Data Processing Agreement

pursuant to Art. 28(3) GDPR

This Data Processing Agreement ("DPA") supplements the agreement between the Customer and HYPD for the use of the HYPD services under the HYPD Terms of Service (the "Main Agreement"). It is concluded between

the Controller: the Customer identified in the Customer's account or Order,

and

the Processor: HYPD Advertising Intelligence GmbH, Attilastraße 16, 12529 Schönefeld, Germany; commercial register Amtsgericht Cottbus, HRB 18651 CB; VAT ID DE458705751; managing directors Ionut Ciobotaru, Philip Mohr, Simon Schneckenberger ("HYPD"),

together the "Parties".

This DPA forms part of the Main Agreement and applies to every Customer automatically from the moment the Customer accepts the Terms of Service or starts using the Service. No signature is required. HYPD records the date, the accepting User and the version of this DPA accepted in the Customer's account and makes that record available on request. A countersigned copy, or a German version, is available on request from privacy@hypd.ai.

By concluding this DPA the Parties enter into a processing relationship under Art. 28 GDPR. Terms defined in the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") have the same meaning here. "Data" means personal data within the meaning of the GDPR. If this DPA and the Main Agreement conflict with respect to the processing of personal data, this DPA prevails.

§ 1 Subject matter and duration

1.1 This DPA applies to all processing of personal data arising from the Main Agreement, insofar as HYPD processes that data on behalf of the Controller. The subject matter of the Main Agreement is the provision of the HYPD platform, an AI co-pilot for performance marketers that connects to the Controller's advertising, analytics and measurement accounts to provide campaign analyses, audits, recommendations, reports and conversational answers, and, where the Controller has enabled Write Actions, to apply changes the Controller has explicitly approved. HYPD processes account, authentication, usage, security, billing and support data of the Controller's Users as an independent controller under its Privacy Policy; that processing is outside this DPA.

1.2 This DPA takes effect together with the Main Agreement, is ancillary to it, and remains in force for as long as HYPD processes personal data on the Controller's behalf. When the Main Agreement ends, this DPA ends automatically; no separate termination is required.

1.3 Either Party may terminate this DPA, and with it the processing relationship, without notice for good cause, in particular if the other Party seriously breaches this DPA or applicable data protection law. A serious breach by HYPD exists in particular where HYPD fails to comply with Art. 28 GDPR or this DPA, does not follow the Controller's instructions, refuses agreed audit rights, or omits mandatory or agreed security measures.

§ 2 Nature and purpose of processing

2.1 HYPD processes the personal data made available by the Controller, or accessible through the Controller's connected accounts, exclusively to fulfil its obligations under the Main Agreement and in accordance with the Controller's documented instructions. HYPD may not process personal data for its own or third parties' purposes, or disclose it to third parties without the Controller's prior instruction in text form.

2.2 The Controller instructs HYPD to aggregate and anonymise personal data processed under this DPA for the purposes set out in Section 7.3 of the Terms of Service, subject to the platform-specific limits stated there. Anonymisation is performed so that neither the Controller, its Users, its accounts nor any individual can be identified by HYPD or any third party with means reasonably likely to be used (Recital 26 GDPR), including by removing all account identifiers before aggregation and by aggregating only across no fewer than ten unrelated accounts. Once anonymised, the data is no longer personal data and HYPD may use it as its own data under Section 7.3 of the Terms of Service. HYPD does not train AI or machine learning models on personal data processed under this DPA, whether identifiable, aggregated or anonymised.

2.3 HYPD may copy or duplicate personal data only where the Controller has approved it, where it is strictly necessary to ensure proper processing (for example backups), or where required to comply with statutory retention obligations.

2.4 The specific processing operations within the meaning of Art. 4(2) GDPR, the types of personal data, the categories of data subjects and the purposes of processing are described in Annex 1, which forms part of this DPA.

2.5 Personal data is processed in member states of the European Union or the European Economic Area. Processing outside the EU/EEA takes place only in compliance with Art. 44 et seq. GDPR. The sub-processors used, and any third-country transfers, are listed in Annex 3.

