Data processing agreement

1. Roles

For the personal data in your connected ad accounts, the analytics you connect, the sales you send to your ad networks and the visitor data of the click shield (together, customer personal data), you are the controller and Zinn Digital® is your processor. Where you act for a client, you confirm that you have the client's authority to instruct us.

For your Zinn Digital® account, billing and our own websites, we are the controller and our privacy policy applies instead of this agreement.

2. Subject matter, duration, nature and purpose

The subject matter is providing Zinn® Ads to you. The processing lasts for as long as you use Zinn® Ads, plus the deletion periods in section 13.

The nature of the processing is collecting through the ad networks' and analytics APIs, storing, analysing, changing your ad accounts on your instructions, sending conversions to your ad networks, preparing invalid-click claims, reporting and deleting. The purpose is to manage and protect your advertising as you instruct.

3. Types of personal data

Depending on the features you use, customer personal data can include:

• Ad account data: account and campaign settings, keywords, ads, search terms, audience lists and performance figures, and the names and e-mail addresses of the users of your ad accounts.
• Analytics data you connect, such as Google Analytics figures, which are normally aggregated.
• Conversion data: sales or sign-ups you send to your ad networks, with the click ID and the order value, and any identifiers the network needs to match them, hashed where the network requires it.
• Customer lists you choose to upload to an ad network, hashed as the network requires.
• Click-shield data about the visitors who click your ads: IP address, browser details, the ad's click ID, the time, the page and the referring page, and signs of automated behaviour.
• Messages and settings you or your team enter in Zinn® Ads.

4. Categories of data subjects

Your customers and prospects, the visitors who click your ads, the people in the audience lists you upload, and your staff, clients and agencies who use your ad accounts or Zinn® Ads.

5. Our instructions

We process customer personal data only on your documented instructions. Your instructions are these terms, your settings in Zinn® Ads, the changes you approve and the kinds of change you allow on autopilot. We tell you if we think an instruction breaks data protection law.

We do not sell customer personal data, use it for our own purposes, or use it to train AI models. The one exception is the anonymous fraud signal described in our privacy policy: a one-way code and a reason, which cannot be turned back into an address or linked to you.

6. Confidentiality

Everyone we authorise to process customer personal data is bound by a duty of confidentiality, and access is limited to the people who need it to run or support Zinn® Ads.

7. Security measures

We keep technical and organisational measures appropriate to the risk, including:

• Encryption of all data in transit with TLS.
• Separation of every customer's data, enforced in the database with row-level security.
• Ad network access tokens encrypted and kept in a secrets vault, never in our code or logs.
• Least-privilege staff access, with every change Zinn® Ads makes and every staff action logged.
• Monitoring and a defined process for detecting and handling security incidents.
• Backups, and deletion of click-shield data when its claim window ends.

8. Sub-processors

You give us general authorisation to use sub-processors. Each one is bound by a written contract with data protection obligations no less protective than this agreement, and we remain responsible to you for their work.

These are the sub-processors that process customer personal data for Zinn® Ads:

9. Changes to sub-processors

Before a new sub-processor starts processing customer personal data, we update this list and e-mail the account owner, so you can object on reasonable data protection grounds. If we cannot resolve an objection, you can end the affected part of the service.

10. International transfers

Where customer personal data is transferred outside the UK or the European Economic Area, we rely on an adequacy decision where one applies, such as the EU-US and UK-US data frameworks for certified providers, or otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914) and the UK International Data Transfer Addendum, with additional safeguards where needed.

Where you are in the EEA and we are in the UK, the UK's adequacy decision under the EU GDPR covers transfers to us. Where the law requires Standard Contractual Clauses between you and us, Module 2 (controller to processor) is incorporated into this agreement by reference.

11. Data subject requests

We help you answer requests from data subjects to access, correct, delete, restrict, move or object to their data, through the tools in Zinn® Ads and by assisting you where we can. If a data subject asks us directly, we pass the request to you and do not answer it ourselves unless you instruct us or the law requires it.

12. Personal data breaches

If we become aware of a personal data breach affecting customer personal data, we tell you without undue delay, and no later than 48 hours after becoming aware of it. We give you what we know about its nature, the data and people affected, its likely consequences and the measures taken, so you can meet your own duties to notify a supervisory authority and data subjects.

13. Assistance

Taking into account the nature of the processing and the information available to us, we help you with your duties on security, data protection impact assessments and prior consultation with a supervisory authority.

14. Deletion and return

When you disconnect an ad account, we delete the data we hold for it. When your use of Zinn® Ads ends, we delete customer personal data within 30 days, unless the law requires us to keep it. You can export your reports and change history before then.

Copies in backups are deleted as the backups expire. Anything the law requires us to keep stays protected under this agreement until it is deleted.

15. Audits

We make available the information reasonably needed to show that we meet this agreement, and we allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits are on reasonable notice, at a reasonable frequency and under confidentiality, so that other customers' data stays protected. We may meet a request with our documentation and security descriptions first.

16. Liability and precedence

Each party's liability under this agreement is subject to the limits in the Zinn® Ads terms of service, except where the law does not allow it to be limited.

If this agreement conflicts with the terms of service on customer personal data, this agreement applies. If it conflicts with Standard Contractual Clauses that apply, the clauses apply.

Text for your privacy notice (click shield)

If you use the click shield, add text like the following to your website's privacy notice, and adjust it to your own website. Replace [your company] with your name.

Fraud prevention for our ads: when you reach our website by clicking one of our ads, [your company] uses Zinn® Ads, provided by Zinn Digital® Ltd, to detect invalid and fraudulent clicks. It processes your IP address, browser details, the ad's click ID, the time, the page you visit and the page you came from, and signs of automated behaviour.

We do this to protect our advertising from fraud, which is our legitimate interest (UK GDPR and EU GDPR Article 6(1)(f)). Zinn Digital® Ltd processes this data on our behalf. The data is kept only for the period in which an ad network accepts an invalid-click claim, and then deleted.

A source found committing click fraud may be recorded as an anonymous code that cannot be turned back into your IP address. You can object to this processing, or exercise your other rights, by contacting us.