Legal / Data processing· template
Draft data processing terms.
A design-stage template. It describes the intended obligations and requires counsel review.
01 / ROLES
Who processes what.
For advertiser data, the customer is the controller and AdBid is a processor. For account and billing data, AdBid may be an independent controller.
| Data | Role | Purpose |
|---|---|---|
| Campaign and creative data | Processor | Execute and measure the campaign |
| Audience signals | Processor | Targeting where consent permits |
| Event and delivery data | Processor | Delivery, billing, evidence |
| Account and billing | Controller/processor | Service operation and billing |
02 / OBLIGATIONS
Intended commitments.
These clauses describe the target contract; they are not in force until executed.
Subprocessors
A current list is maintained and published before onboarding, with purpose, location, and data categories. New subprocessors are notified in advance with an objection right for enterprise customers.
Transfers
Cross-border transfers use an approved mechanism, with a documented data residency option where offered.
Security
Encryption in transit, access control, tenant isolation, logging, vulnerability management, and tested incident response.
Breach
Notification without undue delay after confirmation, with scope, affected categories, containment, and remediation.
Deletion
Deletion on termination subject to legal retention. Backups age out on a documented schedule.
Audit
Enterprise customers may review security documentation and, by agreement, audit reports or on-site controls.