§ 3 Types of personal data and categories of data subjects

The types of personal data processed by HYPD and the categories of data subjects are set out in Annex 1, which forms part of this DPA.

§ 4 Rights and obligations of the Controller

4.1 The Controller alone decides on the purposes and means of processing the personal data it provides or makes accessible through connected accounts.

4.2 The Controller is responsible for compliance with EU and national data protection law and with this DPA. In particular, the Controller is responsible for assessing the lawfulness of the processing (Art. 6 GDPR) and for ensuring that the rights of data subjects under Art. 12 to 22 GDPR are upheld. The Controller alone decides how to respond to data subject requests and communicates with data subjects.

4.3 The Controller may issue instructions to HYPD regarding the nature, scope and method of processing. Instructions are given in documented form, in writing or electronically; oral instructions must be confirmed in text form without delay. An instruction is any direction to HYPD on how to handle personal data. The use of the Service through its interfaces, the connection of accounts, the configuration of the Service, the connection of an AI assistant, and the approval of a Write Action by an authorised User each constitute documented instructions. Instructions may be given by Users with the owner or admin role in the Controller's account; the Controller keeps that list current. The Controller's general authorisation of the sub-processors in Annex 3 constitutes its instruction for the transfers listed there.

4.4 Data sets the Controller provides to HYPD, or makes accessible through connected accounts, remain the sole responsibility of the Controller. The Controller may at any time instruct HYPD to delete, rectify, return, adapt or restrict the processing of personal data.

4.5 The Controller notifies HYPD without delay of any errors or irregularities it notices in the results of the processing.

4.6 The Controller notifies HYPD without delay of any change of its data protection officer or data protection contact.

4.7 The Controller ensures that granting HYPD access to third-party advertising, analytics or measurement accounts (for example via OAuth) is compatible with the terms of use of the respective platform and with the legal basis for disclosing the data to HYPD.

4.8 Where the Controller uses HYPD through a third-party AI assistant of its choice (for example Claude or ChatGPT), the Controller contracts with the assistant's operator directly. Connecting an AI assistant is the Controller's documented instruction to transmit results, including Connected Platform Data, to that assistant (Art. 28(3)(a) GDPR); HYPD records the connection as proof of the instruction. HYPD only responds to requests sent by the assistant. The operator's role, as processor or independent controller, is determined by the Controller's agreement with it. The operator's processing of the conversation, including results HYPD returns into it, falls outside this DPA and is the Controller's responsibility. The Controller is advised to use business or enterprise plans with model training disabled.

4.9 Where the Customer uses the Service for its own clients (agency use), the Customer acts as processor for those clients and HYPD as sub-processor. The Customer warrants that each client has authorised the engagement of HYPD under Art. 28(2) GDPR, that the Customer's contract with the client permits the processing described in Annex 1, and that it passes on its clients' instructions to HYPD. In that case the obligations and rights of the Controller under this DPA apply to the Customer accordingly, and Annex 1 § 4 includes the staff, end users and customers of the Customer's clients.

§ 5 Obligations of HYPD

5.1 HYPD processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by EU or member state law to which HYPD is subject. In that case HYPD informs the Controller of the legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

5.2 HYPD deletes, rectifies, returns, adapts or restricts personal data when instructed by the Controller.

5.3 HYPD ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.4 HYPD implements all technical and organisational measures (TOMs) required under Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures implemented by HYPD are described in Annex 2, which forms part of this DPA.

5.5 The Controller gives general authorisation for HYPD to engage the sub-processors listed in Annex 3. These sub-processors are necessary to perform the Main Agreement. HYPD publishes all changes to its sub-processors at https://www.hypd.ai/subprocessors. HYPD informs the Controller of any intended addition or replacement of a sub-processor that processes personal data on the Controller's behalf at least 30 days in advance, by email to the account owner. The Controller may object within 14 days of the notice on reasonable data protection grounds. If the Parties cannot resolve the objection, the Controller may terminate the affected part of the Main Agreement with effect from the date the change takes effect, with a pro-rata refund of prepaid fees.

