Data Processing Addendum.

This Data Processing Addendum (“DPA”) is part of the Terms of Service between ODD Media LLC, doing business as OMD Growth (“OMD Growth,” “we,” “us” or “our”), and the customer that has accepted them (“Customer” or “you”) for Atlas ReportingOS (the “Service”). It sets out how we process personal data on your behalf. It applies automatically when you accept the Terms, and neither party needs to sign it.

1. Definitions

• Customer Personal Data: personal data that we process on your behalf to provide the Service, including personal data in the data we collect from the platforms you connect.
• Data Protection Laws: the laws that apply to the processing of Customer Personal Data under the Terms, which may include the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).
• Subprocessor: a third party we engage that processes Customer Personal Data.
• Security Incident: a breach of security that leads to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, Customer Personal Data.
• SCCs: the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• Controller, processor, data subject, personal data, processing, business, service provider, sell and share have the meanings given in Data Protection Laws.

2. Scope and roles

You are the controller of Customer Personal Data (a “business” under the CCPA), and we are your processor (a “service provider”). If you use the Service for your own clients, for example as an agency, you are their processor and we are your subprocessor, and you confirm that your clients have authorized you to engage us on the terms of this DPA.

Annex 1 describes the processing. This DPA does not cover personal data we handle as a controller for our own purposes, such as your account and billing details and visits to our website. Our Privacy Policy covers those.

If this DPA conflicts with the Terms, this DPA governs the processing of Customer Personal Data. If the SCCs apply and conflict with this DPA, the SCCs govern.

3. How we process Customer Personal Data

• We process it only on your documented instructions. The Terms, this DPA and the way you set up and use the Service are your complete instructions. If the law requires us to process it otherwise, we tell you first, unless that law forbids it.
• We tell you if we believe an instruction breaks Data Protection Laws.
• We use it only to provide, secure and support the Service for you. Data that we have anonymized and aggregated as Section 6.4 of the Terms allows is no longer personal data.
• Everyone we authorize to process it is bound by confidentiality.

4. Your responsibilities

• You are responsible for the lawfulness of the Customer Personal Data you bring into the Service, including having a lawful basis for it and giving the people concerned any notice they are owed.
• If you install the Atlas pixel on your website, you are responsible for any consent your visitors must give before it runs.
• You will not use the Service to process special categories of personal data, such as health data, or the personal data of children, unless we agree in writing.
• Your instructions to us must comply with Data Protection Laws.

5. US state privacy laws

Where the CCPA or a similar US state privacy law applies, we act as your service provider or processor, and we:

• do not sell or share Customer Personal Data;
• do not retain, use or disclose it for any purpose other than providing the Service under the Terms, or outside our direct business relationship with you;
• do not combine it with personal information we receive from anyone else or collect ourselves, except as those laws allow;
• comply with those laws and give it the level of privacy protection they require; and
• tell you if we can no longer meet these obligations.

We certify that we understand these restrictions and will comply with them. You may take reasonable and appropriate steps to make sure we use Customer Personal Data consistently with your obligations under those laws, and to stop and remediate any unauthorized use.

6. Security

We protect Customer Personal Data with the technical and organizational measures in Annex 2, which are appropriate to the risk. Our Security page describes them in more detail. We may change them as threats and technology change, but not in a way that lowers the overall protection of Customer Personal Data.

7. Subprocessors

You authorize us to engage the Subprocessors in Annex 3, and new ones as this Section allows.

Before a Subprocessor processes Customer Personal Data, we put a written agreement in place that imposes data protection obligations no less protective than this DPA, to the extent they apply to its service. We remain responsible to you for the work of our Subprocessors.

We email the account owner at least 30 days before a new or replacement Subprocessor starts processing Customer Personal Data. You may object on reasonable data protection grounds within those 30 days by emailing security@reportingos.com, and we will work with you in good faith to resolve the objection. If we cannot, you may end your subscription by notice to us, and we will refund any fees you prepaid for the period after it ends.

If we have to replace a Subprocessor urgently to protect the Service or Customer Personal Data, we tell you as soon as we can, and your right to object runs from that notice.

8. Where data is stored and transfers

Customer Personal Data is stored in the United States. Our team accesses it remotely, including from Egypt, where OMD Growth is based, to run and support the Service.

Where the GDPR applies and Customer Personal Data is transferred to us in a country without an adequacy decision, the SCCs are incorporated into this DPA and apply as follows:

• Module Two applies where you are a controller, and Module Three where you are a processor. You are the data exporter and we are the data importer.
• Clause 7 (the docking clause) applies.
• In Clause 9(a), Option 2 (general written authorization) applies, with the notice period in Section 7 of this DPA.
• The optional wording in Clause 11(a) does not apply.
• The competent supervisory authority is the one determined under Clause 13.
• Under Clauses 17 and 18, the SCCs are governed by the law of Ireland, and disputes under them are resolved by the courts of Ireland.
• Annex I of the SCCs is completed by Annex 1 of this DPA, and Annex II by Annex 2.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0) also applies. Its Tables 1 to 3 are completed by this DPA and its annexes, and under Table 4 either party may end it as its Section 19 allows.

