Version 1.3 · Last updated 23 September 2026
Current version · In effect
This version applies from 23 September 2026. It replaces Version 1.2. View the previous version →
This Data Processing Addendum (the "DPA") forms part of the Advertising Agreement between BCA Labs Corporation, incorporated in the British Virgin Islands with its registered office at Intershore Chambers, P.O. Box 4342, Road Town, Tortola, British Virgin Islands ("Blockchain-Ads" or "Company"), and the Advertiser. It is accepted and signed with the Advertising Agreement through the same authenticated signature record and takes effect on that acceptance; its Processor obligations apply when Processing within its scope occurs. Capitalised terms not defined in this DPA have the meanings given in the Agreement.
The public Blockchain-Ads website may be operated or managed by another Blockchain-Ads group company. That entity is not a party to this DPA or the Advertising Agreement unless expressly stated; this DPA applies only to Processing within the scope described below.
This DPA applies only to Personal Data processed by Blockchain-Ads on the Advertiser's behalf as described below. It does not convert independent-controller processing into processor processing or govern data for which another party independently determines the purposes and essential means.
1.1 Applicable Data Protection Law means any privacy or data-protection law that applies to the relevant Processing, including, where applicable, the BVI Data Protection Act, 2021; Regulation (EU) 2016/679 ("EU GDPR"); the EU ePrivacy Directive and its national implementations; the UK GDPR and Data Protection Act 2018; the California Consumer Privacy Act as amended ("CCPA"); and equivalent applicable laws.
1.2 Campaign Data means Personal Data Processed through the Platform on the Advertiser's behalf to deliver, measure, secure, attribute, optimise or report its Campaigns, including data received through pixels, tags, SDKs, APIs, server-to-server connections and conversion integrations, authorised integration configuration data, and, where the Advertiser enables collection for its Campaign purposes, wallet-related events or wallet or wallet-derived identifiers.
1.3 Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, and Subprocessor have the meanings given by Applicable Data Protection Law.
1.4 If this DPA conflicts with the Agreement on a data-processing matter within this DPA's scope, this DPA prevails. An applicable Standard Contractual Clause or UK transfer addendum prevails over both documents to the extent legally required for the transfer it governs.
2.1 Advertiser as Controller; Blockchain-Ads as Processor. The Advertiser controls the Campaign purposes, Account settings, audiences, pixel/tag configuration, deployed properties, event selection and whether retargeting is enabled. For Campaign Data processed to provide those Advertiser-controlled Campaign services, the Advertiser is Controller and BCA Labs Corporation is Processor. The Advertiser's documented instructions consist of the Agreement, this DPA, the Advertiser's Account settings and authorised Campaign instructions, and lawful written instructions consistent with them.
2.2 Blockchain-Ads as independent Controller. BCA Labs Corporation acts as an independent Controller for Account administration, contracting, billing, payment and compliance records, Platform security, fraud prevention, Invalid Traffic detection, legal claims and Platform-service analytics where it determines the relevant purposes and essential means. Advertiser-specific pixel, conversion and event data Processed under Section 2.1 will not be used by Blockchain-Ads to create independent retargeting audiences or cross-client audience products unless the Advertiser separately authorises that Processing and it is lawful. Independent-controller Processing is governed by the Privacy Policy and Applicable Data Protection Law, not the Processor obligations in this DPA. The Agreement's Section 13.5 public-branding licence does not authorise use of advertiser-specific Personal Data, confidential results or event-level records in public marketing.
2.3 The parties are not joint controllers merely because they exchange data or participate in the same advertising supply chain. If a specific Processing activity legally creates joint controllership, the parties will document the required allocation before commencing that activity.
3.1 The subject matter, nature, purpose, duration, Personal Data categories, and Data Subject categories are described in Schedule 1.
