Data Processing Agreement
Effective 19 August 2026
This Data Processing Agreement ("DPA") is entered into between Viralitea Ltd. ("Processor") and the customer entity that has agreed to the Viralitea Terms of Service ("Controller"), collectively the "Parties".
This DPA forms part of and is incorporated by reference into the Terms of Service. It sets out the terms on which the Processor will process personal data on behalf of the Controller, as required by GDPR Article 28.
1. Definitions
- "Personal Data": any information relating to an identified or identifiable natural person processed under this DPA.
- "Processing": any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
- "Data Subject": the natural person whose Personal Data is processed.
- "Sub-processor": any third party engaged by the Processor to process Personal Data on behalf of the Controller.
2. Scope and purpose
The Processor shall process Personal Data only on the documented instructions of the Controller, including for the purposes set out in Annex A, and in accordance with applicable data protection law.
3. Processor obligations
The Processor agrees to:
- Process Personal Data only on the Controller's documented instructions, unless required by law to act otherwise (in which case the Processor shall inform the Controller before processing, unless prohibited by law).
- Ensure that authorised personnel are subject to appropriate confidentiality obligations.
- Implement and maintain appropriate technical and organisational security measures as described in Annex B.
- Assist the Controller in responding to Data Subject requests (access, rectification, erasure, portability) within reasonable timescales.
- Assist the Controller with data protection impact assessments (DPIAs) and consultations with supervisory authorities where required.
- Notify the Controller without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach.
- Delete or return all Personal Data upon termination of the Terms of Service, and certify deletion in writing upon request.
- Make available to the Controller all information necessary to demonstrate compliance with this DPA.
4. Sub-processors
The Controller grants the Processor general authorisation to engage sub-processors. The current list of sub-processors is available at viralitea.com/privacy. The Processor shall notify the Controller of any intended changes to sub-processors at least 14 days in advance, giving the Controller the opportunity to object on reasonable grounds.
The Processor shall impose the same data protection obligations on sub-processors by contract and shall remain liable for sub-processor acts and omissions.
5. International transfers
Where Personal Data is transferred to a third country outside the EEA, the Processor shall ensure that the transfer complies with Chapter V of the GDPR, including by using Standard Contractual Clauses (SCCs) where required.
6. Controller obligations
The Controller shall ensure it has a lawful basis for providing Personal Data to the Processor and for all instructions it gives the Processor. The Controller is responsible for the accuracy of the Personal Data it provides.
7. Limitation of liability
The Parties' liability under this DPA is subject to the limitations set out in the Terms of Service, except to the extent required otherwise by applicable law.
8. Governing law
This DPA is governed by English law and subject to the jurisdiction of the courts of England and Wales.
Annex A: Processing details
| Item | Details |
|---|---|
| Subject matter | AI-powered performance marketing platform |
| Duration | For the duration of the Terms of Service |
| Nature of processing | Storage, analysis, display, and automated decision-making on ad performance data |
| Categories of data subjects | Controller's employees, contractors, and end users of connected ad accounts |
| Categories of personal data | Name, email, hashed password, OAuth tokens, campaign performance metrics |
Annex B: Security measures
- Encryption at rest: all databases encrypted with AES-256. OAuth tokens additionally encrypted at the application layer (Fernet).
- Encryption in transit: TLS 1.2+ enforced for all network communications.
- Access control: least-privilege, role-based access control; production access requires MFA.
- Audit logging: all data access and mutations are logged with actor, timestamp, and action.
- Vulnerability management: automated dependency scanning and regular penetration testing.
- Incident response: documented incident response plan with defined SLAs and breach notification procedures.
Contact
DPA enquiries: privacy@viralitea.com.