Data Processing Agreement

Effective Date: January 24, 2025

This Data Processing Agreement (“DPA”) reflects the agreement between Agile Doyens, LLC (“adLLC,” “we,” “us,” or “our”) and the Customer or User accessing adLLC Products or utilizing adLLC Professional Services (collectively, the “Services”) and applies if and to the extent adLLC Processes Customer Personal Data on your behalf in connection with your access and use of the Services.

This DPA is made pursuant to our adLLC End User Agreement and/or our Customer Agreement (collectively referred to in this DPA as the “Agreement”). This DPA supplements and forms an integral part of the Agreement, and is effective as of your first use of the Services. All terms and conditions of the Agreement apply to this DPA unless clearly stated otherwise. Should a conflict arise between this DPA and the Agreement, this DPA controls.

1. Definitions

Capitalized terms not defined below have the meaning given to them in the Agreement.

“California Consumer Privacy Act” or “CCPA” means California Civil Code § 1798.100 et seq.

“California Personal Information” or “CA Personal Information” means Customer Personal Data that is subject to the protection of the CCPA.

“Consumer,” “Business,” “Sell,” and “Service Provider” will have the meanings given to them in the CCPA.

“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Customer Personal Data.

“Customer Personal Data” means Customer Data that contains Personal Data about your customers or clients, its personnel, and customers, that we receive from you or which is otherwise created or Processed for or on behalf of you in the provision of the Services under the Agreement.

“Data Protection Laws” means data protection laws of the United States and the European Union (“EU”) and, to the extent applicable, the data protection or privacy laws of any other country. Data Protection Laws include, without limitation, CCPA and the EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced, or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR.

“Data Subjects” means the identified or identifiable natural person to whom Customer Personal Data relates.

“GDPR” means EU General Data Protection Regulation 2016/679.

“Member State” means a country that is a member of the European Union or the European Economic Area.

“Personal Data” is defined in our Privacy Policy and any information which would qualify as “personal information” under Data Protection Laws.

“Personal Data Breach” means a breach of security leading to the misappropriation or accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise Processed through the Services or the systems that compromises the security, confidentiality, or integrity of such Customer Personal Data.

“Privacy Laws” means privacy laws or Data Protection Laws of any country or state applicable to our and/or your Processing of Customer Data, including Customer Personal Data.

“Process” or “Processing” means any operation or set of operations that are performed on Customer Personal Data or on sets of Customer Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor” means a natural or legal person, public authority, agency, or other body that Processes Customer Personal Data on behalf of the Controller.

“Sensitive Data” means (i) any patient, medical, or other protected health information regulated by HIPAA or any similar federal or state laws, rules, or regulations; or (ii) any other information subject to regulation or protection under specific laws such as the Gramm-Leach-Bliley Act (or related rules or regulations).

“Special Category Data” means any Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or orientation.

“Subcontractor” means our service providers, agents, subcontractors, and all other persons, entities, or organizations, exclusive of your employees or Third-Party Service providers who are subject to your direction, supervision, and control.

“Sub-Processor” means any Subcontractors engaged by us to Process Customer Data who are identified by us in this DPA, the Agreement, our website, or otherwise approved or acknowledged in writing by you.

2. Scope

This DPA applies if and to the extent Customer Data contains Customer Personal Data and is received by us from or on your behalf as a data Processor while providing the Services. We are not responsible or liable for compliance or non-compliance with any Privacy Laws applicable to your industry that are not generally applicable to us.

3. Term

This DPA begins when we first receive or have access to Customer Data and continues thereafter for the period during which we are a data Processor and have possession or access to Customer Data in connection with the Services until the expiration or cancellation of your right to access or use the Services.

4. Purpose and Security Measures

We will Process Customer Data, including Customer Personal Data, solely for the purpose of providing the Services in accordance with the Agreement and this DPA or as otherwise instructed by you. We will implement and maintain policies, procedures, and practices that satisfy the applicable requirements set forth in this DPA. For more information on how we protect Customer Data, including Customer Personal Data, please see our Security Policy.

