> **How to use**: this document is signed as is, in two counterparts or electronically. The only fields to fill in are the customer's details and, where relevant, the "Module" tick box. The French version prevails in the event of a discrepancy. --- ## DATA PROCESSING AGREEMENT **Between** **GAM Communication LLC**, a limited liability company organised under the laws of the State of Wyoming (United States), Filing ID 2026-001871449, with its registered office at 1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, United States, publisher of the "Subtraq" service, represented by Andrea Guddelmoni in their capacity as *Member*, represented in the European Union, pursuant to Article 27 GDPR, by ☐ _(name and address of the representative, completed on signature)_, hereinafter **"the Provider"**, acting as **processor**, **And** ________________________________________ [legal name], ________________ [legal form], registered under no. ______________, with its registered office at ______________________________________, represented by ______________________ in their capacity as ______________________, hereinafter **"the Customer"**, acting as **controller** ☐ / as **processor on behalf of its own clients** ☐ (tick as applicable), Together **"the Parties"**. ### Article 1 — Purpose and contractual documents 1.1 This agreement (the "Agreement") governs the processing of personal data carried out by the Provider on behalf of the Customer in connection with the use of the Subtraq service, in accordance with **Article 28 of Regulation (EU) 2016/679** ("GDPR"). 1.2 It supplements the Terms of Service available at https://subtraq.co/en/legal/terms. **In the event of a conflict, the order of precedence is**: (1) the Standard Contractual Clauses set out in Annex 4, (2) this Agreement, (3) the Terms of Service. 1.3 Annexes 1 to 4 form an integral part of the Agreement. ### Article 2 — Description of the processing The subject matter, duration, nature, purpose, categories of data and categories of data subjects are described in **Annex 1**. ### Article 3 — Roles of the Parties 3.1 The Customer determines the purposes and means of the processing of data collected through tracked links and the `subtraq.js` SDK. The Customer is the **controller** of that data; where the Customer itself acts on behalf of its own clients, it is a **processor**, and it warrants to the Provider that it holds the necessary instructions and authorisations from its own controller. 3.2 The Provider acts as **processor** for that data. 3.3 This Agreement **does not cover** the Customer's account data (authentication email address, preferences, billing data, API key fingerprints): for that data the Provider acts as **controller** on its own behalf, and the processing is described in its privacy policy. ### Article 4 — Obligations of the Provider The Provider undertakes to: **4.1 Documented instructions.** Process the data only on documented instructions from the Customer, including with regard to transfers outside the European Union. Use of the service and the settings applied by the Customer in its interface constitute instructions. Where the Provider is required by the law to which it is subject to process data beyond those instructions, it shall inform the Customer before processing, unless that law prohibits such information on important grounds of public interest. **4.2 Unlawful instructions.** Immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. **4.3 Confidentiality.** Ensure that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. As at the date of signature, **one single natural person** has access to production data. **4.4 Security.** Implement the technical and organisational measures described in **Annex 2**, in accordance with Article 32 GDPR. **4.5 Sub-processing.** Engage sub-processors only under the conditions of Article 5. **4.6 Assistance with data subject rights.** Assist the Customer, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests to exercise data subject rights (Articles 12 to 23 GDPR). The service interface allows the Customer to access, export and delete data on its own. If a data subject contacts the Provider directly, the Provider shall not respond on the substance and shall forward the request to the Customer within **five (5) business days**. **4.7 Assistance to the Customer.** Assist the Customer in complying with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of the processing and the information available to it. **4.8 Breach notification.** Notify the Customer of any personal data breach **within forty-eight (48) hours** of becoming aware of it, by email to the account contact address, describing the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken. **4.9 Deletion or return at the end of the contract.** At the Customer's choice, expressed no later than termination: delete all data or return it in a structured, machine-readable format and then destroy existing copies. Failing an express choice, the data shall be **deleted within thirty (30) days** of the end of the contract, save for any retention obligation imposed by applicable law. Encrypted backups are purged on their normal cycle, which does not exceed **thirty-five (35) days**. **4.10 Information and audits.** Make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR and allow for audits. In practice: the Provider answers a written security questionnaire **once a year**, within thirty (30) days; a further documentary audit may be requested in the event of a confirmed breach or a documented requirement of a supervisory authority, on thirty (30) days' notice, once a year at most, at the Customer's expense and subject to confidentiality. **4.11 Records.