This Addendum to the Data Processing Agreement (hereinafter, the “Addendum”) governs the processing of personal data carried out by Blip on behalf of and for the account of the Advertiser who contracts or uses the Service governed by the Terms of Use. By contracting, activating, or using the Service, the Advertiser agrees to be bound by the terms of this Addendum, which forms an integral part of the Terms of Use.
On the one hand, the Advertiser (hereinafter, the “Data Controller” or the “Controller”) and, on the other hand, GUS TECHNOLOGIES, S.L.U. (hereinafter, the “Data Processor” or the “Processor”), hereinafter referred to individually as each “Party” and collectively as the “Parties,” hereby state:
I. That, by virtue of the provision of services agreed upon by the parties and as set forth in the Terms and Conditions, the Data Processor has undertaken to provide to the Data Controller the services described in Appendix I (hereinafter, the “Services”).
II. That, in order to perform said Services, the Data Processor needs to process the personal data under the responsibility of the Data Controller.
III. Whereas, to regulate such access, both Parties agree to enter into this Addendum, which shall be governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, and its implementing regulations (hereinafter, the “GDPR” or the “Applicable Regulations”), and, in particular, by the following
CLAUSES
1. PURPOSE
I. The purpose of this Addendum is to define the conditions under which the Data Processor will carry out the processing of personal data necessary for the proper provision of the Services rendered to the Data Controller.
II. The provision of the contracted Services entails the processing of data described in Clause 3 by the Data Processor.
2. TERM
This Addendum shall remain in effect for the entire duration of the provision of the Services contracted by the Data Processor. Notwithstanding the foregoing, both Parties agree that the provisions of this Addendum, whether expressly or implicitly intended to remain in effect after its termination or expiration, shall remain in effect and continue to be binding on both Parties as stipulated.
3. NATURE AND PURPOSE OF THE PROCESSING
The data processing that the Data Processor undertakes to perform shall be limited to the actions necessary to provide the services in accordance with the Terms and Conditions and this Addendum. Specifically, the Advertiser will be provided with the technological solution necessary for it to use the Google Message Ads service and features.
In this context, the Data Processor will process the following information, including, where available, Users’ email addresses and phone numbers:
– Campaign Data (Message Ads Campaign Data): Google click ID (Gclid) or GBRAID, chat ID, ad ID, and campaign ID.
– Conversion Data: conversion timestamps, conversion values, conversion currency, conversion name, and Google click ID (Gclid) or GBRAID; and, where applicable and to the extent available, the email address and phone number of the Advertiser’s end user.
The personal data processed may correspond to the following categories of data subjects:
● End users of the Data Controller who interact with Google Message Ads campaigns and use the communication channels enabled by the Data Controller.
● Potential customers, customers, or users of the Data Controller who interact with advertising campaigns managed through the Service.
The Data Processor will carry out the processing operations necessary for the performance of the Service, including collection and receipt of data, recording, consultation, use, storage and retention, disclosure, and destruction.
Specifically, the Data Processor undertakes to process Personal Data in accordance with the instructions provided by the Data Controller at all times, as well as with the provisions of the Applicable Regulations.
The duration of data processing shall coincide with the duration of the provision of services governed by the Terms and Conditions, as well as any extensions agreed upon by the Parties. The retention periods for personal data shall be as established by the Data Controller.
Furthermore, the Data Processor undertakes not to perform any other processing of the Personal Data, nor to apply or use the data for any purpose other than the provision of the Service referred to in this Addendum, unless expressly authorized by the Data Controller.
Notwithstanding the foregoing, the Data Processor may use aggregated information derived from the Personal Data processed within the scope of the Service—to the extent that it does not allow for the identification of individuals—for its own purposes, including, but not limited to, trend analysis, the compilation of statistics, and the improvement, development, and optimization of products and services, as well as other analytical, operational, or business purposes.
