker, scores it for invalid or low quality traffic, and, only as the Customer configures and confirms, helps the Customer exclude that traffic in its ad accounts. The processing lasts for the term of the Customer's subscription and then until deletion under section 12. Annex I describes the processing in detail.

4. Customer instructions

Adjira processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's configuration and use of the service (including settings, rules, and API calls) are those instructions. Adjira tells the Customer if it believes an instruction breaks Data Protection Law, and may pause that part of the processing until the Customer confirms or changes it. Adjira does not process Customer Personal Data for its own purposes, does not sell it, and does not combine it with data from other customers. If a law Adjira is subject to requires other processing, Adjira tells the Customer first unless the law forbids it.

5. Customer responsibilities

The Customer decides the purposes and legal basis of its tracking. It gives visitors the notices they are owed, obtains any consent required, and honours withdrawal, including where consent is needed before the tracker stores or reads anything on a visitor's device. The tracker consent guide explains how to connect a consent tool. The Customer does not use the service to track sensitive pages such as health or payment forms, and does not send special category data to Adjira.

6. Confidentiality and personnel

Everyone at Adjira who can access Customer Personal Data is bound by a duty of confidentiality, receives access only as needed for their role, and is trained on data protection. Access to Customer Personal Data is limited by role and logged.

7. Security

Adjira applies the technical and organisational measures in Annex II and keeps them appropriate to the risk. It may update them if the protection does not become weaker.

8. Personal data breaches

Adjira tells the Customer without undue delay after it becomes aware of a personal data breach affecting Customer Personal Data. The notice describes what is known: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. Adjira keeps the Customer updated as more is learned, takes reasonable steps to contain and fix the breach, and helps the Customer meet its duties to notify authorities and data subjects. The notice is not an admission of fault.

9. Assistance

Taking into account the nature of the processing, Adjira helps the Customer, by suitable technical and organisational measures, to answer data subject requests for access, correction, deletion, restriction, portability, and objection. The service lets the Customer find and delete one session or one visitor (by visitor id or IP address), export a visitor's data, export a whole workspace, and delete a website, a workspace, or an organization. If a data subject contacts Adjira directly about Customer Personal Data, Adjira passes the request to the Customer and does not answer it on its own unless the law requires. Adjira also gives reasonable help with data protection impact assessments, prior consultations with supervisory authorities, and the Customer's records of processing, and keeps its own records of processing carried out for customers.

10. Subprocessors

The Customer gives Adjira general written authorisation to use the Subprocessors in Annex III. Adjira binds each Subprocessor to data protection duties no less protective than this DPA and stays responsible for their performance.

Adjira gives the Customer at least 30 days notice by email before adding or replacing a Subprocessor, and updates the subprocessor list. The Customer may object on reasonable data protection grounds within that period by writing to [email protected]. The parties then work in good faith to find a solution. If none is found, the Customer may end the affected part of the service and receive a refund of prepaid fees for the remaining period.

11. International transfers

Customer Personal Data is stored in the European Union (Frankfurt, Germany). Where Adjira or a Subprocessor makes a Restricted Transfer, it relies on an adequacy decision (including the EU-US Data Privacy Framework and the UK Extension to it where the recipient is certified) or on the clauses below. The mechanism for each Subprocessor is in Annex III.

EU Standard Contractual Clauses. For Restricted Transfers from the European Economic Area, the parties agree to the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, which are incorporated by reference and completed as follows. Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. Clause 7 (docking clause) applies. In Clause 9(a) option 2 applies, with the notice period in section 10. In Clause 11 the optional independent dispute resolution body does not apply. In Clause 17 option 2 applies: the clauses are governed by the law of the EU member state where the Customer is established, or, where that law does not allow third party beneficiary rights or the Customer is not established in the EU, the law of Ireland, and under Clause 18 disputes go to the courts of that state. Annex I.A lists the parties, Annex I.B is Annex I of this DPA, Annex I.C names the supervisory authority of the Customer's establishment, and Annex II of the clauses is Annex II of this DPA.

UK addendum. For Restricted Transfers from the United Kingdom, the parties agree to the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), incorporated by reference. Its tables are completed with the details in this DPA and its annexes, and either party may end the addendum as its section 19 allows. The law of England and Wales governs it.