5.6 HYPD concludes with each sub-processor a contract that guarantees at least the same level of data protection as this DPA, taking into account all legal and contractual requirements, in particular the technical and organisational measures under Art. 32 GDPR. For transfers to third countries HYPD ensures that appropriate safeguards within the meaning of Art. 44 et seq. GDPR are in place, in particular the EU Standard Contractual Clauses in their current version.

5.7 If a sub-processor breaches its data protection obligations, HYPD is liable to the Controller for the sub-processor's performance. In that case the Controller may instruct HYPD to end the engagement of the sub-processor in whole or in part.

5.8 Taking into account the nature of the processing, HYPD assists the Controller with appropriate technical and organisational measures in fulfilling data subject rights under Chapter III GDPR within the statutory deadlines. If a data subject request is mistakenly addressed to HYPD and it is apparent that it should have been addressed to the Controller, HYPD forwards the request to the Controller without delay and notifies the Controller.

5.9 Taking into account the nature of the processing and the information available to it, HYPD assists the Controller in complying with the obligations under Art. 32 to 36 GDPR (security of processing, notification of personal data breaches to the supervisory authority, communication to data subjects, data protection impact assessment, prior consultation).

5.10 After the end of the services, and at the latest when the Main Agreement ends, HYPD deletes all personal data or returns it to the Controller, at the Controller's choice, and deletes existing copies, within 30 days, unless EU or member state law requires storage. Data obtained from LinkedIn is deleted within 10 days. During the term, and on request within 30 days after termination, HYPD provides an export of Output, account context and the Connected Platform Data it stores for the Controller, in a common machine-readable format. HYPD may retain the Write Actions change log for 12 months after the end of the Main Agreement as documentation of the instructions received (Art. 28(3)(a) and (h) GDPR), with access restricted to that purpose, after which it is deleted. HYPD may retain other documentation demonstrating proper processing in accordance with applicable retention periods.

5.11 HYPD makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audits take place no more than once per year, and additionally after a personal data breach affecting the Controller's data, at the request of a supervisory authority, where there are credible indications of non-compliance, to verify the remediation of earlier findings, or in urgent cases; in urgent cases the notice period may be shortened to what is reasonable in the circumstances. HYPD may first satisfy an audit request by providing its current security documentation, completed questionnaires and the audit reports or certifications of its sub-processors. On-site inspections require 30 days' notice and take place during business hours; the Controller bears its own costs. Audit rights are exercised only to a reasonable and necessary extent and in a manner that does not unreasonably disrupt HYPD's business operations.

5.12 HYPD informs the Controller without delay of serious disruptions of operations, where it believes an instruction infringes data protection law, of breaches by its employees or sub-processors, and of any other irregularities in the processing. HYPD may suspend the execution of an instruction it considers unlawful until the Controller confirms or amends it.

5.13 HYPD notifies the Controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach within the meaning of Art. 33 GDPR affecting the Controller's data, and assists the Controller in meeting its notification obligations.

§ 6 Confidentiality

The Parties undertake to treat all knowledge of each other's business secrets and data security measures as confidential and not to disclose it to third parties. This obligation survives the end of this DPA.

§ 7 Changes

Changes and additions to this DPA require text form to be effective. This also applies to changes to this clause. HYPD may update this DPA only where required by law, by a supervisory authority or by a change of sub-processors under § 5.5, with notice under Section 16 of the Terms of Service; other changes require the Controller's agreement in text form. Previous versions are available on request.

§ 8 Liability

8.1 The limitations of liability in Section 13 of the Terms of Service apply to all claims under this DPA, except where liability cannot be limited by law.

8.2 Each Party is liable towards data subjects under Art. 82 GDPR. Between the Parties, liability is allocated according to each Party's responsibility for the damage (Art. 82(5) GDPR).

8.3 Each Party indemnifies the other, within the limits of § 8.1 and to the extent legally permissible, against third-party claims and administrative fines based on a breach of data protection obligations attributable to the indemnifying Party.