3.2 Blockchain-Ads shall Process Campaign Data only on the Advertiser's documented instructions unless required by applicable law. If law requires other Processing, Blockchain-Ads will inform the Advertiser before Processing unless legally prohibited. Blockchain-Ads does not currently use Campaign Data to train or improve general-purpose AI or machine-learning models and will not provide Campaign Data to a third-party AI provider for that provider's model training without a new lawful documented instruction or other legally valid basis. Data received through a connected third-party API remains subject to any binding provider-specific data-use restrictions. Any future change to these practices remains subject to this DPA, applicable law and any required new instruction or consent.
3.3 Blockchain-Ads will promptly inform the Advertiser if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law. Blockchain-Ads may suspend the affected Processing while the parties address the issue.
4.1 The Advertiser represents, warrants and undertakes that: (a) it has a lawful basis for collecting, using and instructing the Processing of Campaign Data; (b) it provides every legally required notice and obtains every required consent before a Blockchain-Ads collection tool is activated on its property where consent is required; (c) it configures and transmits applicable consent, opt-out and privacy signals accurately; (d) its instructions, audience lists, event configurations, wallet-data configurations and Campaign Data comply with Applicable Data Protection Law; (e) it does not instruct Blockchain-Ads to identify a natural person from wallet information, combine wallet information with direct identifying information, infer or target legally restricted sensitive traits, or Process other prohibited data unless Blockchain-Ads has expressly agreed in writing and the Processing is lawful; and (f) it has authority to provide Campaign Data and instruct Blockchain-Ads to Process it.
4.2 The Advertiser remains responsible for the accuracy, quality, and legality of Campaign Data and for the means by which it acquired that data. By accepting this DPA through the Agreement, the Advertiser acknowledges: "I understand and I accept that managed assistance does not transfer my responsibility for a lawful basis, collection notices, consent signals, instructions or the source and accuracy of my Campaign Data." This does not waive Blockchain-Ads' Processor duties or duties arising from its own independent-controller Processing.
4.3 The Advertiser shall indemnify Blockchain-Ads and the persons protected under Section 8 of the Agreement from third-party claims, Data Subject claims, regulatory proceedings, and fines to the extent lawfully indemnifiable, arising from the Advertiser's breach of this DPA, unlawful instructions, missing or invalid notice or consent, or unlawful collection or disclosure of Campaign Data. This indemnity does not apply to the extent caused by Blockchain-Ads' breach, negligence, fraud, or wilful misconduct and is subject to the Agreement's procedures and applicable law.
5.1 For Campaign Data processed as Processor, Blockchain-Ads shall: (a) Process Campaign Data only under documented instructions and for the purposes in Schedule 1; (b) ensure authorised personnel are bound by appropriate confidentiality obligations; (c) implement and maintain the technical and organisational measures in Schedule 2; (d) taking account of the nature of the Processing, assist the Advertiser through appropriate measures with Data Subject requests; (e) reasonably assist the Advertiser with security, breach notification, data-protection impact assessments, and regulator consultations, taking account of the information available to Blockchain-Ads; (f) notify the Advertiser without undue delay after becoming aware of a Personal Data Breach affecting Campaign Data; and (g) make information reasonably necessary to demonstrate compliance with this DPA available under Section 9.
5.2 Assistance required by this DPA is included in the Service; Blockchain-Ads does not calculate or add a separate service fee for it. The scope remains the assistance described in this DPA, taking account of the nature of the Processing and information available, not unlimited consulting or development. Legal duties and response deadlines are not conditional on a further commercial approval. External audit costs remain governed by Section 9.3.
6.1 The Advertiser gives general written authorisation for Blockchain-Ads to appoint Subprocessors to provide the Service.
6.2 Blockchain-Ads maintains current information about Subprocessors that actually Process Campaign Data on Blockchain-Ads' behalf. That information may be provided electronically through the Platform, a designated online notice or on request to privacy@blockchain-ads.com, and may be updated from time to time. This DPA does not commit Blockchain-Ads to a particular cloud provider, infrastructure vendor, Processing country, data-centre location or hosting region. Independent Supply Partners, payment providers and Advertiser-selected connected services are not Subprocessors merely because the Platform interoperates with them.
