Data Processing Addendum

Last Updated: October 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between AdPeak Ltd (“AdPeak,” “we,” “us”), a company registered at Companies House under company number 17261264 with its registered office at M-SPARC, Menai Science Park, Gaerwen, Gwynedd, LL60 6AG, United Kingdom, and the customer (“Customer,” “you”). It applies where AdPeak processes Personal Data on your behalf in connection with the Services. In the event of a conflict between this DPA and the Terms of Service in respect of data protection, this DPA prevails.

1. Definitions

  • “Data Protection Law” means all laws applicable to the processing of Personal Data under this DPA, including the UK GDPR and the Data Protection Act 2018, the EU General Data Protection Regulation (Regulation (EU) 2016/679), and, where applicable, the California Consumer Privacy Act (CCPA/CPRA).
  • “Personal Data,” “Controller,” “Processor,” “Data Subject,” “Processing,” and “Personal Data Breach” have the meanings given in the UK/EU GDPR.
  • “Customer Personal Data” means Personal Data that AdPeak processes on your behalf in providing the Services.
  • “Sub-Processor” means any processor engaged by AdPeak to process Customer Personal Data.
  • “SCCs” means the European Commission’s Standard Contractual Clauses (Decision 2021/914). “UK Addendum” means the UK Information Commissioner’s International Data Transfer Addendum to the SCCs.

Capitalised terms not defined here have the meaning given in the Terms of Service.

2. Roles of the Parties

The parties acknowledge that, in respect of Customer Personal Data:

  • You are the Controller (or, where you act on behalf of your own clients, a Processor acting on their behalf), and AdPeak is the Processor (or sub-processor).
  • AdPeak is an independent Controller for the limited Personal Data it processes for its own business purposes — such as account administration, billing, security, and website analytics — which is governed by the Privacy Policy rather than this DPA.

Where you act as a Processor on behalf of a third-party controller (for example, an agency acting for its advertiser clients), you warrant that you have the authority and instructions of that controller to engage AdPeak as a sub-processor on the terms of this DPA.

3. Scope and Details of Processing

  • Subject matter: Provision of the Services described in the Terms of Service.
  • Duration: For the term of the Terms of Service and until deletion of Customer Personal Data in accordance with Section 10.
  • Nature and purpose: Reading and analysing connected-account data (such as Google Ads, Google Merchant Center, Meta Ads, Shopify, Google Analytics, Google Search Console, Google Tag Manager, website analytics, e-commerce, and Stripe data) and data you provide (such as files and Google Sheets) to generate reports, insights, and product-labelling outputs; storing that data where a feature needs it, including in a data warehouse and, for custom product-labelling strategies, a data workspace in which agent-written queries run; powering the AI assistant, agents, scheduled tasks, and MCP tools, and delivering their results to the destinations you choose; storing memory files that people, the assistant, and agents create for businesses, agents, and individual users; where you enable plan-and-apply, applying approved changes to your Google Ads account; hosting, storage, logging, and support.
  • Types of Personal Data: Account identifiers and contact details of your personnel; authentication credentials, OAuth tokens, and API keys; names, email addresses, or identifiers of your personnel that appear in connected-account data (for example, in account change histories); order-level data from e-commerce platforms, from which customer-identifying fields (such as names, email addresses, phone numbers, and postal addresses) are excluded; and any Personal Data contained in conversation content, memory files, files, or other data you choose to make available to the Services. In the ordinary course, connected-account data comprises product, advertising-performance, and sales data and does not identify end-consumers.
  • Categories of Data Subjects: Your authorised users and personnel; your customers, to the extent order-level data relates to their purchases; people who interact with AdPeak in your connected Slack workspace; and any individuals whose Personal Data you choose to include in data you make available to the Services.

4. AdPeak’s Obligations

AdPeak shall:

  1. Process on documented instructions. Process Customer Personal Data only on your documented instructions (including as set out in this DPA and the Terms of Service), unless required to do otherwise by law, in which case AdPeak will inform you unless legally prohibited.
  2. Purpose limitation. Not process Customer Personal Data for any purpose other than providing the Services (including supporting, maintaining, and improving them, which may involve authorised AdPeak personnel reviewing conversation content as described in the Privacy Policy), except that AdPeak may create and use anonymised and aggregated data that does not identify you or any Data Subject.
  3. No sale. Not sell or share Customer Personal Data, and not retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Services, within the meaning of the CCPA/CPRA.
  4. Confidentiality. Ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations.
  5. Security. Implement and maintain the technical and organisational measures described in Section 7.
  6. Assist you by appropriate technical and organisational measures, insofar as possible, in responding to Data Subject requests (Section 8) and in meeting your obligations regarding security, breach notification, data protection impact assessments, and prior consultation (Articles 32–36 GDPR).
  7. Notify you if, in its opinion, an instruction infringes Data Protection Law.
  8. Make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits (Section 9).

5. Customer’s Obligations

You shall:

  1. Comply with your obligations as a Controller under Data Protection Law.
  2. Ensure you have a valid lawful basis and all necessary rights, consents, and notices to make Customer Personal Data available to AdPeak and its Sub-Processors for the purposes of the Services.
  3. Ensure your instructions for processing are lawful.
  4. Be responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which you acquired it.
  5. Where you act for your own clients, ensure you are authorised to appoint AdPeak as a sub-processor and to bind those clients to terms consistent with this DPA.