5. Instructions

We will comply with all reasonable instructions provided by you in the Processing of Customer Data. If we cannot provide such compliance for whatever reason, we agree to inform you of our inability to comply promptly. If, for any reason, adLLC, in its sole discretion, believes that any one or more features of the Services cannot comply with your instructions, then we reserve the right to cease all Processing of your Customer Data or stop providing the Services to you until we are either able to comply or you provide us with new instructions. We shall not be liable for the failure to provide the Services should we choose to invoke our rights provided in this section, and your sole remedy shall be the right not to renew your access to the Services.

6. Customer Responsibilities

You are responsible for compliance with your requirements under the applicable Privacy Laws with respect to Customer Data and the instructions you provide us related to such Customer Data. Without limiting the generality of the foregoing, you are solely responsible for: (i) the accuracy, quality, integrity, and legality of your Customer Data and the means by which you acquire Customer Data; (ii) ensuring you have the right to transfer, or provide access to, Customer Data for us to provide the Services; and (iii) ensuring that any instructions that you provide to us regarding the Processing of Customer Data comply with all Privacy Laws. You will inform us without undue delay if you are not able to comply with your responsibilities under this section or applicable Privacy Laws.

7. Specific Disclaimers

You recognize and agree that hosting content online involves risks of unauthorized disclosure or exposure and that, in using the Services, you assume such risks. We shall not, in any way, be responsible for any intentional or unintentional misuse of Customer Data by you (including your employees, subsidiaries, or affiliates) and/or by your authorized users or Third-Party Service providers to whom you have granted access to Customer Data. You are solely responsible for granting access to the Services to your authorized users.

8. Customer Instructions

You acknowledge and agree that the instructions contained in the Agreement and this DPA related to the Processing of Customer Data (collectively, the “Instructions”) constitute the complete Instructions from you regarding our Processing of Customer Data. To the extent any additional instructions from you are consistent with the Instructions, we will Process Customer Data in accordance with the additional instructions. To the extent any additional instructions from you are inconsistent with the Instructions, we may, at our discretion, refuse to honor such additional instructions to the maximum extent permitted under applicable Privacy Laws.

9. No Special Category Data

The Services may not be adequate to protect Sensitive Data or Special Category Data that imposes specific data security or data protection obligations. You acknowledge and agree that transmitting, processing, or otherwise making such data available to the Services is entirely at your own risk. WE HAVE NO OBLIGATION TO YOU WITH REGARDS TO PROCESSING OF SENSITIVE DATA OR SPECIAL CATEGORY DATA BEYOND THE OBLIGATIONS SET FORTH IN THE AGREEMENT AND/OR THIS DPA.

10. Processing

We may Process Customer Data as necessary to provide the Services, including where applicable for hosting and storage; backup and recovery; issue resolution; applying new product or system versions, patches, updates, and upgrades; monitoring and testing system use and performance; IT security purposes including incident management; maintenance and performance of technical support systems; and migration, implementation, configuration, and performance testing. We will not: (i) modify Customer Data other than as necessary to provide the Services; (ii) disclose Customer Data except as compelled by law or as expressly permitted by you; or (iii) access Customer Data except to provide the Services, address service or technical problems, or at your request in connection with customer support matters.

11. Transmission Monitoring

Subject to the provisions of applicable Privacy Laws, you consent to our interception, collection, use, reproduction, storage, and review of any Customer Data as required in connection with: (i) the provision and maintenance of the Services; (ii) billing; (iii) the protection and security of the Services; (iv) compliance with Privacy Laws or valid legal process; and (v) our collection, generation, storage, reproduction, and use of statistical information for our own internal purposes of, among other things, improving and enhancing the Services. Except as required by Privacy Laws or by valid legal process, we will not, without your consent, specifically identify you in association with such statistical information. In connection with such interception, collection, reproduction, storage, or usage, we have the right to remove any Customer Data, the content of which we deem to be in violation of applicable Privacy Laws or any term or condition outlined in the Agreement, upon reasonable written notice of such removal to you. Notwithstanding the foregoing, we do not have any obligation to remove, screen, police, or monitor Customer Data.