4. OBLIGATIONS OF THE DATA CONTROLLER
For the provision of the Service, the Data Controller agrees to make available to the Data Processor the personal data and/or information necessary for the proper processing thereof for the provision of the Services.
In particular, the Data Controller is responsible for:
a. Provide the Data Processor with the data relevant to the provision of the Services.
b. Guarantee the lawful origin of the data to be processed by the Data Processor and its compliance with Applicable Regulations. In particular, guarantee that the Data Controller has fulfilled its duty to inform and has the necessary legal basis for processing the data.
c. Conduct a data protection impact assessment of the processing operations to be carried out by the Data Processor, when applicable.
d. Seek prior consultation with the relevant supervisory authorities to ensure proper regulatory compliance and mitigate associated risks.
e. Ensure, both prior to and throughout the processing, that the Data Processor complies with the Applicable Regulations.
f. Supervise the processing, including conducting inspections and audits.
g. Ensure that the Data Processor’s processing operations align with the purposes for which the Data Controller proposes to engage the Data Processor to provide the agreed-upon services.
h. Finally, the Data Controller acknowledges that the Data Processor possesses sufficient knowledge, reliability, and resources to implement technical and organizational measures that meet the requirements of current data protection regulations.
5. OBLIGATIONS OF THE DATA PROCESSOR
The Data Processor undertakes to comply with the following obligations:
a. To process personal data solely for the purpose of providing the contracted Services, in accordance with the instructions provided in writing by the Data Controller at all times (unless there is a regulation requiring additional processing; in such a case, the Data Processor shall inform the Data Controller of this legal requirement prior to processing, unless such disclosure is prohibited by law for important reasons of public interest).
b. Maintain confidentiality regarding the personal data to which it has access, even after the contractual relationship has ended, and ensure that its employees have committed in writing to maintaining the confidentiality of the personal data processed.
c. Adopt and maintain reasonable and appropriate technical and organizational measures to protect the personal data processed under this Addendum, taking into account the nature of the services provided and the risks associated with the processing.
d. To keep under its control and custody the personal data to which it has access in connection with the provision of the Service and not to disclose, transfer, or otherwise communicate such data—even for storage purposes—to any third parties unrelated to the Service and the provision of the Service covered by this Addendum.
e. The Data Processor must delete the personal data and, if applicable, the media on which it is stored, once the provision of the Service has ended.
In any case, the Data Processor may retain the data duly blocked, for as long as liabilities may arise from its relationship with the Data Controller.
f. Maintain, in writing, a record of all categories of processing activities carried out on behalf of the Data Controller, when required by Applicable Regulations.
g. Cooperate with the Spanish Data Protection Agency or another supervisory authority, upon its request, in the performance of its duties.
h. Make available to the Data Controller all information necessary to demonstrate compliance with obligations exclusively within the scope of the data processed that is owned by the Data Controller, with these processes being subject to restriction and limitation, insofar as they may affect confidential information regarding the business or data processing activities—whether internal or pertaining to other clients of the Processor—and to permit and assist in the conduct of audits, including inspections, by the Data Controller or a third party authorized by it in accordance with the provisions of Clause 10 of this Agreement.
6. SECURITY BREACHES
The Data Processor shall notify the Data Controller without undue delay, and no later than seventy-two (72) hours after becoming aware of any personal data security breaches, and shall assist the Data Controller in notifying the Spanish Data Protection Agency or another competent supervisory authority, and, where applicable, to the data subjects regarding any security breaches that occur, as well as to assist the Data Controller, when necessary, in conducting privacy impact assessments and in prior consultation with the Spanish Data Protection Agency, where applicable.
For the management and reporting of potential security breaches and incidents, the Data Processor shall provide the Data Controller with, at a minimum, the information contained in Article 33(3) of the GDPR.
If and to the extent that it is not possible to provide all the information at once, it may be provided in phases without undue delay.
7. HANDLING OF DATA PROTECTION RIGHTS
In the event that data subjects, whose data are the subject of the Service provided to the Data Controller, exercise their rights with the Data Processor, the Data Processor must immediately forward the request to the Data Controller—and no later than within five (5) business days from receipt—so that the Data Controller may duly address said request.
