Back to Adtool.io

Data Processing Agreement

Last Updated: July 27, 2026

Download / Print PDF

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Adtool ApS ("Adtool", "we", "us", "Processor") and the customer ("Customer", "you", "Controller") using Adtool.io services.

By using Adtool.io, you automatically agree to this DPA. You may download or print this document for your records.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person as defined in applicable Data Protection Laws.
• "Data Protection Laws" means the General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable data protection legislation.
• "Controller" means the entity that determines the purposes and means of Processing Personal Data. In the ordinary case this is the Customer, but see clause 2.1, where the Customer may instead act as a processor on behalf of its own clients, in which case Adtool acts as a sub-processor.
• "Processor" means the entity that Processes Personal Data on behalf of the Controller (Adtool).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Sub-processor" means any third party engaged by Adtool to Process Personal Data on behalf of the Customer.
• "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
• "Security Incident" means a Personal Data Breach.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914.
• "DPF" means the EU-U.S. Data Privacy Framework.
• "Services" means the Service as defined in the Terms of Service.

2. Roles, Scope and Instructions

2.1 Relationship of the Parties

In the context of this DPA:

• You (Customer) are the Controller of Personal Data processed through Adtool.io
• Adtool is the Processor, processing Personal Data on your behalf to provide the Services
  

If you use Adtool to manage advertising for your own clients (e.g., as an agency or freelancer), you act as Controller or, where you process your clients' Personal Data on their behalf, as their Processor, in which case Adtool acts as your sub-processor. You warrant that you have the authorizations and agreements with your clients necessary to engage Adtool and to give the instructions in this DPA, and you remain responsible for compliance with Data Protection Laws in your relationship with your clients.

The terms of this DPA are the data protection terms on which Adtool acts, including where Adtool acts as a sub-processor. Where the Customer's agreement with its own client imposes obligations more onerous than those set out in this DPA, the Customer must notify Adtool in writing in advance, and Adtool is not bound by those obligations unless it has expressly agreed to them in writing.

2.2 Subject Matter and Purpose

Adtool processes Personal Data solely to provide the Services. The details of the processing, its subject matter, duration, nature and purpose, the types of Personal Data, and the categories of data subjects, are set out in Annex I.

2.3 Instructions

This DPA, the Terms of Service, and the Customer's use of the Services' features constitute the Customer's complete and documented instructions to Adtool regarding the Processing of Personal Data. Additional instructions require prior written agreement between the parties.

3. Obligations of Adtool (Processor)

Adtool agrees to:

• Process on Instructions: Process Personal Data only on your documented instructions, including with regard to international transfers, unless required to do so by Union or Member State law to which Adtool is subject (in which case Adtool will inform you of that legal requirement before processing, where legally permitted)
• Unlawful Instructions: Immediately inform you if, in Adtool's opinion, an instruction infringes the GDPR or other applicable data protection provisions
• Confidentiality and Personnel: Ensure that persons authorized to process Personal Data are bound by contractual or statutory confidentiality obligations, and limit access to Personal Data to personnel who need it to provide the Services
• Security: Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as set out in Annex II
• Sub-processors: Not engage another processor without your authorization (see Section 5)
• Assistance: Assist you in responding to data subject requests and ensuring compliance with your obligations under Data Protection Laws
• Deletion: On termination, delete or return Personal Data in accordance with Section 9 (Data Retention and Deletion), at your choice, subject to any legal retention requirements
• Audit: Make available all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Adtool may satisfy audit requests by providing relevant documentation and third-party reports (e.g., security certifications or penetration-test summaries). Any on-site audit is subject to reasonable notice, confidentiality, no more than once per year (absent a Personal Data Breach or regulator requirement), during business hours, and at the Customer's cost
• DPIAs and Consultations: Provide reasonable assistance to you with data protection impact assessments and any prior consultations with supervisory authorities, taking into account the nature of processing and the information available to Adtool

4. Obligations of Customer (Controller)

You agree to:

• Ensure you have a lawful basis for processing Personal Data through Adtool
• Provide clear instructions regarding the processing of Personal Data
• Comply with all applicable Data Protection Laws in your use of Adtool
• Ensure that any data you upload or process through Adtool is collected lawfully
• If you are an agency or freelancer, ensure you have appropriate agreements with your own clients

5. Sub-processors

5.1 Authorized Sub-processors

You grant Adtool general authorization to engage the sub-processors identified in Annex III (which incorporates the current list published at https://adtool.io/subprocessors) to assist in providing the Services. Adtool reviews each sub-processor's data protection practices and enters into a data processing agreement with each of them before any processing begins.