Switzerland. For Restricted Transfers subject to the Swiss Federal Act on Data Protection, the EU clauses apply with these changes: references to the GDPR mean the Swiss Act, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, Swiss law governs, Swiss courts have jurisdiction, and the term "member state" does not exclude data subjects in Switzerland from suing for their rights there.

Additional safeguards. Adjira assesses the law of the destination before a Restricted Transfer, uses encryption in transit and at rest, and stores IP addresses only in encrypted form. If a public authority asks for Customer Personal Data, Adjira tells the Customer unless the law forbids it, reviews whether the request is lawful and challenges it where there are grounds, and discloses only the minimum permitted.

12. Return and deletion

The Customer can export its data and delete it at any time using the service. Retention follows Annex I: for example session data is deleted automatically after the shorter of the workspace's setting and the plan's maximum, and the encrypted form of each IP address after 30 days. When a workspace or organization is deleted it waits seven days so the deletion can be undone, then its data is removed. A workspace with no active or trialing subscription for 90 days is deleted, after reminders. At the end of the service, or on the Customer's written request, Adjira deletes Customer Personal Data and, if asked before deletion, makes an export available. Copies in backups are overwritten within the backup retention period in Annex II, and deleted subjects are recorded in an erasure ledger so restored backups do not bring them back into use. Adjira keeps data only where the law requires it and then protects it under this DPA.

13. Audits and information

Adjira makes available the information needed to show it follows this DPA and Article 28 GDPR, including answers to reasonable security questionnaires. Where that is not enough, or a supervisory authority requires it, the Customer (or an independent auditor bound by confidentiality) may audit Adjira once a year, or after a personal data breach, on 30 days written notice, during business hours, without harming other customers, and at the Customer's cost. Adjira may meet an audit request by giving a recent independent report or certification where one exists. The audit never reaches other customers' data.

14. Liability

Each party's liability under this DPA is subject to the limits and exclusions in the Terms, and the limits there apply in total to the Terms and this DPA together. Nothing limits liability that cannot be limited by law, or a data subject's rights under the standard contractual clauses.

15. Term, changes, and order of precedence

This DPA starts when the Customer accepts the Terms and lasts as long as Adjira processes Customer Personal Data. Adjira announces a material change at least 30 days ahead and asks the Customer to accept it again. If a law or regulator requires a change, the parties will agree to it in good faith. If this DPA conflicts with the Terms about personal data, this DPA prevails. If it conflicts with the standard contractual clauses or the UK addendum, those prevail for the transfers they cover.

16. Governing law and contact

Unless section 11 says otherwise, the governing law and courts are those of the Terms: the laws of Pakistan and the courts of Lahore, Pakistan. Questions and requests under this DPA go to [email protected]. Data protection officer: [TO BE PROVIDED: data protection officer name and contact, or a statement that none is appointed].

Annex I. Description of the processing

Parties. Data exporter: the Customer, as identified in its Adjira account. Data importer: Adjira, 26H, H Block, Punjab Small Industries Society, Lahore, Pakistan, 54000. Contact: [email protected].

Data subjects. Visitors to the Customer's websites and landing pages; people who click the Customer's ads; and the Customer's own users of Adjira (workspace members and invited people), whose account data Adjira processes as controller except where it appears inside a customer workspace.

Categories of personal data.

No special category data is intended to be processed.

Frequency and nature. Continuous while the tracker runs. Operations: collection, storage, enrichment with IP intelligence databases read on Adjira's own servers, scoring, aggregation, display to the Customer, export, and deletion.

Purpose. To detect invalid, automated, and low quality ad traffic, report on traffic quality and campaign performance, and, when the Customer confirms, prepare exclusions in the Customer's ad accounts.

Retention.

Transfers. Only to the Subprocessors in Annex III, for the purposes stated there.

Annex II. Technical and organisational measures

Annex III. Authorised Subprocessors

The Customer authorises these Subprocessors. The current list, with change notices, is on the subprocessor page.

IP lookups. Location, network, VPN, datacenter, and Tor checks run on Adjira's own servers against locally stored databases (DB-IP Lite and public lists). No visitor IP address is sent to the providers of those databases, so they are not subprocessors.

Ad platforms. When a customer connects a Google, Meta, Microsoft, or TikTok ads account, Adjira exchanges data with that platform on the customer's instruction and with the customer's own account and agreement. These platforms act for the customer, not for Adjira, so they are not listed above.

Adjira will add error monitoring and metrics providers here, with the notice period in the DPA, before enabling them.