For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the changes that Act requires: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, references to the GDPR are read as references to that Act, and data subjects in Switzerland may bring claims in Switzerland.

9. Helping you meet your obligations

• Requests from individuals: we help you answer requests from people exercising their rights under Data Protection Laws, as far as the nature of the processing allows. If someone sends such a request to us, we pass it to you and do not answer it ourselves unless the law requires us to.
• Assessments: we give you the information you reasonably need for a data protection impact assessment, or a consultation with a supervisory authority, that concerns the Service.

10. Security Incidents

If we become aware of a Security Incident, we notify you by email without undue delay, and within 72 hours of becoming aware of it, as our Privacy Policy commits. We tell you, as far as we know them, what happened, the kinds and approximate number of people and records affected, the likely consequences, what we have done and will do, and who to contact. If we do not know everything at first, we send the rest as we learn it.

We promptly take reasonable steps to contain, investigate and limit the incident. Notifying you is not an admission of fault.

Attempts that do not compromise Customer Personal Data, such as blocked sign-in attempts, pings and port scans, are not Security Incidents.

11. Audits

On written request, we give you the information you reasonably need to confirm that we meet this DPA, including our detailed security documentation under a non-disclosure agreement.

If that information is not enough to meet a requirement of Data Protection Laws, if a supervisory authority asks, or after a Security Incident, you may audit our compliance with this DPA yourself or through an independent auditor. Audits take place no more than once a year, except when a supervisory authority asks or after a Security Incident, on at least 30 days’ written notice, during business hours, without disrupting the Service, under confidentiality and at your own cost. An auditor may not be our competitor and may not see other customers’ data.

12. Return and deletion

• Before your subscription ends, you can ask for an export of your data by emailing welcome@reportingos.com.
• When you disconnect a platform or delete your account, its access tokens are deleted immediately.
• Within 30 days after your subscription ends or you delete your account, we delete Customer Personal Data, including from backups, unless the law requires us to keep it. Usage logs, which may hold limited personal data, are kept for up to 12 months and then deleted, as our Privacy Policy describes.
• On request, we confirm the deletion in writing.

13. General

• This DPA lasts as long as we process Customer Personal Data for you.
• Each party’s liability under this DPA is subject to the limits and exclusions of liability in the Terms, except where Data Protection Laws or the SCCs do not allow it.
• We may update this DPA as Section 14.2 of the Terms allows. No update will reduce the protection of Customer Personal Data or your rights under this DPA.
• This DPA is governed by the law that governs the Terms, except where the SCCs provide otherwise.
• If you need a signed copy for your records, email security@reportingos.com.

Annex 1. Details of the processing

Annex 2. Technical and organizational measures

• Encryption in transit: every connection to the Service is encrypted with TLS 1.2 or higher, all the way to our servers, and HTTPS is enforced. Calls to the platforms you connect are made over HTTPS.
• Encryption at rest: backups are encrypted before they leave the server, with keys held apart from the systems they protect. OAuth tokens and API keys for connected platforms are encrypted in the database with a separate application key. Passwords are hashed with a salted, one-way algorithm built for passwords, and Atlas API keys are stored as hashes.
• Network protection: our servers accept web traffic only through our firewall, and databases and internal services are not exposed to the internet.
• Access control: access to production systems and Customer Personal Data is limited to the personnel who need it to run and support the Service, and every administrative account uses two-factor authentication. Sign-in to the Service is protected against password guessing, and sessions expire automatically.
• Separation: each customer’s data is logically separated from every other customer’s.
• Data minimization: we request only the permissions each connected platform needs for the features you enable.
• Vulnerability management: every code change and the live Service are scanned for known vulnerabilities, findings carry fix deadlines set by their severity, and the production servers install operating-system security updates automatically.
• Security testing: the live Service and its API are tested from the outside, signed out and signed in, including attempts to reach another customer’s data.
• Monitoring: production is monitored continuously for errors, downtime and failed scheduled jobs, including backups, with alerts to the people who fix them.
• Incident response: a written plan with named owners, severity levels and set steps from containment through recovery to a written review.
• Backups: the database is backed up daily, encrypted and stored apart from production, in storage that locks recent backups against deletion.
• Physical security: the servers run in our hosting provider’s data centers in the United States, under that provider’s physical security controls.
• Review: these measures are reviewed every six months.

Annex 3. Subprocessors

The current list of Subprocessors is section 7 of our Security page: each company, what it does, the data it touches and where it is based. That list forms this Annex, and it changes only as Section 7 allows.

The platforms you connect yourself, such as Meta, Google, Stripe, Close and Typeform, are your own accounts, authorized by you. They are not our Subprocessors.