5.2 Changes to Sub-processors

We maintain the current list of authorized sub-processors at https://adtool.io/subprocessors (incorporated into this DPA by Annex III). We will update that list at least 14 days before a new sub-processor begins processing Personal Data; publication of the updated list constitutes notice of the change, and you are responsible for checking the page. You may object on reasonable data-protection grounds within 14 days of the update. If we cannot reasonably accommodate your objection, you may terminate your account. Your continued use of the Services after the 14-day period without objection constitutes acceptance of the new sub-processor.

5.3 Sub-processor Terms and Liability

Where Adtool engages a sub-processor, Adtool will impose data protection obligations on that sub-processor that are no less protective than those set out in this DPA, by way of a written contract. Adtool remains fully liable to you for any acts or omissions of its sub-processors that result in a breach of this DPA.

6. International Data Transfers

Personal Data is stored in the United States (Supabase) and processed by sub-processors in the US and EU, as listed in Annex III. Where Personal Data is transferred from the EU/EEA to the United States, Adtool relies on the following safeguards:

• DPF-certified recipients: For recipients certified under the EU-U.S. Data Privacy Framework, the transfer is based on the recipient's DPF certification.
  
• Non-certified recipients: For recipients not certified under the DPF, the transfer is based on the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 (Module Three: processor to processor), which are incorporated into Adtool's written agreement with the relevant sub-processor.
• The safeguard applying to each sub-processor is indicated in the sub-processor list referenced in Annex III (https://adtool.io/subprocessors).
• Fallback: If the DPF is invalidated, or a recipient's DPF certification lapses, the transfer will instead be based on the Standard Contractual Clauses, as incorporated in the recipient's data processing agreement or otherwise implemented by Adtool without undue delay.

7. Security Incidents

7.1 Notification

In the event of a Security Incident, a Personal Data Breach as defined in Section 1, affecting your data, Adtool will notify you without undue delay and, where feasible, not later than 72 hours after becoming aware of the incident.

7.2 Incident Information

The notification will include, to the extent known:

• A description of the nature of the incident

• Categories and approximate number of data subjects affected

• Likely consequences of the incident

• Measures taken or proposed to address the incident

7.3 Cooperation

Adtool will cooperate with you and provide reasonable assistance in investigating the incident and meeting your notification obligations to supervisory authorities and data subjects.

8. Data Subject Rights

Adtool will assist you in responding to requests from data subjects exercising their rights under Data Protection Laws, including:

• Right of access

• Right to rectification

• Right to erasure

• Right to restriction of processing

• Right to data portability

• Right to object

If Adtool receives a request directly from a data subject, we will promptly forward it to you unless legally prohibited from doing so.

9. Data Retention and Deletion

Upon termination of your account, your data is kept intact for 90 days, unless you request earlier deletion, so that you can export or request the return of your Personal Data, or reactivate your account. At the end of this 90-day window, Adtool will delete your Personal Data, except where Adtool is required to retain data it holds as an independent controller (for example, billing records under the Danish Bookkeeping Act).

If you request deletion of your account and data, deletion will be carried out within 90 days of your request, or within such shorter period as you reasonably require to meet your own obligations under Data Protection Laws. Adtool will delete your Personal Data from its production systems, including cached data derived from connected platforms such as Meta, and will procure the deletion of Personal Data processed on Adtool's behalf by the sub-processors listed in Annex III. Once deleted, your data cannot be restored and your account cannot be reactivated. Database backups are retained for 7 days on a rolling basis, so data deleted from our production systems is removed from any remaining backups within 7 days of deletion. Creative assets in file storage are not included in database backups; they are deleted at the same time as the rest of your data and are not retained in any backup. Unsubscribing from marketing communications is not a request to delete your account or data.