8. SUBCONTRACTING OF SERVICES
The Data Controller authorizes the subcontracting of services related to the processing activities governed by this Addendum.
The Data Processor is obligated to convey and communicate to the Subprocessors all of the obligations arising for the Data Processor from this Addendum and, in particular, to provide sufficient guarantees that it will implement appropriate technical and organizational measures so that the processing complies with applicable regulations.
The Data Processor and the Subprocessors must enter into a service agreement involving access to personal data that complies with the requirements set forth in the GDPR. It shall be the responsibility of the Data Processor to regulate the new relationship so that Subprocessors are subject to the same conditions (instructions, obligations, security measures, etc.) and the same formal requirements as the Data Processor.
The Data Controller may consult the Subprocessors involved in the provision of the Service in Blip’s Data Processing Agreement, available in the following link.
9. INTERNATIONAL DATA TRANSFERS
The Data Processor shall not process personal data outside the European Economic Area (EEA) in a country that does not have an adequate level of protection, unless it can guarantee an adequate protection framework, pursuant to applicable regulations, through the application of binding corporate rules, the adoption of standard contractual clauses approved by the European Commission, or, where applicable, obtaining authorization for the transfer from the competent supervisory authority, as well as any other measures required under applicable law.
In cases where there are Subprocessors outside the EEA, the Data Processor shall ensure that an appropriate mechanism recognized by applicable personal data protection regulations is in place. In the absence of an adequacy decision pursuant to Article 45 of the GDPR, the Data Processor shall sign the standard contractual clauses set forth in Commission Implementing Decision 2021/914/EU (hereinafter, the “SCCs”), or any other legal instrument that updates or modifies such standard contractual clauses.
If the Data Processor is required to transfer personal data to a third country or an international organization pursuant to Union law, Member State law, or other applicable legislation, it shall inform the Data Controller in advance of this legal requirement, unless such legislation prohibits it.
10. AUDIT
The Data Controller may audit compliance with the obligations set forth in this Agreement, either directly or through an independent auditor subject to appropriate confidentiality obligations, upon prior written notice to the Data Processor at least fifteen (15) days in advance.
Unless there is a security incident, a request from a competent authority, or a legal obligation justifying immediate action, such audits may not be conducted more frequently than once every twelve (12) months.
Audits must be conducted during the Data Processor’s normal business hours, in a manner that minimizes any impact on its operations, systems, and business activities.
Under no circumstances may the exercise of audit rights entail access to the Data Processor’s confidential information, trade secrets, security measures whose disclosure could compromise their effectiveness, or information or data relating to the Data Processor’s other clients.
11. RESPONSIBILITIES AND WARRANTIES
The Parties agree to comply with the obligations set forth in this Addendum and in the Applicable Regulations, in connection with this personal data processing engagement.
Both Parties, by mutual agreement, undertake to be liable for all damages incurred by the other Party in all cases of negligent or wrongful conduct in the fulfillment of the contractual and regulatory obligations incumbent upon them pursuant to the terms of this Addendum.
Likewise, both Parties agree that a breach of the obligations set forth in this Addendum may constitute grounds for its termination, therefore, any breach by the Data Processor, its employees, or any persons involved in the provision of services on its behalf or at its request, shall entitle the Data Controller to terminate this Addendum and shall give rise to the corresponding compensation for damages resulting from the breach of contractual obligations.
12. APPLICABLE LAW AND JURISDICTION
This Addendum shall be governed by Spanish and European regulations regarding the Protection of Personal Data, as well as the rulings and guidelines of the Spanish Data Protection Agency and other competent authorities in this matter. To resolve any dispute regarding the interpretation and/or enforcement of the provisions of this Addendum, both Parties submit to the jurisdiction of the Courts and Tribunals of Madrid, expressly waiving any other jurisdiction or venue that might otherwise apply to them.