Data Processing Agreement (DPA)

Processor: Opus Growth, a trading brand of Talat KOÇ, a sole proprietorship registered in Türkiye (Gökalp Tax Office). Contact: support@opus-growth.com

This Data Processing Agreement ("DPA") forms part of the Opus Growth Terms of Service (the "Agreement") and applies automatically to every customer who accepts them (the "Customer"). It governs the personal data Opus Growth processes on the Customer's behalf while providing the Opus Growth service (the "Service"). No separate signature is needed. If you need a countersigned copy for your records, write to support@opus-growth.com.

1. Definitions#

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 ("GDPR"). "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

2. Roles and scope#

• The Customer is the controller of the personal data described in Annex I and Opus Growth processes it as a processor. Where the Customer itself acts as a processor for its own client, Opus Growth acts as the Customer's sub-processor and the Customer confirms that its client has authorised this.
• The advertising and analytics platforms the Customer connects (such as Google, Meta, Microsoft, TikTok, LinkedIn and OpenAI's ChatGPT Ads) and the AI assistant the Customer uses the Service with (such as Anthropic's Claude or OpenAI's ChatGPT) provide their services to the Customer under the Customer's own agreements with them. They are not sub-processors of Opus Growth. Opus Growth exchanges data with them only on the Customer's instruction.
• This DPA does not cover data Opus Growth processes as an independent controller, such as account, billing and support data about the Customer's own users. That data is governed by our Privacy Policy.

3. Instructions#

Opus Growth processes personal data only on the Customer's documented instructions, including with regard to transfers, unless required to do so by applicable law, in which case it informs the Customer before processing unless the law prohibits this. The Agreement, this DPA and the Customer's use and configuration of the Service, including requests made through the Customer's AI assistant and approvals given in it, are the Customer's documented instructions. Changes to connected advertising accounts are applied only after the Customer has seen a preview and approved the change. Opus Growth informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection law.

4. Confidentiality#

Opus Growth ensures that every person it authorises to process the personal data is bound by an appropriate obligation of confidentiality and has access only to the extent needed to provide, secure and support the Service.

5. Security#

Opus Growth implements the technical and organisational measures described in Annex II. It may update them, provided that the overall level of security is not reduced.

6. Sub-processors#

• The Customer gives general authorisation for Opus Growth to engage the sub-processors listed in Annex III.
• Opus Growth updates Annex III on this page and informs Customers by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receives a pro rata refund of prepaid fees for the remaining term.
• Opus Growth imposes data protection obligations on each sub-processor that are no less protective than those in this DPA and remains responsible to the Customer for the performance of its sub-processors.

7. Assistance#

• Taking into account the nature of the processing, Opus Growth assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. If Opus Growth receives such a request directly, it forwards it to the Customer without undue delay and does not respond itself unless instructed.
• Opus Growth assists the Customer, taking into account the information available to it, in meeting its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations.

8. Personal data breaches#

Opus Growth notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer's personal data. The notification describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Opus Growth provides further information as it becomes available and takes reasonable steps to contain and remedy the breach.

9. Deletion and return#

When the Service ends, or earlier on the Customer's request, Opus Growth deletes the Customer's personal data within 30 days, unless retention is required by law. Disconnecting a platform deletes the stored access token for that platform immediately. Deleted data leaves Opus Growth's encrypted backups as they rotate, within at most 12 months, and is not restored from them except to recover the Service. Before deletion the Customer can export the data available in the Service through its AI assistant or panel.

10. Information and audits#

Opus Growth makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and this DPA. The Customer agrees to first request this information in writing, for example through a security questionnaire, which Opus Growth answers within a reasonable time. If the information is not sufficient, the Customer, or an independent auditor bound by confidentiality, may carry out an audit once in any 12 month period, or after a personal data breach, with at least 30 days' notice, during business hours, in a way that does not disrupt the Service or compromise the security or confidentiality of other customers' data, and at the Customer's own cost.

11. International transfers#

• Opus Growth hosts the Customer's personal data in the European Union, in Germany and Finland (Annex III).
• Opus Growth is established in Türkiye, so access to the personal data from Türkiye may constitute a transfer to a third country. To the extent the GDPR applies to such a transfer, the parties enter into the SCCs, which are incorporated into this DPA by reference: Module Two (controller to processor), or Module Three (processor to processor) where the Customer acts as a processor, with the Customer as data exporter and Opus Growth as data importer.
• For the SCCs: Clause 7 (docking clause) applies; under Clause 9(a), Option 2 (general written authorisation) applies with the 30 day notice period in section 6; the optional wording in Clause 11 does not apply; under Clause 13, the competent supervisory authority is the one determined under Annex I.C; under Clause 17, the SCCs are governed by the law of the EU Member State in which the Customer is established, provided that law allows for third-party beneficiary rights, and otherwise by the law of Ireland; under Clause 18, disputes are resolved by the courts of that same Member State. Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.
• Opus Growth transfers personal data to a sub-processor outside the European Economic Area only where an adequacy decision or another transfer mechanism under Chapter V GDPR applies.