§ 9 Governing law and jurisdiction

This DPA is governed by German law and the applicable law of the European Union, in particular the GDPR. Section 17.2 of the Terms of Service applies to the place of jurisdiction.

§ 10 Language

This DPA is provided in English and German. The English version is binding; the German version is a translation for convenience.

§ 11 Severability

If individual provisions of this DPA are or become wholly or partially invalid or unenforceable, the validity of the remaining provisions is unaffected; the statutory rule applies in place of the invalid provision.

This Annex describes the nature, scope and purpose of the processing of personal data under the Main Agreement. The basis is the use of the HYPD platform, an AI co-pilot for performance marketers.

1. Subject matter and purpose

HYPD provides the Controller with an AI co-pilot that connects to the Controller's advertising, analytics and measurement accounts (currently Google Ads, Google Analytics, Google Merchant Center, Google Search Console, Google Tag Manager, Meta Ads, LinkedIn Ads, Microsoft Advertising and TikTok for Business) and performs the following services exclusively on behalf of and in accordance with the instructions of the Controller:

• analysis of advertising accounts, campaigns, ad groups, keywords, ads and audiences;
• audits to identify optimisation potential, misconfigurations and wasted spend;
• optimisation recommendations and strategic insights based on campaign data;
• answering the Controller's questions about its accounts in conversational form, in the HYPD app or through an AI assistant the Controller has connected;
• reports, dashboards and benchmarks for the Controller's performance marketing;
• where the Controller has enabled Write Actions for an account: applying individual changes the Controller has explicitly approved, with a change log.

The purpose of the processing is to support and optimise the Controller's performance marketing activities. HYPD does not process personal data for its own purposes. The creation of aggregated and anonymised data takes place on the Controller's instruction under § 2.2 of this DPA, within the limits set by the Connected Platforms' terms as stated in Section 7.3 of the Terms of Service: no aggregation of Meta data, LinkedIn data only for reporting and benchmarks with the connecting account manager's consent, Google data only as permitted by the Google API Services User Data Policy. HYPD does not train AI or machine learning models on personal data processed under this DPA.

2. Nature of processing

Processing comprises in particular collecting, recording, storing, retrieving, consulting, using, structuring, analysing, disclosing by transmission (to the sub-processors listed in Annex 3, to an AI assistant the Controller has connected, and, for approved Write Actions, to the respective platform), restricting and erasing personal data.

Access to the Controller's accounts takes place through the interfaces (APIs) provided by the respective platforms with OAuth-based authorisation of the Controller's own Users. Read access is the default. Write access is used only to apply changes that an authorised User of the Controller has approved individually in the Service, acting under that User's own authorisation with the platform. Google Ads data is retrieved live for each request and is not cached.

Inputs and context data processed in the conversational interface are transmitted to the AI model providers listed in Annex 3 to the extent required to answer the request. These providers are operated in EU regions, are contractually prohibited from training on the data, and retain requests only transiently, for up to 30 days, for abuse monitoring under their EU terms.

Where the Controller accesses HYPD through a third-party AI assistant, the request is routed through that assistant's infrastructure under the Controller's own agreement with its operator (§ 4.8). That operator is not a sub-processor of HYPD. HYPD stores the requests received from the assistant as conversation history for 30 days and technical logs of the calls for 60 days.

3. Types of personal data

The HYPD platform is designed to process as little personal data as possible in normal operation. Depending on the configuration of the connected accounts and the Controller's use, the following categories of personal data may be processed:

• the identity of the Controller's Users as it appears in Customer Data, for example the approving User in the change log, the email address of the User who authorised a platform connection, or names entered in prompts (account, authentication, usage and billing data of Users are processed by HYPD as independent controller under its Privacy Policy and are outside this DPA);
• account and access data for connected accounts (account IDs, OAuth tokens, linked email addresses);
• campaign-related data and metrics (campaign, ad group and ad structures, keywords, creatives, budgets, bids, impressions, clicks, conversions, costs, KPIs);
• free-text fields such as search terms, URLs, ad texts and keywords as received from the platforms, which may occasionally contain personal data entered by third parties;
• aggregated audience and segment information as provided by the platforms through their APIs (for example demographic, geographic and device aggregates, audience names and sizes), without member-level data;
• content of conversational requests and responses (prompts, conversation history) and the account context set up by the Controller, insofar as the Controller or its staff enter personal data;
• the Write Actions change log (approving User, time, change details).

