# Data Processing Addendum

> How Roasby processes personal data in your ad accounts on your behalf, under GDPR, UK GDPR and US state privacy laws.

This Data Processing Addendum ("DPA") is part of the [Terms of Service](/terms) between the customer that holds a Roasby workspace ("Customer", "you") and **Anesthesia Zone, LLC**, doing business as Roasby ("Roasby", "we"). It applies automatically when you accept the Terms; no signature is needed. If you need a countersigned copy, email legal@roasby.com.

## 1. Definitions

"Data Protection Laws" means the laws that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act ("CCPA"). "Customer Personal Data" means personal data in Customer Data (as defined in the Terms) that we process on your behalf. "Controller", "processor", "data subject", "personal data breach", "processing" and "service provider" have the meanings given in the Data Protection Laws.

## 2. Roles and scope

- You are the controller (or a processor acting for your client, in which case we are your subprocessor), and we are your processor (and service provider under the CCPA) for Customer Personal Data.
- For account, billing, support and website data, we act as an independent controller under our [Privacy Policy](/privacy); this DPA does not apply to that data.
- The details of the processing are in Annex 1.

## 3. Your instructions

We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and the actions you, your workspace members and your connected AI assistants take in the Service. We will tell you if we believe an instruction breaks Data Protection Laws. You are responsible for having a lawful basis for the processing and for the instructions you give.

## 4. Our obligations

We will:

- process Customer Personal Data only to provide, secure and support the Service, and not sell, share for cross-context advertising, retain, use or disclose it for any other purpose, or combine it with other data except as the Data Protection Laws allow;
- ensure that people authorized to process it are bound by confidentiality;
- implement the technical and organizational measures in Annex 2 and keep them at least at that level;
- help you, taking into account the nature of the processing, to respond to data subject requests, carry out data protection impact assessments and consult supervisory authorities;
- notify you without undue delay, and in any case within **72 hours**, after becoming aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need to meet your own obligations;
- not use Customer Personal Data to train AI models.

## 5. Subprocessors

- You give general authorization for us to use subprocessors. The current list is at [/subprocessors](/subprocessors).
- We will impose data protection obligations on each subprocessor that are at least as protective as this DPA, and we remain responsible for their performance.
- We will update the list at least **30 days** before a new subprocessor starts processing Customer Personal Data (except in an emergency to keep the Service running, when we will notify you as soon as possible). You can ask to be notified by email at privacy@roasby.com.
- You may object on reasonable data protection grounds within 30 days of the update. We will then work with you in good faith on a solution; if none is found, you may end the affected part of the Service and receive a refund of prepaid fees for the remaining period.

## 6. International transfers

Customer Personal Data is hosted in Germany and Finland and may be accessed or processed in the United States, Egypt and the other countries listed on the subprocessors page. To the extent that a transfer from the EEA, the UK or Switzerland requires it:

- the **EU Standard Contractual Clauses** (Commission Implementing Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this DPA by reference, with you as data exporter and us as data importer; clause 7 (docking) applies; option 2 of clause 9 (general authorization, with the notice period in section 5) applies; the optional wording in clause 11 does not apply; clauses 17 and 18 select the law and courts of Ireland; and Annexes 1 and 2 of this DPA complete the Annexes of the Clauses;
- for transfers from the UK, the **UK International Data Transfer Addendum** issued by the Information Commissioner is incorporated, completed with the information in this DPA, and either party may end it as allowed by its section 19;
- for transfers from Switzerland, the Clauses apply with the Swiss Federal Data Protection and Information Commissioner as competent authority and Swiss law references where required.

Where a subprocessor is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), we may also rely on that certification.

## 7. Audits

We will make available the information reasonably needed to show compliance with this DPA, by answering security questionnaires and providing summaries of our measures, at most once a year unless there has been a breach or a supervisory authority requires more. If that information is not enough to meet a legal requirement, you may conduct an audit at your own cost, with 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.

## 8. Deletion and return

You can export your data from the Service while your workspace is active. When a workspace is deleted, or the Terms end, we delete Customer Personal Data within 30 days, except copies in encrypted backups, which are deleted as the backups rotate (within about 7 months), and data we must keep by law, which we will continue to protect under this DPA. Deleting your account deletes your personal workspace and any workspace you own with no other members. A workspace you own with an admin passes to its longest-standing admin, who becomes its owner, and its Customer Personal Data stays in that workspace.

## 9. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the Data Protection Laws do not allow it. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

## Annex 1: Details of processing

- **Parties:** Customer (data exporter, controller or processor) and Anesthesia Zone, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States, privacy@roasby.com (data importer, processor).
- **Subject matter and purpose:** providing the Roasby service: syncing connected ad accounts, reporting, carrying out the changes the Customer confirms, keeping the change log, in-app AI features, and support.
- **Nature of processing:** collection through ad platform APIs, storage, organization, analysis, display, transmission to the ad platforms and to the AI assistants the Customer connects, and deletion.
- **Categories of data subjects:** the Customer's workspace members, and individuals whose data appears in ad accounts, such as the Customer's clients, contacts, and people in customer lists or ad content.
- **Categories of personal data:** names, email addresses and other contact details in ad accounts and audience lists (usually hashed by the platforms), account identifiers, and the actors recorded in the change log. No special categories of data are intended.
- **Frequency:** continuous while the ad account is connected.
- **Duration:** for the term of the Terms, then deletion as in section 8.
- **Subprocessors:** as listed at [/subprocessors](/subprocessors).

## Annex 2: Technical and organizational measures

The measures described on our [Security page](/security), which are designed to provide a level of security appropriate to the risk but cannot guarantee absolute security, including:

- encryption in transit (TLS) and of tokens and secrets at rest, and encrypted backups;
- logical separation of each workspace's data, applied in queries and checked by automated tests;
- access control with two-factor authentication for administrators, least-privilege server accounts and an audit log;
- safety controls on changes (confirmation, paused-by-default creation, no deletes, guardrails, change log and revert);
- monitoring, alerting and an incident response process;
- secure development with automated tests, static analysis, dependency audits and security reviews;
- data minimization and automatic deletion after the retention periods in the Privacy Policy;
- confidentiality obligations for all personnel with access.