12. Liability, term and precedence#

• Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where such limitations are not permitted by the GDPR or the SCCs.
• This DPA applies for as long as Opus Growth processes personal data on the Customer's behalf.
• In the event of a conflict, the SCCs prevail over this DPA, and this DPA prevails over the Agreement.

Annex I: Description of the processing#

A. Parties. Data exporter: the Customer, as controller (or processor, see section 2), using the Service to manage its own or its clients' digital advertising and analytics. Data importer: Opus Growth, as identified above, as processor (or sub-processor), providing the Service.

B. Description of the processing.

• Data subjects: the Customer's own staff who use the Service; people whose data is held in the advertising and analytics accounts the Customer connects, such as people who submitted a lead form and people on customer lists uploaded for audience targeting or conversion measurement; visitors to the Customer's websites where the Customer installs the Opus Growth click protection tag or hosts a website on Opus Growth.
• Personal data: names, email addresses and phone numbers in lead form submissions and customer lists, often as one-way hashes; online identifiers such as click IDs, IP addresses and browser information; conversion and engagement data; contact and form data on websites the Customer hosts on Opus Growth; names and email addresses of the Customer's users.
• Special categories of data: none are intended. The Customer must not use the Service to process special categories of personal data.
• Frequency: continuous, for as long as the Customer uses the Service.
• Nature of the processing: reading data from the connected platforms when the Customer or its AI assistant requests it; structuring and summarising it; transmitting it to the AI assistant and reports the Customer chooses; making changes in the connected platforms after the Customer approves them; storing the limited data described below; hosting websites where the Customer uses AI Server.
• Purpose: providing the Service under the Agreement.
• Retention: advertising and measurement data is read from the platform when requested and is not kept as a full copy. Opus Growth keeps only what a feature needs, such as the latest report summaries, report links the Customer shares and data cached for Data Studio for up to 30 minutes, and deletes it with the account. Click protection records are kept for 90 days. Access tokens are kept until the platform is disconnected or the account is deleted. Section 4 of the Privacy Policy gives the full list.
• Sub-processors: as listed in Annex III, for the same nature, purpose and duration.

C. Competent supervisory authority. The supervisory authority of the EU Member State in which the Customer is established or, where the Customer is not established in the EU, the supervisory authority of the Member State in which its representative under Article 27(1) GDPR is established.

Annex II: Technical and organisational measures#

• Encryption in transit: all access to the Service, its API and the connector uses HTTPS with TLS.
• Encryption at rest: access and refresh tokens and API keys for connected platforms are stored encrypted with authenticated symmetric encryption (Fernet), with support for key rotation. Backups are encrypted before they leave the server.
• Data minimisation: advertising data is read on request and not copied in full; only the summaries a feature needs are stored.
• Hosting: servers at Hetzner data centres in Germany, with a continuously replicated read-only standby database and encrypted backups in Finland.
• Access control: administrative access to servers only with SSH keys from authorised machines, behind firewalls; database replication over a private network; least privilege for staff.
• User authentication: sign-in with Google, or with a password plus a one-time code sent by email; one-time codes are valid for 15 minutes and can be used once; users can review and revoke connected AI applications from the panel.
• Change control in customer accounts: every change to a connected advertising account is shown as a preview and applied only after explicit approval; budget changes are limited per change and per 24 hours; all actions are recorded in an activity log the Customer can review.
• Isolation of hosted websites: each AI Server runs in its own isolated container with resource limits, restricted outbound network access and a read-only base system.
• Availability and resilience: zero-downtime deployments with health checks, a hot standby database and regular, monitored backups with tested restores.
• Monitoring and incident response: service health and errors are logged with personal content masked, and personal data breaches are handled as described in section 8.
• Deletion: account deletion within 30 days, immediate deletion of tokens on disconnect, and backup rotation within 12 months.

Annex III: Sub-processors#

• Hetzner Online GmbH (Germany): servers, database, website hosting, standby database and backups. Location: Falkenstein, Germany and Helsinki, Finland. Transfer mechanism: none needed, processing within the EU.
• Cloudflare, Inc. (USA): network delivery, TLS termination and protection against attacks for the website, the panel and the connector (data in transit). Location: Cloudflare's global network; each request is handled at the data centre nearest to the visitor. Transfer mechanism: EU-US Data Privacy Framework and SCCs.
• Google LLC / Google Ireland Limited: Google Workspace email for service messages such as report links and notifications. Location: EU and USA. Transfer mechanism: EU-US Data Privacy Framework and SCCs.