Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Zenox Marketing Management - FZCO (“Scaley”, the processor) and the customer (“Customer”, the controller) using the Scaley AI service. It applies whenever Scaley processes personal data on behalf of the Customer. The DPA is entered into automatically when a Customer creates a Scaley account and covers all personal data processed through Scaley during the term of the agreement.

Enterprise customers who require a countersigned copy can request one at hello@scaleyai.com.

1. Roles and scope

For personal data brought into Scaley by the Customer (for example, campaign data, product catalogs, or any personal data present in connected ad accounts), the Customer is the controller and Scaley is the processor. Scaley processes personal data only on documented instructions from the Customer, which include the Terms of Service, the Privacy Policy, this DPA, and the configuration the Customer sets inside the product.

2. Subject matter and duration

Subject matter: providing the Scaley service, including connecting to authorized platforms, generating recommendations, and executing automations the Customer enables.

Duration: for the term of the agreement, plus the deletion period in Section 9.

Nature and purpose: storage, hosting, analysis, and transmission of personal data to operate the service as configured by the Customer.

Types of personal data:contact data of the Customer's personnel, end-customer identifiers present in connected ad accounts (for example, customer match hashes, audiences, conversion events), and any other personal data the Customer chooses to send into Scaley.

Categories of data subjects: Customer's employees, contractors, and end customers whose data exists in the Customer's connected accounts.

3. Customer instructions

Scaley will process personal data only on documented instructions from the Customer, including to comply with a legal obligation. Scaley will inform the Customer if an instruction infringes applicable data protection law. The Customer is responsible for ensuring it has a lawful basis to share personal data with Scaley and that any required notices or consents have been obtained from data subjects.

4. Confidentiality

Scaley ensures that personnel authorized to process personal data are bound by confidentiality obligations and are trained on their data protection responsibilities.

5. Security

Scaley implements and maintains appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. Current measures include encryption in transit (TLS) and at rest, least-privilege access controls, access logging and audit, secure software development practices, regular security reviews, and vendor security assessments. Scaley updates these measures over time in line with the state of the art. A current summary is available on request.

6. Sub-processors

The Customer gives general authorization for Scaley to engage sub-processors to support the service. Scaley maintains a current list of sub-processors at scaleyai.com/sub-processors. Scaley will give the Customer at least thirty (30) days' prior notice of any intended addition or replacement of a sub-processor. The Customer can reasonably object by notifying Scaley at hello@scaleyai.com. If the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of any prepaid fees for unused time.

Scaley enters written agreements with each sub-processor that impose data protection obligations no less protective than those in this DPA. Scaley remains liable to the Customer for the performance of its sub-processors.

7. International transfers

Where personal data is transferred out of the European Economic Area, the United Kingdom, or Switzerland, the parties rely on appropriate safeguards, including the European Commission Standard Contractual Clauses (Module 2, controller to processor; Module 3, processor to processor as applicable), the UK International Data Transfer Addendum, and the Swiss addendum. By accepting this DPA the parties agree to these clauses as incorporated by reference. Scaley will provide copies on request and will work with the Customer on any transfer impact assessment where required.

8. Data subject requests

Scaley will assist the Customer, taking into account the nature of the processing, to respond to data subject requests to exercise their rights under applicable data protection law. Scaley will promptly forward any request it receives directly from a data subject to the Customer and will not respond on the Customer's behalf without instruction.

9. Return and deletion

On termination of the agreement, Scaley will, at the Customer's choice, delete or return all personal data it holds on behalf of the Customer, except where retention is required by law. Deletion will happen within ninety (90) days of termination and includes all copies except encrypted backups that are overwritten in the normal backup cycle within the same period.

10. Breach notification

Scaley will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting the Customer's personal data. The notice will include the available facts, the likely consequences, and the measures taken or proposed.

11. Audit

Scaley will make available to the Customer, on reasonable request and no more than once per year (unless a supervisory authority or a qualifying incident requires otherwise), information necessary to demonstrate compliance with this DPA. Where needed, the Customer may conduct an audit through an independent third-party auditor subject to confidentiality obligations and mutually agreed scope, timing, and cost. Scaley's SOC 2 reports and completed security questionnaires, when available, are deemed to satisfy this obligation to the extent they address the matter under review.

12. Conflict and term

If there is a conflict between this DPA and the Terms of Service, this DPA controls with respect to the processing of personal data. This DPA terminates when the agreement terminates, except that obligations that by their nature should survive (including Sections 5, 9, and 10) survive.

13. Contact

Privacy and DPA contact: hello@scaleyai.com. Legal notices: hello@scaleyai.com.