To request data deletion, contact: support@adtool.io

10. Liability

Each party's liability under this DPA is subject to, and counts towards, the limitations of liability set forth in the Terms of Service. Nothing in this DPA increases or creates liability beyond the cap stated in the Terms of Service.

11. Term and Termination

This DPA remains in effect for as long as Adtool processes Personal Data on your behalf. This DPA survives termination of your Adtool account until Adtool has deleted or returned all Personal Data in accordance with Section 9 (Data Retention and Deletion).

12. Governing Law

This DPA is governed by Danish law. Any disputes arising from this DPA shall be resolved by the competent courts of Denmark.

13. Contact Information

For questions about this Data Processing Agreement:

Adtool ApS
Vallensbækvej 63, 2625 Vallensbæk, Denmark
CVR: 45752577
Email: hello@adtool.io

To exercise data protection rights or request deletion, contact support@adtool.io (see Section 9).

Acceptance: By using Adtool.io services, you confirm that you have read, understood, and agree to this Data Processing Agreement.

Annex I: Details of Processing

Subject matter: The provision of the Services, Adtool's advertising workflow platform, to the Customer.

Duration: The duration of the Customer's use of the Services, plus the retention period set out in Section 9.

Nature and purpose of processing: Processing necessary to provide the Services, currently including:

• Managing advertising campaigns on the Customer's behalf (currently via the Meta (Facebook/Instagram) Marketing API)
• Storing and organizing creative assets (images, videos)
• Synchronizing data with the Customer's connected platforms (currently Meta and Google Drive)
• Providing analytics and reporting on campaign performance, including caching of aggregated performance data
• Providing customer support

Categories of data subjects:

• The Customer's employees and team members who use Adtool
• The Customer's clients (if the Customer is an agency managing campaigns on their behalf)
• Third parties whose public business identity is stored, including the Facebook Pages, Instagram accounts and partner brands that the Customer manages on behalf of its own clients (name, handle, follower count and profile image)

Types of Personal Data:

• Account information (name, email address)
• Authentication data (OAuth tokens for connected platforms)
• Ad account and business manager data
• Campaign and ad set configurations
• Creative assets and metadata
• Usage data and activity logs
• Support conversations
• Aggregated ad performance data (cached)
• Public page and profile identity data (names, handles, profile images)

Annex II: Technical and Organizational Measures

• Encryption: All data is encrypted in transit (TLS) and at rest at the infrastructure level
• Authentication: Email/password, magic-link, and OAuth sign-in, with two-factor authentication (TOTP) enforced by the application once enrolled
• Access Controls: Role-based access controls; production data access is restricted to a small, allowlisted group with audit-logged administrative access
  
• Log retention: operational and debug logs are retained for 90 days and are then deleted.

• Tenant Isolation: Application-level tenant isolation enforced on every API route, backed by database row-level security (RLS) policies

• Infrastructure: Data stored on Supabase servers (US), with transfers safeguarded by Standard Contractual Clauses (see Section 6)

• Token Security: OAuth tokens are protected by infrastructure-level encryption at rest, strict access controls, and audit-logged administrative access; field-level token encryption is on our security roadmap

• Monitoring: Regular security monitoring and updates

Annex III: Authorized Sub-processors

Adtool's current authorized sub-processors, including each sub-processor's purpose, location, and the transfer safeguard applying to it, are listed at https://adtool.io/subprocessors. That list forms part of this DPA. Changes to the list are handled as described in Section 5.2; publication on that page constitutes notice of changes.

Note on integrations: The Meta integration operates on the Customer's own ad accounts and business assets, under the Customer's own agreements with Meta Platforms Ireland Ltd (or the Meta entity applicable to the Customer). Meta is therefore not engaged by Adtool as a sub-processor; Adtool accesses the Customer's Meta assets on the Customer's behalf using the Customer's authorization. The Google Drive integration, and, once launched, the Microsoft OneDrive integration, likewise operates on the Customer's own account; in that context Google or Microsoft acts as the Customer's processor, not as Adtool's sub-processor for file contents. Analytics and marketing tags managed via Google Tag Manager, on our website and in the platform, operate in Adtool's own capacity as controller, are consent-based, and are described in our Privacy Policy; they do not involve sub-processing of Customer Personal Data under this DPA.

Download / Print PDF