This Data Processing Agreement (hereinafter, “DPA”) is entered into between the customer who has contracted the services of boostiQ (hereinafter, “the Controller”) and IMPACTIQ, S.L. (hereinafter, “the Processor”), and forms an integral part of the Terms and Conditions of Service.
7.1. Purpose
This DPA governs the processing of personal data carried out by the Processor on behalf of the Controller as a result of the provision of the boostiQ Service, in accordance with Article 28 GDPR. In particular, when the Controller connects its advertising platform accounts (Meta Ads, Google Ads, LinkedIn Ads) or analytics accounts (Google Analytics 4) and the Processor accesses that data in order to provide the Service.
7.2. Nature, purpose and duration of the processing
- Purpose: to provide the Controller with the digital marketing campaign analysis, recommendation and execution services described in the Terms.
- Nature: reading, analysis, temporary storage and, where authorised by the Controller, execution of changes to the connected accounts.
- Categories of data: advertising identifiers, campaign metrics, audiences, creative content, conversion data and, where applicable, aggregated personal data of the Controller’s end users.
- Categories of data subjects: the Controller’s end users, and the Controller’s leads and customers.
- Duration: for as long as the Service contract between the Controller and the Processor remains in force.
7.3. Obligations of the Processor
The Processor undertakes to:
- Process the personal data only in accordance with the instructions of the Controller, unless required to do so by law.
- Ensure that the persons authorised to process the data have committed themselves to confidentiality.
- Adopt the appropriate technical and organisational measures provided for in Art. 32 GDPR: encryption in transit and at rest, access control, backups, activity logging.
- Assist the Controller, by means of appropriate technical and organisational measures, so that it can fulfil its obligation to respond to requests from data subjects.
- Assist the Controller in ensuring compliance with the obligations relating to security, breach notification and impact assessments.
- Notify the Controller of any personal data breach without undue delay and, in any event, within a maximum of 48 hours of becoming aware of it.
- At the choice of the Controller, return or delete all personal data after the end of the provision of the Service.
- Make available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allow for reasonable audits, with a minimum of 30 days’ notice.
7.4. Authorised sub-processors
The Controller gives general authorisation for the subcontracting of the following services, listed in the Privacy Policy (section 2.5). The Processor will give at least 30 days’ notice of any substantial change to the list of sub-processors, giving the Controller the opportunity to object.
7.5. International transfers
Where the processing involves transfers outside the European Economic Area, the Processor will guarantee the existence of a legitimate mechanism in accordance with Chapter V GDPR: standard contractual clauses, an adequacy decision or equivalent.
7.6. Confidentiality and return of data
Upon termination of the contract, the Processor will return to the Controller or delete all personal data processed, within a maximum of 30 days, unless applicable legislation requires its retention.
7.7. Liability
The Processor shall be liable to the Controller for damages caused by breach of the obligations of this DPA and of the GDPR, within the limits provided for in the Terms.
Last updated: 6 May 2026
For customers who require a DPA with specific clauses or a handwritten signature, please contact [email protected].