** Maintain a record of the categories of processing activities carried out on behalf of the Customer (Article 30(2) GDPR). ### Article 5 — Sub-processors 5.1 The Customer gives the Provider a **general written authorisation** to engage the sub-processors listed in **Annex 3**. 5.2 The Provider shall inform the Customer of any intended addition or replacement of a sub-processor **at least thirty (30) days in advance**, by email and by publication at https://subtraq.co/en/legal/privacy. The Customer may object on reasonable and documented data protection grounds within that period. If the objection is maintained, the Customer may terminate the affected part of the service without charge or penalty and obtain a pro rata refund of the unused paid period. 5.3 The Provider shall impose on each sub-processor, by contract, the same data protection obligations as those set out in this Agreement. It **remains fully liable** to the Customer for the performance of their obligations. ### Article 6 — Transfers outside the European Union 6.1 Data entrusted by the Customer is **stored exclusively within the European Union** (Germany). No copy is created outside the Union. 6.2 As the Provider is established in the United States, **its access to the data from the United States constitutes a transfer** within the meaning of Chapter V GDPR. That transfer is governed by the **Standard Contractual Clauses** of Commission Implementing Decision (EU) 2021/914 of 4 June 2021, incorporated by reference in **Annex 4**, with the following specifications: - **Module Two** (controller to processor) where the Customer acts as controller; **Module Three** (processor to processor) where the Customer itself acts as processor; - **Clause 7** (docking clause): applicable; - **Clause 9**: Option 2, general written authorisation, thirty (30) days' notice; - **Clause 11**: the optional independent dispute resolution body is **not selected**; - **Clause 17**: Option 2 — the governing law is that of the Member State in which the Customer is established; - **Clause 18(b)**: the competent courts are those of that same Member State; - Annexes I, II and III to the Standard Contractual Clauses correspond respectively to **Annexes 1, 2 and 3** of this Agreement. 6.3 **Update clause.** The Parties acknowledge that the European Commission has announced a dedicated set of Standard Contractual Clauses for importers whose processing is directly subject to the GDPR under Article 3(2), and that this set had not been adopted as at the date of signature. Upon its adoption, the Parties undertake to substitute it for the clauses in Annex 4 by way of a simple amendment **within six (6) months**. In the meantime, the clauses in Annex 4 apply to the extent that they strengthen the protection of data subjects. 6.4 **Public authority requests.** If the Provider receives a binding request from a public authority, including a judicial authority, of a third country concerning the Customer's data, it shall: (a) inform the Customer as soon as possible, unless legally prohibited; (b) challenge the request where there are reasonable grounds to consider it unlawful; (c) disclose only the **minimum** information required; (d) document the request and the response given and keep that documentation available to the Customer and the competent supervisory authority. As at the date of signature, the Provider **has received no such request**. ### Article 7 — Liability Each Party is liable for damage caused by processing which infringes the GDPR, in accordance with Article 82 GDPR. The limitations of liability agreed in the Terms of Service apply to this Agreement, **except** as regards the rights of data subjects as third-party beneficiaries under the Standard Contractual Clauses, which cannot be limited. ### Article 8 — Term This Agreement takes effect upon signature and remains in force for the duration of the service contract, and thereafter until Article 4.9 has been fully performed. ### Article 9 — Governing law and jurisdiction This Agreement is governed by the law of the **Member State in which the Customer is established**. The courts of that Member State have exclusive jurisdiction. This provision is adopted for consistency with Clause 17 of the Standard Contractual Clauses and does not deprive the Customer of any right to bring proceedings before the courts of its domicile. **Signed on** ______________, in two counterparts or electronically. | For the Provider | For the Customer | |---|---| | GAM Communication LLC | ____________________ | | Andrea Guddelmoni, *Member* | Name: ______________ | | | Title: ______________ | --- ## Annex 1 — Description of the processing (= Annex I to the SCCs) ### A. List of Parties **Data exporter**: the Customer, identified at the head of the Agreement. Relevant activities: measuring the performance of marketing campaigns by means of tracked links. Role: controller (or processor, as ticked). **Data importer**: GAM Communication LLC, 1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, United States — contact@subtraq.co — Article 27 representative in the Union: ☐ _(completed on signature)_. Relevant activities: provision of the Subtraq tracked-link and analytics service. Role: processor. ### B. Description of the transfer | | | |---|---| | **Subject matter** | Provision of a link shortening, redirection and measurement