6.3 Where Applicable Data Protection Law requires notice of an intended addition or replacement of a Subprocessor, Blockchain-Ads will provide prior notice through the registered Account email, an authenticated Platform notice or another reasonable electronic method in sufficient time to provide the Advertiser the legally required opportunity to object. No individual signature or approval is required unless applicable law requires it.
6.4 The Advertiser may object during that period on reasonable and documented data-protection grounds. The parties will attempt to resolve the objection in good faith. If no reasonable solution is available, the Advertiser may discontinue only the affected Processing or Campaign. Advertising Credit and any refund request remain governed exclusively by Section 17 of the Agreement; a Subprocessor objection does not create an automatic refund right.
6.5 Blockchain-Ads will impose data-protection obligations on each Subprocessor that are no less protective for the relevant Processing than the obligations imposed on Blockchain-Ads by this DPA and remains responsible for the Subprocessor's performance to the extent required by Applicable Data Protection Law.
6.6 Advertiser-selected connected services. A third-party account, platform or integration selected, controlled and connected by the Advertiser is not a Blockchain-Ads Subprocessor merely because the Platform interoperates with it or sends an Advertiser-authorised instruction to it. The Advertiser remains responsible for that connected service, its permissions and configuration, except to the extent Blockchain-Ads separately appoints that provider to Process Campaign Data on Blockchain-Ads' behalf, in which case Sections 6.1 to 6.5 apply.
7.1 The Advertiser authorises Blockchain-Ads and its authorised Subprocessors to Process Campaign Data in countries where the authorised Processing occurs, subject to this Section and Applicable Data Protection Law. Processing locations may change as providers and infrastructure change; no location or hosting region is guaranteed by this DPA.
7.2 For a transfer from the EEA to BCA Labs Corporation that requires, and may lawfully use, the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, those unmodified clauses are incorporated by reference. Module Two (Controller to Processor) applies; Clause 7 (docking) applies; Clause 9(a) uses Option Two, with prior notice under Section 6.3 sufficient to provide a reasonable opportunity to object before the new Subprocessor begins the relevant Processing; the optional independent-dispute-resolution wording in Clause 11 is omitted; Clause 17 uses Irish law and Clause 18 uses the courts of Ireland. Schedule 1 supplies Annex I and Schedule 2 supplies Annex II. If the actual roles or transfer fall outside that configuration, the affected transfer must not begin until a valid mechanism and required information are in place.
7.3 For a UK restricted transfer requiring the UK International Data Transfer Addendum to the EU SCCs, the mandatory clauses of the then-current approved Addendum are incorporated to the extent legally applicable. The parties, roles and transfer details are identified in Schedule 1; the EU SCC selections are those in Section 7.2; and the security information is in Schedule 2. Any additional information required by the mandatory Addendum must reflect the actual transfer when it occurs. If another lawful UK transfer mechanism is used, that mechanism governs instead.
7.4 Blockchain-Ads will implement supplementary measures reasonably required by Applicable Data Protection Law and will provide information reasonably necessary for the Advertiser's transfer assessment. Each party remains responsible for its applicable transfer duties. Before a restricted transfer begins, the parties must complete any legally required transfer assessment and put effective supplementary measures in place. Signing this DPA does not, by itself, establish that a particular destination or transfer is lawful.
7.5 If an incorporated transfer mechanism is replaced, invalidated, or becomes legally unavailable, the parties will cooperate to implement a valid replacement. Blockchain-Ads may suspend the affected Processing until a lawful mechanism is available.
8.1 Blockchain-Ads will maintain measures appropriate to the nature and risk of Campaign Data, including the measures in Schedule 2. Blockchain-Ads may update those measures where the overall level of protection is not materially reduced.
8.2 A Personal Data Breach notification will include information reasonably available to Blockchain-Ads concerning the nature of the incident, affected data, likely consequences, containment, and contact point. Notification is not an admission of fault or liability.
8.3 The Advertiser is responsible for securing its properties, Account credentials, integrations, endpoints, and authorised users and for notifying Blockchain-Ads promptly of suspected compromise affecting Campaign Data.