HYPD does not request user-level dimensions (such as analytics user or client IDs or click identifiers) and removes such fields before storage where an API response nevertheless contains them. HYPD does not access endpoints that return personal data of the Controller's customers or of third parties; in particular, HYPD does not retrieve lead form submissions or the members of Customer Match, custom or other audience lists.

Processing of special categories of personal data within the meaning of Art. 9 GDPR is not intended. The Controller will not enter such data into the HYPD platform.

4. Categories of data subjects

• staff and authorised Users of the Controller who use the HYPD platform;
• persons listed in the Controller's connected accounts as account owners, administrators or authorised users;
• end users and customers of the Controller, insofar as they are indirectly covered by aggregated campaign and audience data or by free-text fields such as search terms;
• in the case of agency use (§ 4.9): the staff, end users and customers of the Customer's clients.

5. Duration of processing

The duration of the processing corresponds to the term of the Main Agreement. After the Main Agreement ends, data is deleted or returned in accordance with § 5.10 of this DPA. During the term the following retention periods apply: raw data from connected platforms, other than Google Ads, at most 12 months from retrieval; derived data based on LinkedIn reporting data at most 12 months; conversation history and requests from connected AI assistants 30 days; technical logs 60 days; data of a disconnected platform 30 days, LinkedIn 10 days, or immediately on request; the Write Actions change log for the term plus 12 months as documentation.

HYPD has implemented the following technical and organisational measures to ensure a level of security appropriate to the risk. Measures may be adapted in the course of technical development provided the level of protection is maintained. The HYPD platform runs entirely on the cloud infrastructure listed in Annex 3; physical security of the data centres is ensured by those providers, whose ISO 27001 and SOC 2 reports are available through the providers.

1. Confidentiality (Art. 32(1)(b) GDPR)

1.1 Physical access control (HYPD office)

• HYPD's own office at Attilastraße 16, 12529 Schönefeld;
• entrance doors secured by a standardised locking system with security locks;
• issue, loss and return of keys to staff and third parties are documented;
• visitors and external personnel are accompanied by staff;
• access only for persons who require it for their tasks (need-to-access principle).

1.2 System access control

• login to workstations and central systems exclusively through personal user accounts; multi-factor authentication is mandatory for all production systems, cloud consoles and administrative accounts;
• binding password policy: minimum complexity (upper and lower case, digits, special characters), minimum length of 12 characters for administrative accounts;
• automatic locking of workstations after inactivity, unlocking only by password or biometrics;
• firewalls, antivirus and endpoint protection on all clients, regularly updated;
• incoming email is checked server-side for viruses and spam;
• access to internal systems from outside the office only over encrypted connections;
• full-disk encryption on laptops and mobile devices;
• mobile devices protected by passcode or biometrics;
• encrypted Wi-Fi networks; guests use a separate guest network only.

1.3 Data access control

• differentiated authorisation concept based on the need-to-know principle; roles and rights are assigned centrally;
• number of administrative accounts limited to the necessary minimum; administrative tasks performed with separate admin accounts;
• prompt withdrawal of permissions when staff leave or change roles;
• logging of access to sensitive applications and data (who, when, which action);
• secure destruction of paper documents containing personal data using P-4 or higher cross-cut shredders.

1.4 Separation

• logical separation of customer data (multi-tenancy) within the HYPD platform;
• separation of test, development and production systems;
• purpose limitation: personal data is processed exclusively for the purposes defined in the Main Agreement and this DPA.

