Data Processing Addendum

This Addendum governs personal data that UNLIMITED SERVICES LIMITED processes on behalf of a client. It forms part of the Terms of Service and applies to every engagement in which we handle personal data for a client — which is most of them.

Under this Addendum the client is the controller and UNLIMITED SERVICES LIMITED is the processor within the meaning of Article 4 GDPR. It is written to meet the requirements of Article 28(3).

1. Why this exists

Running advertising audiences, configuring tracking, operating email and SMS platforms and analysing customer data all involve processing personal data belonging to the client’s customers. The GDPR requires a written contract between controller and processor covering the subject matter, duration, nature and purpose of that processing, the types of data, the categories of data subject, and the obligations of both parties. That is what this page provides.

2. Subject matter and duration

The subject matter is the provision of the marketing services set out in the applicable Scope of Work. Processing lasts for the duration of the engagement and the return or deletion period in section 11.

3. Nature and purpose of processing

Depending on the services engaged, processing may include:

• uploading and managing custom and lookalike audiences on advertising platforms;
• configuring and operating tracking through pixels, the Conversions API, Google Tag Manager and analytics tools;
• importing, segmenting and sending to contact lists in email and SMS platforms;
• analysing customer, order and behavioural data to inform strategy and reporting;
• accessing the client’s own platforms in order to carry out the above.

Processing is carried out solely to deliver the agreed services, and never for our own purposes.

4. Types of personal data

• Contact details: names, email addresses, telephone numbers, postal addresses.
• Online identifiers: cookie and pixel identifiers, advertising IDs, IP addresses, device and browser information.
• Transaction data: order history, order values, purchase dates, basket contents.
• Behavioural data: pages viewed, campaign interactions, email opens and clicks.

We do not knowingly process special categories of personal data under Article 9, nor data relating to criminal convictions. The client must not supply such data without written agreement in advance, and the Acceptable Use Policy sets out sectors we decline.

5. Categories of data subject

The client’s customers, prospective customers, website visitors, newsletter subscribers and, where relevant, its own staff whose contact details appear in campaign material.

6. Our obligations as processor

We will:

1. process personal data only on the client’s documented instructions, including on international transfers, unless required otherwise by law — in which case we tell the client first, unless the law forbids it;
2. ensure that anyone authorised to process the data is bound by confidentiality;
3. apply the technical and organisational measures in section 9;
4. respect the conditions in section 8 for engaging subprocessors;
5. assist the client, as far as we reasonably can, in responding to requests from data subjects exercising their rights;
6. assist the client with its obligations under Articles 32 to 36 — security, breach notification and impact assessments;
7. delete or return the data at the end of the engagement, as set out in section 11;
8. make available the information needed to demonstrate compliance with Article 28, and allow and contribute to audits as set out in section 12;
9. inform the client immediately if we consider an instruction breaches the GDPR or other data protection law.

7. The client’s obligations as controller

The client warrants that:

• it has a lawful basis for the processing it instructs, and where consent is required — as for most email and SMS marketing and for non-essential tracking — that valid consent has been obtained and can be evidenced;
• its privacy notice tells data subjects that processors such as us are used;
• data supplied to us was collected lawfully, and purchased or scraped lists are never supplied;
• its instructions to us comply with data protection law.

The client remains responsible for the lawfulness of the data it provides. We will not act on an instruction we believe to be unlawful.

8. Subprocessors

The client gives general authorisation for us to engage subprocessors, on condition that each is bound by data protection obligations equivalent to those in this Addendum, and that we remain fully liable to the client for their performance.

We will inform the client at least 30 days before adding or replacing a subprocessor. The client may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the client may terminate the affected services without penalty.

Which of these apply depends on the services engaged. Only those needed for the agreed work are used, and the named list for a given engagement is confirmed in writing before it starts.

Independent controllers, and why it matters to you

Several of the platforms above are marked as independent controllers rather than our subprocessors. That is not a technicality worth skipping.

When customer data is uploaded to an advertising platform to build an audience, or when a pixel or the Conversions API sends event data, that platform processes the data for its own purposes as well as for the campaign — improving its models, measuring across advertisers, and its own commercial ends. For that processing it acts as a controller in its own right, and in several cases as a joint controller alongside you.

Two consequences follow, and both are the client’s responsibility as controller:

• Your privacy notice must reflect it. It needs to tell your customers that their data is shared with these platforms and for what purpose. Naming us alone is not enough.
• Consent must cover it. Where consent is the basis — which it is for non-essential tracking and for most email and SMS marketing — that consent has to extend to this sharing, and you must be able to evidence it.

We will tell you which platforms an engagement involves and in what role, so your own notice can be brought in line. We cannot write that notice for you: it is the controller’s document, and we are not your legal adviser.

An up-to-date list is available at any time from info@marketeragency.online.

9. Security measures

Taking account of the state of the art, the costs, and the risk to data subjects, we apply:

• encryption in transit for all data, and encryption at rest for stored client material;
• multi-factor authentication on every account that supports it, including all client platform access;
• access limited to what each task requires, reviewed when an engagement changes or ends;
• individually held platform access, never shared credentials;
• a password manager for all credentials, never plain-text storage or transmission;
• separation of client data, so one client’s data is never mixed with another’s;
• regular backups, and restoration testing;
• a documented procedure for detecting and reporting personal data breaches.

10. Personal data breaches

We will notify the client without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting the client’s data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

We will not notify a supervisory authority or data subjects on the client’s behalf unless instructed in writing, because that notification is the controller’s obligation.

11. Return and deletion

On termination, or on the client’s written request at any time, we will at the client’s choice delete or return the personal data we hold on its behalf, and delete existing copies, within 30 days, unless retention is required by law.

We confirm deletion in writing. Data held inside the client’s own platforms — its advertising accounts, its email platform, its analytics — is not ours to delete; it stays where it is, under the client’s control, and we remove our access within 5 business days.

12. Audits

We will make available all information necessary to demonstrate compliance with Article 28 and, on reasonable written notice and no more than once a year, allow the client or an independent auditor appointed by it to audit that compliance. Audits take place during business hours, must not disrupt our operations or breach the confidentiality of other clients, and the client bears the cost unless the audit reveals a material breach.

13. International transfers

UNLIMITED SERVICES LIMITED is established in Hong Kong, for which no adequacy decision exists. Where a client transfers EU or EEA personal data to us as processor, the transfer is made under the Standard Contractual Clauses adopted under Article 46 GDPR — Module Two, controller to processor — which are incorporated into this Addendum by reference and available in full on request.

Where a subprocessor is established outside the EEA, the onward transfer is covered by an adequacy decision or by Standard Contractual Clauses with the additional measures required.

14. Liability and precedence

Liability under this Addendum is subject to the limits in the Terms of Service, except where those limits cannot lawfully apply to obligations under the GDPR.

Where this Addendum conflicts with the Terms of Service or a Scope of Work on a matter of data protection, this Addendum prevails.

15. Contact

Data protection matters: info@marketeragency.online. Requests under this Addendum are acknowledged within 1 to 3 business days and acted on within the periods set out above.