Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms an integral part of the Terms and Conditions of the Optimads platform and governs the processing of personal data in accordance with Regulation (EU) 2016/679 (“GDPR”), Art. 28, and Romanian Law No. 190/2018. It applies automatically to every Client using the Service.

1. Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in the GDPR. “Service” = the Optimads platform. “Sub-processor” = a third party that processes data on our behalf.

2. Subject matter and purpose

We process data exclusively to provide the Service contracted by the Client: conversion tracking (server-side and browser), attribution, reporting and sending events to the advertising platforms chosen by the Client, as well as the answers of the AI assistant (Finny) and the delivery of alerts on the channels chosen by the Client (email, WhatsApp, Telegram), which may contain data from the Client's ad accounts and stores. The operations include collection, recording, organisation, storage and erasure, in accordance with the Client's instructions.

3. Roles and responsibilities

• The Client = Controller — ensures the legal basis for collection (including visitors' consent before tracking) and the lawfulness of the data.
• Optimads = Processor — processes data only on the Client's documented instructions (the configuration in the platform) and informs the Client if an instruction infringes the GDPR.

4. Obligations of the Processor

• Confidentiality: persons with access to the data are bound by confidentiality.
• Appropriate security (see section 8).
• Assists the Client, as far as possible, in responding to data subjects' requests (access, erasure, etc.).
• Notifies security breaches (see section 10).

5. Data processed

Categories of data

• Identification data of buyers and visitors (email, phone, first name, last name, city, postcode, state/county, country and, if the site sends them, gender and date of birth) — sent to advertising platforms only as SHA-256 hashes. Hashing is pseudonymisation, not anonymisation: the data remain personal data.
• Technical identifiers: IP address, device/browser type, timestamps, cookie identifiers (e.g. fbc/fbp, ttclid), visitor IDs.
• Advertising behaviour and conversion data: events (PageView, ViewContent, AddToCart, Purchase), order value, order ID.
• Campaign and store data included in alerts and in the assistant's answers (campaign and account names, performance figures, aggregated orders).

Data subjects

Visitors and customers of the Client's stores/websites.

Storage period

For the duration of the contract. On termination, tracking data are deleted within at most 30 days (except for legal retention obligations). Server logs are kept for 7–30 days for diagnostics and security.

6. Sensitive data

The Service is not intended and must not be used to collect special categories of data (health, religion, political opinions, sexual orientation — Art. 9 GDPR).

7. Sub-processors and international transfers

The Client grants general authorisation for the use of the sub-processors below, which apply equivalent protection standards. We will announce changes at least 15 days in advance (by updating this page / by email); objections can be sent to contact@optimads.ai.

Transfers outside the EU/EEA take place with appropriate safeguards (Standard Contractual Clauses or adequacy decisions, including the EU-U.S. Data Privacy Framework for certified providers).

Telegram, if one of the Client's users chooses to connect it, delivers messages as an independent controller under its own terms; it is not our sub-processor.

8. Technical and organisational measures

• Role-based access control + authentication; tokens stored securely, never displayed or logged.
• Encryption in transit (HTTPS/TLS); identification data of visitors and buyers (email, phone, name, address) are sent to advertising platforms only as SHA-256 hashes.
• Logical isolation of data between clients (RLS), access logging.
• Infrastructure on providers with recognised certifications; testing before deployment.

9. Right to audit

On reasonable request, we provide the relevant security documentation. An on-site audit may be carried out with at least 14 days' notice, at most once a year, during business hours, without disrupting operations, subject to a confidentiality agreement, at the Client's expense.

10. Breach notification

We notify the Client without undue delay and within at most 72 hours of confirming a personal data breach, with the information available and the measures taken.

11. Deletion of data

On termination of the contract, we delete the data from active systems within at most 30 days. On request, we can provide a structured export (JSON/CSV) within 30 days. Data subjects can request erasure at any time (see also the Data deletion page).

12. Governing law

Romanian law applies. Disputes are settled amicably; failing that, the courts of Romania have jurisdiction.

13. Changes

We may update this DPA to reflect changes in processing or regulation; material changes are announced by publication on this page.

This English version is a translation provided for convenience; in case of discrepancy, the Romanian version prevails.