service | | **Nature of the processing** | Collection, recording, organisation, structuring, storage, consultation, statistical aggregation, making available through an interface and an API, erasure | | **Purpose** | Enabling the Customer to measure the reach and performance of its campaigns and to attribute conversions | | **Duration** | Term of the service contract, then erasure in accordance with Article 4.9 | | **Categories of data subjects** | Visitors clicking on a link created by the Customer; where applicable, leads and customers of the Customer identified by it through the `lead()` and `identify()` functions | | **Categories of personal data** | Link identifier; timestamp; **country** (derived from the IP address in memory, the IP address **never being written**); device type (derived from the User-Agent); referrer **hostname** only, excluding the path; UTM parameters; bot flag; click identifier stored in the `localStorage` of the Customer's domain; and, if and only if the Customer voluntarily sends them through the SDK or API: a lead's email address, an internal user identifier, a sale amount and currency | | **Special categories** | **None.** The service is not designed to process data falling under Article 9 or 10 GDPR, and the Customer undertakes not to send any | | **Frequency** | Continuous, in real time | | **Retention** | Individual click records: **13 months**. Statistical aggregates that do not allow re-identification: no time limit. Data sent via `lead()` / `identify()`: for the life of the account, erasable by the Customer at any time | | **Sub-processors** | See Annex 3 | ### C. Competent supervisory authority The supervisory authority of the Member State in which the Customer is established. Where the Customer is not established in the Union, the authority of the Member State in which its Article 27 representative is established. --- ## Annex 2 — Technical and organisational measures (= Annex II to the SCCs) **Encryption and transport** - All communications are encrypted in transit (HTTPS/TLS). - Session tokens are stored in `httpOnly` cookies, inaccessible to JavaScript. - API keys are never stored in clear text: only their SHA-256 fingerprint is retained. **Hosting and access** - Server and database located in **Germany** (Hetzner Online GmbH). - Dedicated database, **not publicly exposed** to the internet. - Administrative server access via **SSH with a dedicated key**; as at the date of signature, **one single natural person** has such access. - Logical separation of data between customer accounts: no account's data is reachable from another account. **Backups and continuity** - **Daily encrypted backups**, purged on a cycle not exceeding 35 days. **Minimisation by design** — structural measures, not mere undertakings: - The **IP address is never written to the database**: it is read in memory to derive the country and detect bots, then discarded. - **No device fingerprinting** is computed. - **No third-party cookies**: the SDK uses first-party `localStorage` on the Customer's domain. - Only the referrer **hostname** is retained; the full path, which may contain personal data, is discarded. - No cross-device tracking beyond what the Customer explicitly identifies. **Organisation** - Breach notification to the Customer within 48 hours (Article 4.8). - Logging of administrative access. - Record of the categories of processing carried out on behalf of the Customer (Article 30(2)). **Measures applicable to sub-processors**: contractual flow-down of the same obligations, and verification that storage remains hosted within the Union. --- ## Annex 3 — Authorised sub-processors (= Annex III to the SCCs) | Sub-processor | Role | Place of processing | Scope | |---|---|---|---| | **Hetzner Online GmbH** (Germany) | Hosting of the application server and database | Germany (EU) | **All** data entrusted by the Customer | | **Cloudflare, Inc.** (United States) | Edge redirection network, DDoS protection, key-value cache | Global network, including outside the EU | Data contained in the **standard HTTP request** (headers, link URL). The replicated link directory contains **no identifying data** (no email, no IP) | | **Amazon Web Services EMEA SARL** (Amazon SES) | Technical delivery of transactional emails | Ireland (EU) | Email addresses of the **Customer's account** — outside the data entrusted under this Agreement | | **Stripe** | Subscription payment and invoicing | EU / United States, under Standard Contractual Clauses | Billing data of **the Customer itself** — outside the data entrusted under this Agreement | > The "Plumail" service mentioned in the privacy policy is an **internal service of GAM Communication LLC**, operated from the same German servers; it is not a third-party sub-processor. Its only technical sub-processor, Amazon SES, is listed above. --- ## Annex 4 — Standard Contractual Clauses The Parties adopt in full, by reference, the Standard Contractual Clauses for the transfer of personal data to third countries annexed to **Commission Implementing Decision (EU) 2021/914 of 4 June 2021**, published in the *Official Journal of the European Union* L 199, 7 June 2021, p. 31, the authentic text of which is available at: **https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj** The applicable module, selected options, governing law, courts and annex mapping are set out in **Article 6.2** of the Agreement. By signing the Agreement, the Parties are deemed to have signed the Standard Contractual Clauses as so completed. ---