Accord de traitement des données (DPA)

Parties

This Data Processing Addendum ("DPA") forms part of the agreement between the Client, acting as data controller ("Client", "Controller"), and Palmidos Ltd, Israel, acting as data processor ("Palmidos", "Processor"). It applies to personal data Palmidos processes on Client's behalf in connection with the services.

Subject matter and duration

This DPA covers the processing of: (a) lead data generated by advertising campaigns landing on Client's website, and (b) contact details of Client's staff involved in the engagement. It remains in effect for as long as Palmidos processes personal data on Client's behalf under the main agreement.

Nature and purpose of processing

Palmidos processes personal data to set up, run, and report on advertising campaigns on Client's behalf, and to communicate with Client's staff regarding the engagement.

Categories of data subjects and data

1. Data subjects: individuals who submit leads through Client's advertising campaigns, and Client's employees or contractors involved in the engagement.
2. Data categories: contact details (name, email, phone), campaign interaction data, and business contact information. No special categories of data are intentionally processed.

Processor obligations

Palmidos will:

1. Process personal data only on Client's documented instructions, unless required otherwise by law.
2. Ensure personnel with access to personal data are bound by confidentiality obligations.
3. Implement appropriate technical and organizational security measures.
4. Assist Client, to a reasonable extent, in responding to data subject requests (access, rectification, erasure, portability, and objection).
5. Notify Client without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting Client's data.
6. Delete or return all personal data to Client at the end of the engagement, unless retention is required by law.
7. Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits by Client or an appointed auditor on reasonable notice.

Sub-processors

Client authorizes Palmidos to engage the following sub-processors:

1. Vercel — hosting and infrastructure.
2. Neon — database hosting (EU, Frankfurt).
3. Stripe — payment processing.
4. Resend — transactional email delivery.
5. OpenAI Ads Manager — advertising platform, acting as an independent controller for its own processing of ad platform data.

Palmidos will give Client at least 30 days' notice before adding or replacing a sub-processor, allowing Client to object on reasonable data protection grounds.

International transfers

Where personal data is transferred outside the EU/EEA, Palmidos relies on appropriate safeguards, including the EU Standard Contractual Clauses ("SCCs"), where applicable to the transfer in question.

Liability

Liability under this DPA is subject to the limitation of liability set out in the main agreement between the parties.

Governing law

This DPA is governed by the laws of the State of Israel, consistent with the governing law provisions of the main agreement.

Contact

Questions about this DPA can be sent to Palmidos Ltd at support@chatadsai.com.