12. Sub-Processors

By using the Services, you authorize us to subcontract its Processing work related to Customer Personal Data under the Agreement to Third-Party Service providers identified in this DPA, the Agreement, or as listed on our website. You agree that we may later use Sub-Processors not identified in the Agreement or listed on our website through written notice to you with reasonable time to object to such Sub-Processor. We will require that all Sub-Processors maintain adequate measures reasonably appropriate to such Sub-Processor’s storage, maintenance, or processing activities that comply in all material respects with the relevant obligations in this DPA to the extent applicable to the nature of the services provided by such Sub-Processors. We will remain responsible for each Sub-Processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause us to breach any of its obligations under this DPA.

13. International Transfers

Unless otherwise provided in the Agreement, we may Process Customer Data globally as necessary to provide the Services. Unless otherwise provided in written documentation between you and us, all the Services are hosted in the United States, and if you are located anywhere other than the United States, your access and use of such the Services constitute your consent to our transferring and the subsequent storage of Customer Data from your country of origin to the United States. If the Agreement or other written documentation executed between you and us indicates a specific geographic location where Customer Data will be stored and hosted (“Country of Origin”), then any transfer of Customer Data, including Customer Personal Data, outside of the Country of Origin by us (if any) will only be done through your written permission and in compliance with the relevant provisions of the Privacy Laws in the originating country.

14. Cooperation and Inquiries

One party will promptly inform the other if it receives any inquiry, complaint, or claim from any court, governmental official, third parties, or individuals arising out of the use of the Services and will provide the other party reasonable support and cooperation in a timely manner in responding to any request. Should we directly receive a request or inquiry from a Data Subject that has identified you as the Controller, we will promptly pass on such requests to you without responding to the Data Subject. Should you, on the basis of Data Protection Laws, be obliged to provide access or information to a Data Subject about the Processing of Customer Personal Data, we will reasonably assist you in providing such access or information.

15. Information Security

We have implemented and will maintain appropriate technical and organizational security measures for the Processing of Customer Personal Data designed to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. These security measures govern all areas of security applicable to the Services, including physical access, system access, data access, transmission and encryption, input, data backup, data segregation and security oversight, enforcement, and other security controls and measures. All our employees, as well as any Sub-Processors that Process Customer Personal Data, are subject to appropriate written confidentiality arrangements or are otherwise bound by statutory obligations of confidentiality. For more information on our security practices, please see our Security Policy.

16. Data Breach Incidents

If we become aware of a Personal Data Breach relating to Customer Personal Data Processed through the Services, we will inform you without undue delay. We will take appropriate measures to address the Personal Data Breach, including, where appropriate, securing Customer Personal Data, and will work in good faith to reduce risk to the Data Subjects whose Customer Personal Data was involved. Privacy Laws may impose a duty to inform the competent authorities or affected Data Subjects in the event of the loss or unlawful disclosure of Customer Personal Data or access to it, and we agree to provide you with sufficient information to allow you to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Privacy Laws. We will cooperate with you and take reasonable steps as necessary to assist in the investigation, mitigation, and remediation of each Personal Data Breach. You agree that you are responsible for and will coordinate the messaging related to any privacy violation, security breach, or data breach incident with us before making any public disclosures.

17. Inspection and Audit Rights

You may inspect, at your expense, our security, technical, and organizational procedures used for Processing Customer Personal Data to verify compliance with this DPA (“Audit”). Unless otherwise required by applicable Data Protection Laws, you may Audit our compliance with this DPA once per twelve (12) month period, unless a violation of our obligations under this DPA is found, in which case you may conduct another Audit within six (6) months. The Audit may be conducted by your data protection officer or a mutually accepted authorized representative or third-party auditor. We agree to provide you with any reasonably necessary information and documents during the Audit. All Audits will be performed during normal working hours and in such a way that the Audit does not disrupt or compromise our normal business operations. In addition, we will cooperate with any Audit ordered by a relevant regulator that arises from its performance under the Agreement. Any Audit shall not entitle you to view, or in any way access records and/or processes: (i) not directly related to Customer Personal Data Processed by us; (ii) not directly related to the Services provided to you under the Agreement; (iii) in violation of applicable Data Protection Laws; and/or (iv) in violation of our confidentiality obligations owed to a third party.

