Data Processing Agreement

1. Roles

• Controller determines the purposes and means of processing (campaigns, destinations, whether to use tracking URLs in ads, and end-user notices/consents).
• Processor provides the CountedClicks platform and processes click and account-linked measurement data only on documented instructions from Controller (including configuration in the Service and this DPA).
• Processor is an independent controller for its own account administration, billing, security, and product improvement of the Service unrelated to Controller’s end-user click streams, as described in the Privacy Policy.

2. Subject matter and duration

Processing covers HTTP redirects and logging of click events for links Controller creates, for the duration of the Agreement and any post-termination retention required for billing, disputes, or law (see retention in the Privacy Policy / Annex below).

3. Nature and purpose

Transparent click redirection (HTTP 302 to `redirection_url`), attribution when identifiers are present, analytics/reporting for Controller, billing classification, and security/abuse prevention.

4. Types of personal data and data subjects

Data subjects: end users who click Controller’s ads or links that include a CountedClicks tracking URL; and authorised users of Controller’s account.

Data categories (clicks): timestamp; public tracking codes; destination URL; User-Agent-derived device/browser/OS; optional campaign parameters Controller includes; coarse geo/edge signals when available. Raw IP addresses are not stored in click logs by default. Cookies are not set on the `/click` path.

5. Controller instructions and compliance

Controller instructs Processor to:

• Redirect to the validated `redirection_url` supplied in each request;
• Record attributed clicks when valid link identifiers are present;
• Apply Privacy Mode / Bot Detection only when enabled on the link by Controller.

Controller is responsible for lawful use of the Service, including obtaining any notices and consents required under GDPR, ePrivacy, and platform policies (including Google’s EU User Consent Policy where Google products are used) for EEA/UK/Swiss users.

6. Processor obligations

• Process personal data only on Controller’s documented instructions;
• Ensure persons authorised to process data are bound by confidentiality;
• Implement appropriate technical and organisational security measures;
• Assist Controller with data-subject requests, insofar as possible;
• Assist with security incidents, DPIAs, and prior consultation where relevant;
• Delete or return personal data after end of services, subject to legal retention;
• Make available information necessary to demonstrate compliance with this DPA.

7. Sub-processors

Controller authorises Processor to use infrastructure sub-processors strictly necessary to host and operate the Service (application hosting, managed database, and backup/storage used for durability). Current hosting is operated on Railway’s cloud infrastructure. Processor will impose data-protection terms no less protective than this DPA and remains responsible for sub-processor performance.

Material changes to sub-processors will be communicated via the Service or support@mediaspades.com. Controller may object on reasonable data-protection grounds; if unresolved, Controller may terminate the affected Service as its sole remedy.

8. International transfers

Where personal data is transferred from the EEA/UK to a third country without an adequacy decision, parties rely on the EU Standard Contractual Clauses (Module 2 Controller to Processor) and/or the UK International Data Transfer Addendum, as applicable, which are incorporated by reference upon request to support@mediaspades.com. Supplementary measures include TLS in transit, access controls, and least-privilege administration.

9. Security incident notice

Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data, and will provide information reasonably required for Controller’s notification obligations.

10. Annex — retention

• Click event logs: up to 24 months, then deletion or irreversible aggregation;
• Account/billing records: as required by law and generally up to 24 months after closure.

11. Contact

DPA and privacy requests: support@mediaspades.com

MediaSpades FZ-LLC
RAKEZ Business Zone, Al Nakheel Area, P.O. Box No. 10055, Ras Al Khaimah, United Arab Emirates

This online DPA applies automatically to paid and approved accounts unless replaced by a signed paper or PDF version agreed by both parties. For a countersigned copy, email support@mediaspades.com.