1.5 Pseudonymisation and encryption

• encryption of personal data in transit over public networks using current TLS protocols (TLS 1.2 or higher);
• encryption of databases and storage media containing personal data (encryption at rest);
• encrypted storage of OAuth tokens and API credentials;
• remote access and data transfers exclusively over encrypted connections;
• removal of user-level identifiers from retrieved platform data before storage;
• pseudonymisation of personal data where compatible with the purpose of processing.

2. Integrity (Art. 32(1)(b) GDPR)

2.1 Input control

• logging of entry, modification and deletion of personal data at the level of individual user accounts, including timestamps;
• logging of logins and logouts on central systems and applications;
• traceability of administrative actions at server and application level;
• Write Actions are applied only after individual approval by an authorised User and are recorded in an immutable change log with approver, time and change details.

2.2 Transfer control

• transmission of personal data to sub-processors exclusively encrypted (TLS);
• remote access to workstations only with the user's prior consent, except automated update and configuration processes;
• data carriers are securely erased before internal or external transfer;
• document destruction using data-protection-compliant procedures (see 1.3).

3. Availability and resilience (Art. 32(1)(b) and (c) GDPR)

• regular installation of security updates and patches on clients and production systems;
• regular encrypted backups of production systems; restorability verified by test restores;
• redundant infrastructure at the cloud providers (Google Cloud, AWS, Railway on Google Cloud, Vercel), using availability zones and automated failover where provided by the service;
• production environments are monitored by monitoring and alerting systems;
• fire and smoke detectors and suitable extinguishing equipment in the business premises;
• documented backup and recovery concept.

4. Procedures for regular review, assessment and evaluation (Art. 32(1)(d) GDPR)

4.1 Data protection management

• maintenance and continuous updating of a record of processing activities under Art. 30 GDPR, including the data protection impact assessment screening for the AI features;
• regular review of the effectiveness of the technical and organisational measures (at least annually);
• established procedures for fulfilling data subject rights under Art. 12 to 22 GDPR;
• regular review and updating of information duties (privacy policy);
• all staff bound to confidentiality and data protection;
• training and awareness of staff in data protection and information security;
• documented password and access policies;
• named data protection contact (Philip Mohr, privacy@hypd.ai).

4.2 Incident response management

• automatic locking of user accounts after a defined number of failed login attempts;
• documented process for notifying the Controller of personal data breaches under Art. 33 GDPR within 48 hours;
• central documentation and prioritisation of security incidents;
• after each security incident, measures to prevent or mitigate further incidents are discussed and implemented.

4.3 Sub-processor control

• careful selection of sub-processors with regard to data protection and data security requirements;
• written data processing agreements with sub-processors under Art. 28 GDPR;
• for transfers to third countries: appropriate safeguards under Art. 44 et seq. GDPR (in particular EU Standard Contractual Clauses);
• regular review of the sub-processors used.

The Controller consents to the use of the sub-processors listed in tables 1, 2 and 4. They are necessary for the performance of the Main Agreement. For transfers to third countries, appropriate safeguards under Art. 44 et seq. GDPR are in place, in particular the EU Standard Contractual Clauses in their current version and, where applicable, certification under the EU-US Data Privacy Framework (DPF). The current list is also published at https://www.hypd.ai/subprocessors.

1. Infrastructure and platform operation (sub-processors)

2. AI model providers used by HYPD (sub-processors)

3. Recipients on the Controller's instruction (independent controllers, not sub-processors)

4. Internal business operations (sub-processors with incidental access)

Providers that process only data for which HYPD is the controller (Stripe for payments, Featurebase for feedback) are not sub-processors under this DPA and are described in the Privacy Policy.

Notes:

• Where sub-processors or their group companies process data outside the EU/EEA, appropriate safeguards are in place, in particular the EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914 and, where applicable, certification under the EU-US Data Privacy Framework.
• HYPD informs the Controller of intended changes regarding the addition or replacement of sub-processors in accordance with § 5.5 of this DPA.
• Contractual arrangements guaranteeing at least the level of protection agreed in this DPA exist with every sub-processor.