9.1 On reasonable written request, Blockchain-Ads will provide information reasonably necessary to demonstrate compliance with this DPA. Blockchain-Ads may satisfy this obligation through security documentation, questionnaires, certifications, or independent audit reports.
9.2 If that information is demonstrably insufficient and Applicable Data Protection Law requires further inspection, the Advertiser may conduct one audit in any 12-month period on at least 30 days' notice. An audit must occur during business hours, avoid unreasonable disruption, protect other customers' data and Blockchain-Ads' confidential information, and comply with reasonable security and confidentiality requirements.
9.3 The Advertiser bears reasonable external audit costs unless the audit establishes a material breach by Blockchain-Ads. Blockchain-Ads does not add a separate service fee for its own assistance required under this DPA. Additional audits are permitted where required by a regulator or following a material Personal Data Breach affecting the Advertiser's Campaign Data; mandatory inspection and audit rights remain unaffected.
10.1 If Blockchain-Ads receives a request relating solely to Campaign Data processed as Processor, it may direct the requester to the Advertiser and will reasonably assist the Advertiser in responding.
10.2 Each party is independently responsible for requests and regulatory communications relating to data for which it acts as Controller.
10.3 Unless prohibited by law, the Advertiser shall notify Blockchain-Ads before making a statement to a regulator that attributes a breach or violation to Blockchain-Ads and shall provide a reasonable opportunity to respond, where lawful and practicable. This does not require permission to contact an authority, delay a mandatory report or restrict a protected complaint or disclosure.
11.1 During the Service, Campaign Data is retained according to the Platform's applicable retention settings and the retention criteria in Schedule 1. Advertiser-controlled pixel, conversion, audience-event and wallet-related Campaign Data may be retained for up to 12 months unless deleted earlier or lawfully retained longer for a documented legal, security or dispute purpose.
11.2 Following termination of the affected Service, Blockchain-Ads may delete Campaign Data through its ordinary deletion process, subject to Applicable Data Protection Law. If the Advertiser wants a return copy, it should request return at or before termination and in any event before deletion begins. Where a return is required by Applicable Data Protection Law and timely requested, Blockchain-Ads will use a reasonably available secure return method. Mandatory return, deletion and retention requirements prevail.
11.3 Blockchain-Ads may retain data it holds as independent Controller, security and audit records, legal-claim records, and data required by law. Advertiser-specific Personal Data retained under this paragraph remains protected and is deleted or de-identified when the applicable purpose ends.
11.4 Aggregated or irreversibly de-identified information that no longer constitutes Personal Data may be retained without a fixed period.
12.1 To the extent BCA Labs Corporation acts as a service provider or contractor for Campaign Data under the CCPA, it shall not sell or share that Campaign Data, retain, use, or disclose it outside the direct business relationship, or combine it with Personal Data received from another person except as permitted by the CCPA and its regulations.
12.2 Blockchain-Ads certifies that it understands and will comply with the restrictions in Section 12.1 and will notify the Advertiser if it determines that it can no longer meet them. The Advertiser may take reasonable steps to stop and remediate unauthorised use.
12.3 Section 12 does not apply to independent-controller Processing disclosed in the Privacy Policy. Blockchain-Ads is responsible for providing any legally required notice and opt-out mechanism for that independent Processing.
13.1 Each party is responsible for its own records of Processing, impact assessments, representative appointments, data-protection officer obligations, regulator registrations, and other accountability duties.
13.2 Where Article 27 EU GDPR or Article 27 UK GDPR requires BCA Labs Corporation to appoint a representative, Blockchain-Ads will publish the appointed representative's contact details in its Privacy Policy before beginning the affected independent-controller Processing. Nothing in this DPA postpones or replaces that legal obligation.
13.3 Blockchain-Ads will not claim that pseudonymous data is anonymous unless it has documented that the data cannot reasonably be related to an identified or identifiable person using means reasonably likely to be used.
14.1 Liability under this DPA is subject to Sections 8 and 16 of the Agreement, except to the extent an applicable law or incorporated transfer mechanism does not permit limitation. Nothing limits a Data Subject's rights or a supervisory authority's powers.