6. Sub-Processors

  1. You provide general authorisation for AdPeak to engage Sub-Processors to process Customer Personal Data. Our current Sub-Processors are listed at /sub-processors.
  2. AdPeak will impose data-protection obligations on each Sub-Processor that are no less protective than those in this DPA, and remains liable for its Sub-Processors’ performance of those obligations.
  3. AdPeak will give at least 30 days’ prior notice of any intended addition or replacement of a Sub-Processor (via the Sub-Processor page and/or email). You may object on reasonable data-protection grounds within that period; if the objection cannot be resolved to the parties’ mutual reasonable satisfaction, you may terminate the affected Services as your sole remedy.

7. Security — Technical and Organisational Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, AdPeak maintains appropriate technical and organisational measures, including:

  • Encryption of Personal Data in transit (TLS) and at rest.
  • Access control on a least-privilege basis, with authentication and role-based authorisation; third-party credentials (such as OAuth tokens and API keys) are encrypted using keys managed in Google Cloud Key Management Service and permanently deleted when the account or organisation is purged.
  • Network and infrastructure security, with all platform data hosted on Google Cloud Platform in hardened, access-controlled environments.
  • Least-privilege access to connected platforms, using read-only access except where you approve a plan under the plan-and-apply feature, and technical controls that limit the data requested from them.
  • Logging and audit trails of actions taken within the Services.
  • Resilience and recovery measures consistent with the hosting provider’s capabilities.
  • Segregation of customer data at the application level, with each conversation, connection, and resource tied to a single organisation, and agent-written queries checked so that they can only read the customer’s own data workspace.
  • Secure development and change management practices, including code review and automated testing.
  • Personnel subject to confidentiality obligations and security awareness.

AdPeak may update these measures from time to time provided the level of protection is not materially reduced.

8. Data Subject Requests

AdPeak will, taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights under Data Protection Law. If AdPeak receives a request directly from a Data Subject relating to Customer Personal Data, it will, unless legally prohibited, promptly inform you and not respond to the request except on your documented instructions or as required by law.

9. Audit

AdPeak will make available to you information reasonably necessary to demonstrate compliance with this DPA. Where you reasonably require further information, you may request an audit no more than once per year (or following a Personal Data Breach affecting your data), on reasonable prior written notice, during business hours, subject to confidentiality, and conducted so as to minimise disruption. AdPeak may satisfy audit requests by providing relevant certifications, third-party reports, or written responses where these reasonably address the request.

10. Return and Deletion of Data

On termination or expiry of the Services, or on your written request, AdPeak will delete Customer Personal Data in accordance with the retention and deletion process described in the Privacy Policy — comprising an immediate soft delete followed by permanent deletion of Customer Personal Data from AdPeak’s application database and data warehouse after a 30-day grace period, with database backups expiring shortly afterwards — except to the extent AdPeak is required by law to retain a copy, or retains anonymised or aggregated data that no longer identifies any Data Subject, or retains limited deletion records as proof of compliance.

11. Personal Data Breach

AdPeak will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to it to assist you in meeting your breach-notification obligations, including the nature of the breach, likely consequences, and measures taken or proposed. Such notification is not an acknowledgement of fault or liability.

12. International Transfers

AdPeak hosts Customer Personal Data on Google Cloud Platform, with its application database and servers in the United Kingdom and its data warehouse and file storage in the European Union, and may transfer it to, or access it from, other countries — including the United States — in connection with the Services (for example, AI inference and Sub-Processors).

Where a transfer of Customer Personal Data is made from the UK, EEA, or Switzerland to a country not covered by an adequacy decision, AdPeak ensures an appropriate safeguard under Data Protection Law applies, which may include:

  • The SCCs (for EEA transfers), which are incorporated into this DPA by reference and completed as follows: Module Two (Controller-to-Processor) or Module Three (Processor-to-Processor) applies as appropriate; the docking clause applies; the parties’ details, the description of processing (Section 3), and the Sub-Processor list serve as the Annexes; and the governing law and forum are those of the Terms of Service to the extent permitted;
  • The UK Addendum to the SCCs (for UK transfers); and/or
  • Reliance on an applicable adequacy decision or data-transfer framework (such as the UK–US Data Bridge or EU–US Data Privacy Framework) where the recipient is certified.

AI inference transfers. AI inference is routed to a primary provider (Google Cloud Vertex AI) and, where the primary provider is unavailable or at capacity and for some specific tasks, to a fallback (OpenRouter) that passes requests to upstream model providers. AI inference by either may take place outside the UK and EU, including in the United States. These transfers are covered by the safeguards above, and under the applicable providers’ terms and our configured account settings the data is not used to train models.

13. Liability

Each party’s liability under this DPA is subject to the exclusions and the aggregate limitation of liability set out in the Terms of Service, except to the extent those limitations are not permitted by Data Protection Law.

14. General

This DPA is governed by the laws of England and Wales and subject to the jurisdiction provisions of the Terms of Service. If any provision is held invalid, the remainder continues in effect. Except as amended by this DPA, the Terms of Service remain in full force.

15. Contact

Data-protection enquiries and requests under this DPA should be sent to privacy@adpeak.ai.