Data Processing Agreement

1. Parties and roles

The customer is controller for its project data. CENTRO PUBLICIDAD ELECTRÓNICA ESPAÑA, S.L., as operator of DigitalPublic, is processor when handling that data on the customer's behalf. This DPA forms part of the SaaS terms while a subscription or legally required post-service processing remains in effect.

2. Subject, duration, and purpose

DigitalPublic processes data to host the portal, connect providers, execute authorized queries and operations, generate content and reports, maintain CRM and communications, provide support, bill, protect the service, and retain auditability. Processing lasts for the relationship and periods needed for return, deletion, security, and legal obligations.

3. Data and data subjects

• Customer user, employee, contractor, and contact data.
• Lead, end-customer, audience, campaign, content, analytics, communication, and activity data.
• Technical identifiers, permissions, audit records, and connection metadata.
• Special categories must not be uploaded without sufficient agreement and legal basis.

4. Instructions and confidentiality

DigitalPublic processes data according to documented customer instructions, including instructions through the portal, API, or authorized agent. An instruction that infringes law may be suspended and reported. Authorized personnel are bound by confidentiality.

5. Technical and organizational measures

• Account and project isolation, role and scope controls.
• Provider credentials encrypted at rest and encrypted transport.
• Human approval, auditability, revocation, quotas, and module limits.
• Backups, technical monitoring, vulnerability and incident management proportionate to risk.
• Separation of public content from private customer data.

6. Subprocessors and transfers

The customer gives general authorization for subprocessors listed at /en/subprocessors. DigitalPublic will impose equivalent obligations where applicable and remains responsible for selection. International transfers will use an adequacy decision, Standard Contractual Clauses, or another valid mechanism when required.

7. Rights, assessments, and audit

DigitalPublic will provide reasonable assistance for data subject rights, impact assessments, and authority consultations. It will make available information needed to demonstrate compliance and permit proportionate, coordinated, confidential audits that do not compromise other customers.

8. Incidents

DigitalPublic will notify the customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf, providing available information and reasonable updates.

9. Return and deletion

At service termination, the customer may request reasonable export. DigitalPublic will return or delete data at the customer's choice unless law requires retention or limited isolated backups remain.

10. Model training

The public search=yes, ai-input=yes, and ai-train=yes permission applies only to public content accessible without authentication. It does not authorize training on private account, project, lead, campaign, credential, or audit data.