Watchtower
Legal

Watchtower — Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the Terms of Service between adParagon, LLC ("Processor," "we") and the customer ("Controller," "you") for the Watchtower Service. It governs our processing of Personal Data on your behalf.

1. Definitions

Terms such as "Personal Data," "Processing," "Controller," "Processor," "Data Subject," "Supervisory Authority," and "Personal Data Breach" have the meanings in GDPR / UK GDPR; "Business," "Service Provider," "Sell," and "Share" have the meanings in the CCPA/CPRA. "Data Protection Laws" means all privacy and data-protection laws applicable to a party's processing.

2. Roles and scope

2.1 You are the Controller (or Business) and we are the Processor (or Service Provider) of the Personal Data contained in Customer Data. Where you are yourself a processor for another controller, we are a sub-processor and these terms apply accordingly.

2.2 CCPA. We are a Service Provider. We will not (a) sell or share Personal Data; (b) retain, use, or disclose it except to perform the Service, for a permitted business purpose, or as allowed by law; (c) retain, use, or disclose it outside our direct business relationship with you; or (d) combine it with data from other sources except as permitted for a Service Provider. We certify we understand and will comply with these restrictions.

3. Processing instructions

3.1 We will process Personal Data only on your documented instructions, including as set out in the Terms, this DPA, and your configuration and use of the Service (such as enabling the reputation network), and as required by law (in which case we will inform you unless legally prohibited).

3.2 We will inform you if, in our opinion, an instruction infringes Data Protection Laws.

4. Confidentiality and personnel

We ensure that personnel authorized to process Personal Data are bound by confidentiality and are trained on their obligations, and we limit access on a need-to-know basis.

5. Security

We implement appropriate technical and organizational measures to protect Personal Data as described in Annex II, including encryption in transit, access controls and least-privilege, peppered HMAC hashing of network identifiers, logging and monitoring, and secure development practices, taking into account the state of the art, the costs, and the risk.

6. Sub-processors

6.1 You provide general authorization for us to engage sub-processors to provide the Service. Our current sub-processors are listed on request (contact privacy@watchtowerhq.ai) and include, as of the effective date: Supabase (database/hosting), Render (application hosting), Resend (email), Stripe (billing), Sumsub (business verification).

6.2 We will impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.

6.3 We will give you at least 30 days' notice of any new or replacement sub-processor (via email to privacy@watchtowerhq.ai). If you reasonably object on data-protection grounds, we will work in good faith to resolve it; if we cannot, you may terminate the affected Service.

7. Data-subject requests

Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures, insofar as possible, to respond to data-subject requests. If we receive such a request directly, we will (unless legally prohibited) direct the data subject to you.

8. Personal Data Breach

We will notify you without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach affecting your Personal Data, provide the information reasonably available to us, and take reasonable steps to mitigate and remediate.

9. Data protection impact assessments

We will provide reasonable assistance with your data-protection impact assessments and prior consultations with Supervisory Authorities, taking into account the nature of processing and the information available to us.

10. International transfers

Where our processing involves transfer of Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Module Two: Controller-to-Processor, or Module Three where we act as sub-processor), completed as set out in Annex III, and the UK International Data Transfer Addendum and Swiss amendments as applicable, which are incorporated by reference.

11. Deletion and return

On termination, we will, at your choice, delete or return Personal Data within 30 days, and delete existing copies except to the extent retention is required by law or the data has been irreversibly de-identified (including hashed reputation signals, which do not identify a data subject). For the reputation network, an erasure request reverses the influence of the relevant contribution.

12. Audits

We will make available information reasonably necessary to demonstrate compliance with Article 28 of GDPR and allow for and contribute to audits, including by providing our most recent third-party reports or certifications (where available) and responding to reasonable written questionnaires. On-site audits are limited to once per 12 months, on reasonable notice, subject to confidentiality, and at your expense absent a confirmed material breach.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations of liability in the Terms. In the event of conflict on data-protection matters, this DPA (and the SCCs) prevail over the Terms.

Annex I — Description of processing

  • Subject matter: provision of the Watchtower fraud-detection Service.
  • Duration: the term of the Terms, plus any retention period in Section 11.
  • Nature and purpose: ingesting traffic events; evaluating them for fraud/quality; returning verdicts, scores, and metrics; optional cross-tenant reputation signaling; support and security.
  • Types of Personal Data: IP addresses; device and advertising identifiers; user-agent and device attributes; event metadata (timestamps, offers, sub-source IDs); and, for account administration, business contact details of your personnel. The Service is not designed to receive special-category data, and you agree not to submit it.
  • Categories of data subjects: your end users (e.g., publisher/app users whose traffic you evaluate) and your authorized personnel.
  • Frequency: continuous, per your use of the Service.

Annex II — Technical and organizational security measures

Encryption of data in transit (TLS); access controls, authentication, and least-privilege; peppered HMAC hashing of identifiers used in the reputation network and k-anonymity thresholds before any signal is readable; network segmentation and secrets management; logging, monitoring, and anomaly detection; secure SDLC and dependency management; backup and recovery; personnel confidentiality and training; vendor due diligence.

Annex III — Standard Contractual Clauses details

Module(s): Two (Controller-to-Processor); Module Three where we act as sub-processor. Clause 7 docking: not used. Clause 9 sub-processor option: Option 2 (general authorization), 30 days. Clause 11 independent redress: no. Clause 17 governing law: Ireland. Clause 18 forum: Ireland. Annexes to the SCCs are populated by Annexes I–II above. Executed SCCs and the UK Addendum are available on request.

Contact for data-protection matters: privacy@watchtowerhq.ai · adParagon, LLC · 217 Cedar Street #254, Sandpoint, ID 83864