Data Processing Addendum

This Data Processing Addendum (“DPA”) is between the customer that holds an Affiliate Manager account (“Customer”, the controller) and Andria Labs LLC, the operator of Affiliate Manager (“we”, “us”, the processor). Where the Customer is itself a processor for another controller, we are its subprocessor, and the Customer passes on its controller’s instructions to us.

It applies to personal data we process on the Customer’s behalf in providing the Service (“Customer Personal Data”) and is governed by the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), and other data protection laws to the extent they apply (together, “Data Protection Law”). It does not cover data we process as a controller for our own purposes, such as account and billing data about the Customer’s own users; our Privacy Policy covers that.

Subject matter: providing the Affiliate Manager service under the Terms: running the Customer’s affiliate program, attributing referrals, calculating and recording commissions, supporting payouts, and (if the Customer uses it) finding and contacting potential affiliates with the AI Affiliate Recruiter.

Duration: for the term of the Customer’s account, plus the deletion period in section 10.

Nature and purpose: collection, storage, organisation, retrieval, calculation, transmission (including by email), and deletion, carried out only to provide the Service and as further described in Annex 1.

Categories of data subjects and personal data: see Annex 1.

We process Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s use and configuration of the Service are the Customer’s complete instructions. We will tell the Customer if we believe an instruction breaks Data Protection Law, and we may decline to follow it. If law requires us to process Customer Personal Data otherwise, we will inform the Customer first unless the law prohibits it.

The Customer is responsible for having a lawful basis for the processing it instructs, including for contacting prospects through the AI Affiliate Recruiter, and for the information it gives data subjects.

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, and gets access only as far as needed to run and support the Service.

We implement the technical and organisational measures in Annex 2, which are designed to meet GDPR Article 32. We may update them as long as the overall level of protection does not decrease.

The Customer gives general authorisation for us to use subprocessors. The current list, with each provider’s purpose and location, is at /subprocessors. We will add a new subprocessor to that page at least 30 days before it starts processing Customer Personal Data. The Customer may object on reasonable data-protection grounds by emailing privacy@affiliatemanager.us within that period; if we cannot reasonably accommodate the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the remaining period.

We impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible to the Customer for their performance.

• Data subject requests: the Service lets the Customer view, correct and delete the personal data it holds, and export sales and payout records as CSV; for other data, we will provide a machine-readable copy on request to privacy@affiliatemanager.us. If we receive a request about Customer Personal Data directly, we will pass it to the Customer without undue delay and not answer it ourselves, except to confirm we have forwarded it or where the request is an opt-out from recruiting email, which we honour immediately (section 8).
• Impact assessments and consultations: we will give the Customer reasonable information about the Service to help it carry out a data protection impact assessment or consult a supervisory authority.

When someone opts out of recruiting email sent through the Service, we add their email address to a suppression list that blocks recruiting email to them from every Affiliate Manager customer. We keep that list as an independent controller, on the basis of our legitimate interest in making sure an opt-out is respected, and keep it for as long as needed to do so.

We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will go to the account owner’s email address and will describe, as far as we then know them, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. We will supply further information as it becomes available and take reasonable steps to contain the breach.

The Customer can export its sales and payout records from the Service at any time, and we will provide a machine-readable copy of its other Customer Personal Data on request before deletion. When the account is deleted, we delete Customer Personal Data from our live systems within 30 days; copies in our providers’ backups expire within a further 30 days. We keep data longer only where law requires it, and then only for that purpose.

On written request, no more than once a year (or after a personal data breach or a supervisory authority’s request), we will provide the information reasonably necessary to show compliance with this DPA, including written answers to a security questionnaire and our subprocessors’ available certifications or audit reports. If that information is not enough to meet the Customer’s obligations under Article 28, we will allow an audit by an independent auditor bound by confidentiality, at the Customer’s cost, on reasonable notice and in a way that does not disrupt the Service or expose other customers’ data.

We and most of our subprocessors are in the United States. For transfers of Customer Personal Data from the European Economic Area that are not covered by an adequacy decision (such as the EU-U.S. Data Privacy Framework for a certified recipient), the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. For those Clauses:

• the optional docking clause (Clause 7) applies;
• Clause 9(a) Option 2 (general written authorisation, with the 30-day notice in section 6) applies;
• the optional language in Clause 11 does not apply;
• for Clauses 17 and 18, the Clauses are governed by the law of Ireland and disputes go to the courts of Ireland;
• Annex I is completed by section 2 and Annex 1 of this DPA, and Annex II by Annex 2;
• the competent supervisory authority is the one for the EU Member State where the Customer is established or, if it is not established in the EU, where its EU representative is.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0) is incorporated, with its tables completed by the information in this DPA; either party may end it as allowed by its Section 19. For transfers from Switzerland, the Clauses apply with references to the GDPR read as references to the FADP, the Swiss Federal Data Protection and Information Commissioner as the competent authority for those transfers, and “Member State” read to include Switzerland so that Swiss data subjects can bring claims there.

If this DPA and the Clauses conflict, the Clauses prevail.

Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the Clauses do not allow them. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

Data subjects. The Customer’s affiliates and affiliate applicants; people the Customer researches or contacts as potential affiliates (“prospects”); the Customer’s own buyers, as they appear in order data synced from connected platforms; people who click the Customer’s tracking links; and the Customer’s team members who use the Service.

Personal data.

• Affiliates: name, email, referral code, commission terms, notes, earnings, payouts, payout-account status, and any W-9 / W-8 tax form the Customer uploads (which may contain a taxpayer identification number and address)
• Prospects: name, email, public profile URL and channel, audience-size description, topic tags, fit score and reason, emails sent, and whether they replied or opted out (not the text of replies)
• Buyers: order id, amount, currency, product, coupon code and, where the platform provides it, the buyer’s email address
• Link clicks: a keyed hash of the IP address, browser user-agent, referring page, time, and fraud signals
• Team members: name, email and role

Special categories. None intended. The Customer should not put special category data in notes or other free-text fields.

Frequency. Continuous, for as long as the Customer uses the Service.

Retention. As described in the “How long we keep data” section of our Privacy Policy, and section 10 of this DPA.

Subprocessors. As listed at /subprocessors.

• Encryption in transit: all traffic to the website, app and API uses HTTPS with TLS 1.2 or higher.
• Encryption at rest: the database and file storage are encrypted at rest by our hosting and database providers. Credentials for connected platforms (API keys, tokens) are additionally encrypted by our application with AES-256-GCM, using a random IV for each value, before they are stored.
• Passwords: stored only as bcrypt hashes.
• Tax documents: kept in a private storage bucket and served only through signed links that expire after five minutes.
• Access control: every request for account data is authenticated, and data is scoped to the Customer’s organisation in the application layer. Production access is limited to the personnel who operate the Service.
• Data minimisation: we store a keyed hash of a clicking visitor’s IP address rather than the address; we do not store the text of replies to recruiting email; error reports are scrubbed of email addresses.
• Application security: a Content Security Policy with per-request nonces; signature checks on incoming webhooks; rate limiting on sensitive endpoints; input validation.
• Secure development: changes go through automated type checks, tests, dependency audits, secret scanning and static analysis (Semgrep, CodeQL) before deployment.
• Availability: daily backups of the database by our database provider; error monitoring and alerting.
• Incident response: security reports go to a monitored inbox, and personal data breaches are handled as described in section 9.
• Subprocessors: chosen for their security practices and bound by data protection terms.