Data processing addendum

1. Roles and scope

This addendum forms part of the Service terms. The Client is the controller and THEFOCUS LTD is the processor for personal data processed inside the client workspace, in the Client's advertising accounts, tag managers and analytics, and in CRM exports given to us ("Client Personal Data"). Annex 1 describes the processing. Where the Client is itself a processor for another controller, we act as its sub-processor on the same terms.

This addendum meets Article 28 of the UK GDPR and, where they apply, Article 28 of the EU GDPR and the processor provisions of other data protection laws in the markets we serve.

2. Our obligations as processor

• Process Client Personal Data only on the Client's documented instructions, including the contract and the Client's use of the application, unless the law requires otherwise. In that case we inform the Client before processing unless the law prohibits it. We tell the Client if we believe an instruction breaks data protection law.
• Ensure that everyone authorised to process it is bound by confidentiality.
• Apply the technical and organisational measures in Annex 2.
• Use subprocessors only as set out in section 3.
• Assist the Client, taking into account the nature of processing, with data subject requests and with its obligations on security, breach notification, impact assessments and prior consultation with regulators.
• Notify the Client without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data, with the information the Client needs to meet its own reporting duties.
• At the end of the services, delete or return Client Personal Data at the Client's choice within 30 days and delete existing copies, unless the law requires us to keep them.
• Make available the information needed to demonstrate compliance and allow audits by the Client or an auditor it appoints, on 30 days' notice, under confidentiality and no more than once a year unless a breach or a regulator requires it.

3. Subprocessors

The Client gives general authorisation to the subprocessors described on our Subprocessors page; the current named list is available in the client dashboard and on request. We give at least 30 days' notice of a new subprocessor through the application. The Client may object on reasonable data protection grounds; if we cannot resolve the objection, the Client may end the affected service without penalty. We impose data protection terms on each subprocessor that are no less protective than this addendum and remain responsible for its performance.

4. International transfers

We transfer Client Personal Data outside the UK only under UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the ICO International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Where the Client is in the EEA, transfers to us rely on the European Commission's adequacy decision for the United Kingdom; if that decision ceases to apply, the EU Standard Contractual Clauses (module two, or module three where the Client is a processor) are incorporated by reference, with Ireland as the governing law and forum for those clauses only. Where the Client is in Switzerland, the same clauses apply with the Swiss amendments. For other markets, we sign the transfer terms the Client's law requires, such as standard contracts under Türkiye's KVKK or China's PIPL, on request.

5. Special category data and sensitive targeting

The Client must not upload special category data (for example health data), criminal offence data or children's data to the application, and must not instruct targeting based on sensitive characteristics.

6. Liability and duration

Liability under this addendum is subject to the limits in the Service terms. This addendum lasts as long as we process Client Personal Data.

Annex 1: Description of processing

• Subject matter and duration: delivery of the services for the contract term and the 30-day exit period.
• Nature and purpose: campaign planning and operation, real-time optimisation signals to the Client's campaigns, measurement and tracking configuration, reporting and support.
• Data subjects: the Client's staff users, and its prospects and customers as represented in advertising, analytics and CRM data.
• Data categories: names and business contact details of Client users; online identifiers, hashed contact data used for platform conversion matching, aggregated campaign metrics and CRM lead stages.
• Retention: as set out in the Privacy notice and section 2.

Annex 2: Technical and organisational measures

• Mandatory multi-factor authentication for all accounts, with single-use recovery codes stored only as hashes.
• Role-based, least-privilege access for staff, reviewed when roles change.
• Isolation between client workspaces enforced in the application and at the database layer.
• Encryption in transit with current TLS and encryption at rest for databases, files and backups.
• Distributed, encrypted service delivery across more than 125 countries.
• Append-only audit logs for security-relevant actions.
• No storage of advertising-account passwords; access only through platform user or partner permissions.
• Signed and replay-protected webhooks and data ingestion.
• Automated secret scanning and tests before every release.
• Incident response procedure with defined escalation and client notification.