Business superintelligence that acts.
Data Processing Addendum:
Our obligations as your processor.
This addendum is part of the Terms of Service for every customer whose Customer Data includes personal data protected by the GDPR, the UK GDPR, the Swiss FADP, the CCPA or a similar law. It applies without a signature. A countersigned copy is available on request from [email protected].
In plain words
You are the controller of the personal data in your connected accounts. Adella is your processor and handles it only on your instructions, which are these terms and what you do in the application.
We keep it confidential, keep it secure, tell you within 72 hours of a breach, help you answer requests from the people it is about, use only the subprocessors on the published list, and delete it when you leave.
For data from the EEA, the UK and Switzerland, the Standard Contractual Clauses and the UK Addendum are built in.
1. Definitions
Words defined in the Terms of Service have the same meaning here. Data Protection Law means every law that applies to the processing of personal data under this agreement, including the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA), and other US state privacy laws. Personal data, controller, processor, data subject, personal data breach and processing have the meanings given in Data Protection Law. Customer Personal Data means personal data within Customer Data. SCCs means the Standard Contractual Clauses approved by the European Commission in Decision 2021/914. UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.
2. Roles
For Customer Personal Data, you are the controller (or a processor acting for your own client, in which case you confirm the client's instructions and authority) and Adella is the processor. For the personal data of your users as account holders, and for website visitors, Adella is a controller under the Privacy Policy. Under the CCPA, Adella is a service provider to you.
3. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Adella service: reading connected accounts, finding and pricing problems, producing plans, drafts and reports, applying approved changes, keeping the record. |
| Duration | The term of the agreement, plus the deletion period in section 11. |
| Nature and purpose | Collection, storage, analysis, generation of text and images, and deletion, for the purpose of providing the service to you and for no other purpose. |
| Types of personal data | Users: name, business email, role, sign-in and activity records. Your customers (through a connected store or email marketing account): name, email address, shipping region, order history, discounts and refunds. Your contacts (through a connected mailbox, calendar or CRM): name, email address, company, the content of messages and events in the threads you work with, notes and promises. Ad-platform data: audience and performance figures, which are aggregated and do not ordinarily identify a person. |
| Categories of data subject | Your users and staff; your customers and prospects; your clients' staff, customers and prospects on the agency path; your contacts. |
| Special categories | None are required by the service. You agree not to connect data sources that are intended to carry special-category data. |
4. Instructions
Adella processes Customer Personal Data only on your documented instructions: the Terms of Service, this addendum, the settings and approvals you make in the application, and any written instruction you give that is consistent with them. If we believe an instruction breaks Data Protection Law we tell you, and we may stop until it is resolved. If the law requires us to process the data for another reason, we tell you before we do, unless the law forbids it.
5. Confidentiality
Everyone at Adella who can access Customer Personal Data is bound by a written duty of confidentiality and receives data protection training. Access is limited to the people who need it for their work, and is logged.
6. Security
Adella keeps the technical and organizational measures described on the Security page, which forms Annex II of this addendum, and does not reduce them during the term. In summary: separation of every customer's data at the data layer; role-based access checked on the server; encryption in transit and at rest; encrypted daily backups; individual accounts with multi-factor authentication for production access; an audit record of every change and every staff access; monitoring; and a tested incident process.
7. Subprocessors
You give general authorization for Adella to use the subprocessors on the subprocessor page, which states what each one receives and where it is. Each subprocessor is bound by a written contract with obligations no less protective than this addendum, and Adella remains responsible for their performance.
Before adding or replacing a subprocessor we update the page and email account holders at least 30 days in advance. If you object on reasonable data protection grounds within that period, we will work with you to resolve it; if we cannot, you may end the agreement for the affected service and we refund any prepaid fees for the remaining period.
8. Requests from data subjects
If a data subject writes to Adella about Customer Personal Data, we tell you promptly and do not answer on your behalf except to say that you are the controller, unless you instruct us otherwise. The application lets you find, export, correct and delete data about a person yourself; where it does not, we help you within the time the law allows you, at no charge for reasonable requests.
9. Personal data breaches
Adella tells you of a personal data breach affecting Customer Personal Data without undue delay and in any case within 72 hours of confirming it, with what is known: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, the measures taken, and a contact. We update you as we learn more and help you meet your own notification duties. A notification is not an admission of fault.
10. Assistance
Taking into account the nature of the processing and the information available to us, Adella helps you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority. Reasonable assistance is free; work that goes beyond it is at our then-current rates, agreed in advance.
11. Return and deletion
You can export Customer Data at any time during the term. When an account is disconnected or the agreement ends, Adella deletes the Customer Personal Data from production within 30 days (to confirm) and from backups when the backup window of 30 days (to confirm) ends, unless the law requires us to keep part of it, in which case we keep only that part, only for that purpose, and tell you. On request we confirm deletion in writing.
12. Audits
Adella makes available the information needed to show compliance with this addendum: the Security page, the subprocessor list, the security pack, and the summaries of any third-party assessments we obtain. Once in any twelve months, or after a breach, you may audit Adella's compliance, by a written questionnaire first and, where that does not resolve the question, by an inspection by you or an independent auditor bound by confidentiality, on 30 days' notice, during business hours, without disrupting the service or exposing other customers' data. Each side bears its own costs.
13. International transfers
Customer Personal Data is processed in the United States. For data from the European Economic Area, the SCCs (Module Two, controller to processor, or Module Three where you are a processor) are incorporated into this addendum, with Adella as data importer and you as data exporter; clause 7 (docking) applies; option 2 of clause 9 (general authorization, 30 days' notice) applies; the optional wording in clause 11 does not apply; clause 13 and the governing law and forum in clauses 17 and 18 refer to Ireland; Annex I is section 3 of this addendum and Annex II is the Security page. For data from the United Kingdom, the UK Addendum applies to the SCCs, with the tables completed by the information in this addendum. For data from Switzerland, the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner. Adella does not rely on the EU-US Data Privacy Framework unless this page says it is certified. We assess, and tell you about, any law of the destination country that would stop us meeting these clauses, and we challenge access requests from public authorities where the law allows.
14. CCPA service provider terms
Adella is your service provider. We do not sell or share Customer Personal Data, do not retain, use or disclose it for any purpose other than providing the service under the agreement, do not use it outside the direct business relationship with you, and do not combine it with personal data from other sources except as the CCPA allows a service provider to. We tell you if we can no longer meet these obligations, and you may take reasonable steps to stop and remedy unauthorized use. We give the same obligations to our subprocessors.
15. Liability and precedence
Each party's liability under this addendum, including under the SCCs where they allow it, is subject to the limitations in the Terms of Service. Where this addendum conflicts with the Terms, this addendum prevails for the processing of Customer Personal Data; where the SCCs conflict with either, the SCCs prevail.
16. Term
This addendum lasts as long as Adella processes Customer Personal Data, and the obligations in sections 5, 11 and 15 continue after that.
17. Contact
Data protection matters, and a countersigned copy of this addendum with the SCC annexes completed: [email protected].
Business superintelligence that acts.
Free to start. One Adella account for every app.