Data Processing Agreement (DPA)
GalGom Solutions, SL, located at Calle Aribau, 170 1º2ª, 08036 Barcelona, Spain, CIF B01961291 (hereinafter referred to as the “Data Processor” or “GalGom Solutions”).
1. Purpose
This Data Processing Agreement (DPA) governs the terms under which GalGom Solutions will process personal data on behalf of the Client in connection with the services provided through Campaign AI.
2. Purpose and Nature of Processing
GalGom Solutions will process personal data to manage, optimize, and report on the performance of advertising campaigns in Google Ads. This includes, but is not limited to, the collection of Google Ads data, campaign optimization, and performance reporting.
3. Duration
This DPA will remain in effect for the duration of the contractual relationship between GalGom Solutions and the Client and as long as personal data is being processed.
4. Types of Personal Data Processed
● Contact Data: Name, email address.
● Payment Data: Credit card information or other payment methods (via third-party providers). ● Account Data: Information from the Client’s Google Ads account, including identifiers and settings.
5. Obligations of the Data Processor
5.1 Processing in Accordance with Instructions
● GalGom Solutions will only process personal data in accordance with the Client’s instructions.
5.2 Confidentiality
● All personnel with access to personal data will sign a confidentiality agreement.
5.3 Security Measures
● GalGom Solutions will implement and maintain appropriate technical and organizational measures to protect personal data from unauthorized access, loss, or destruction, including encryption, access controls, and physical and logical security.
6. Sub-Processors
By using the service, the Client authorizes GalGom Solutions to engage necessary sub-processors to fulfill the contractual obligations. Current sub-processors include payment providers (currently Stripe and PayPal), hosting providers (currently IONOS), and others as necessary. Sub-processors may be replaced or supplemented, with notice provided to the Client for their information.
7. Rights of Data Subjects
GalGom Solutions will facilitate the exercise of rights by data subjects, including access, rectification, deletion, and portability of personal data, upon the Client’s request. Responses to data subject requests will be provided within a maximum of 30 days.
8. Data Deletion or Return
Upon termination of the contractual relationship, GalGom Solutions will delete or return all processed personal data unless there is a legal obligation to retain it.
9. Audits and Assessments
The Client has the right to request audits to verify compliance with this DPA, with at least 30 days’ notice. Audits must be conducted without disrupting operations and will be at the Client’s expense.
10. Notification of Security Incidents
GalGom Solutions will notify the Client of any security incident affecting personal data within 24 hours of detection. This notification will include:
● Nature of the breach.
● Affected data.
● Measures taken to mitigate damage and prevent future incidents.