Before any Audit, we must mutually agree in writing on the scope of the Audit, which must describe the proposed scope, duration, and start date of the Audit. You must provide prior written notice, including a written explanation of the reason for the Audit, to us no later than thirty (30) days before any such Audit commences. Before any Audit, both parties shall agree to pursue, in good faith, other means of reconciling the documents that would render such Audits unnecessary. Audits may be performed by a third party mutually accepted by the parties, and any such third-party auditor must sign a confidentiality agreement acceptable to us, or otherwise be bound by a statutory or legal confidentiality obligation. Such third-party auditor may not disclose anything other than the results of our compliance or non-compliance with the Audit.

You agree to provide us with the audit results, including any documented reports, which shall be subject to the confidentiality terms of the Agreement. You may use the Audit reports only to meet your requirements in accordance with applicable Data Protection Laws or to confirm our compliance with this DPA.

18. Deletion of Customer Data

We will, except to the extent provided in the Agreement or prohibited by applicable law, destroy and delete all Customer Data in our possession and subject to Processing within sixty (60) days of the cancellation of your right to access or use the Services (unless sooner requested in writing by you). This does not apply to Customer Data that is Processed or stored by Partner Programs or Third-Party Services that are used in conjunction with the Services. To delete any Customer Personal Data stored or Processed by Partner Platforms or Third-Party Services providers, you must contact the applicable Partner Platform or Third-Party Services provider directly.

19. Legal Requirements

We may be required by applicable Data Protection Laws to provide access to Customer Personal Data, such as to comply with a subpoena or other legal process, or to respond to government requests, including public and government authorities for national security and/or law enforcement purposes. We agree to promptly inform you of requests for access to Customer Data, unless otherwise required by law.

20. Additional Provisions for California Personal Information

When Processing CA Personal Information in accordance with your Instructions, you agree that you are a Business and we are a Service Provider for the purposes of the CCPA, and that we will Process CA Personal Information as a Service Provider strictly for the purpose of providing the Services under the Agreement (“Business Purpose“) or as otherwise permitted by the CCPA, including as described in our Privacy Policy. We shall not (a) Sell any CA Personal Information other than use Google Analytics; (b) retain, use, or disclose any CA Personal Information for any purpose other than for the specific purpose of providing the Services, including retaining, using, or disclosing the CA Personal Information for a commercial purpose (as defined in the CCPA) other than the provision of the Services; or (c) retain, use, or disclose the CA Personal Information outside of the direct business relationship between you and us.

21. Severability

If any provision of this DPA is held invalid or unenforceable by any court of competent jurisdiction, the parties shall mutually agree on an alternate, legally valid, and enforceable provision. The remainder of this DPA shall continue in full force and effect to the extent that continued operation without the invalid or unenforceable provision is consistent with the intent of the parties.

22. Disclaimer

WE SHALL NOT BE LIABLE FOR: (I) VIOLATION OF ANY APPLICABLE DATA PROTECTION LAW, (II) PERSONAL DATA BREACH, OR (III) VIOLATION OF ANY PRIVACY OR INTELLECTUAL PROPERTY RIGHTS ASSOCIATED WITH CUSTOMER DATA NOT STORED ON OUR SERVERS OR CAUSED BY YOUR OR YOUR ACTS, OMISSIONS, OR NEGLIGENCE.

23. Limitation of Liability

Each party and each of their affiliates’ liability, taken in aggregate, arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, will be subject to the limitations and exclusions of liability set out in the Section entitled ‘Limitation of Liability’ of the Agreement and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement (including this DPA). In no event will either party’s liability be limited with respect to any individual’s data protection rights under this DPA or otherwise. IN NO EVENT WILL OUR LIABILITY TO YOU FOR A BREACH OF CUSTOMER DATA EXCEED ONE MILLION DOLLARS ($1,000,000).

24. Governing Law

This DPA will be governed by the choice of law and jurisdiction provisions contained in the Agreement.

Back to top.