Data processing addendum

This addendum applies where KPI Atlas processes personal data on behalf of the customer. The customer is the controller; KPI Atlas is the processor. Where the customer processes its own clients' data, the customer may itself be a processor and this addendum operates on a sub-processing basis.

Subject matter: retrieval, storage, transformation and delivery of marketing performance data for reporting purposes. Duration: for as long as the customer maintains an account, plus the 30-day export window.

Data subjects: the customer's personnel, the customer's clients' personnel who receive or access reports, and end users represented within aggregate marketing metrics.

Categories: names, business contact details, authentication identifiers, and aggregate marketing performance data. No special category data is required by the service and it should not be uploaded through manual imports.

KPI Atlas processes personal data only on the customer's documented instructions, which include the configuration set in the product, unless required otherwise by law. We will inform the customer where we believe an instruction infringes applicable data protection law.

Personnel with access to personal data are bound by confidentiality obligations and receive data protection training. Access is granted on a least-privilege basis and reviewed periodically.

Encryption in transit and at rest; network segregation; role-based access control with multi-factor authentication for administrative access; audit logging; vulnerability management; documented backup and restore procedures; and periodic review of these measures.

The customer gives general authorisation for the subprocessors listed in the current subprocessor list. We will give at least 30 days' notice before adding or replacing a subprocessor, and the customer may object on reasonable data protection grounds.

Each subprocessor is bound by data protection obligations no less protective than those in this addendum.

We assist the customer, taking into account the nature of processing, with data subject requests, data protection impact assessments and prior consultations, and provide the information reasonably required to demonstrate compliance.

We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information available at that time, and provide updates as the investigation progresses.

International transfers rely on Standard Contractual Clauses or an equivalent mechanism. The customer may audit compliance once per year on reasonable notice, or rely on an available third-party report.

On termination, and at the customer's choice, personal data is returned by export or deleted, with deletion completed from production systems within 30 days and from backups on the standard backup cycle.