14.2 This DPA is governed by BVI law and the dispute provisions of Section 15 of the Agreement, except to the extent an incorporated transfer mechanism mandatorily provides otherwise for claims under that mechanism.
14.3 If a provision is invalid or unenforceable, it will be modified to the minimum extent necessary or severed without affecting the remaining provisions.
14.4 The Advertiser accepts and signs this DPA and its Schedules through the same electronic or written signature that accepts the Advertising Agreement; no separate DPA signature or checkbox is required. The retained record identifies the DPA version, Advertiser, authorised representative and signature date. BCA Labs Corporation makes this DPA available as part of the Advertising Agreement and is bound on the Advertiser's valid acceptance; no separate Company countersignature is required. The authenticated record also evidences agreement to the applicable transfer clauses completed under Section 7 and Schedule 1. It is not consent on behalf of individual Data Subjects. DPA changes follow Section 14.3 of the Advertising Agreement, without modifying mandatory transfer clauses beyond their permitted procedures.
Data exporter: the Advertiser identified in the Account and retained Agreement/DPA acceptance record. Contact: the authorised representative, registered Account email or subsequently designated privacy contact. Role: Controller for Campaign Data governed by Module Two. Activities: operating the Advertiser's properties and Campaigns and instructing advertising measurement, delivery and reporting. Signature and date: the authenticated Agreement/DPA acceptance record.
Data importer: BCA Labs Corporation, Intershore Chambers, P.O. Box 4342, Road Town, Tortola, British Virgin Islands. Contact: the privacy function, privacy@blockchain-ads.com. Role: Processor for Campaign Data within this DPA. Activities: providing the advertising technology and instructed services described below. BCA's agreement to these clauses takes effect through the acceptance mechanism in Section 14.4, on the date recorded for the Advertiser's signature.
Transfers occur on an ongoing basis while the relevant integration or Campaign is active. Processing may include collection, transmission, recording, organisation, hosting, storage, retrieval, matching, analysis, measurement, reporting, security, correction and deletion for the purposes described in this DPA. Sensitive categories and direct identifiers are excluded unless separately agreed with the required safeguards. Duration follows the relevant Service and the retention criteria below.
For EU SCC Annex I.C, the competent supervisory authority is determined under Clause 13: the authority responsible for the exporter's compliance where it is established in an EEA Member State; the authority where its Article 27 representative is established where that rule applies; or the authority of the EEA Member State identified in the Account's transfer details in which affected Data Subjects are located where the exporter has no required representative. The relevant exporter establishment, representative or selected Member State must be recorded before the transfer; Irish governing law does not by itself select the Irish supervisory authority. For the UK Addendum, the competent authority is the UK Information Commissioner.
Subject matter. Campaign delivery, frequency management, measurement, attribution, conversion tracking, reporting, Advertiser-configured audiences and retargeting, security, and Invalid Traffic filtering.
Duration. The duration of the affected Service plus the retention periods below.
Data Subjects. Visitors to and users of Advertiser websites, applications, and dApps; recipients of Advertisements; and persons whose events are measured through an Advertiser-authorised integration.
Personal Data. Cookie and device identifiers, mobile advertising identifiers, IP address, user-agent and device/browser information, coarse location, publisher or application context, URLs and referrers, timestamps, auction and delivery data, impression and click data, conversion and event data, consent or privacy signals and, where enabled by the Advertiser for its Campaign purposes, wallet-related events or wallet or wallet-derived identifiers.
Intended exclusions. Special-category or sensitive data, children's data, passwords, payment-card data, financial-account credentials, and direct identifiers unless expressly agreed in writing.
Auction and delivery logs. Retained for the period reasonably necessary for Campaign delivery, billing, reconciliation, Invalid Traffic and fraud controls, security, dispute handling and applicable legal obligations.
Advertiser pixel and event Campaign Data. Pixel, conversion, audience-event and wallet-related Campaign Data may be retained for up to 12 months from collection unless deletion is required earlier or lawful retention is required longer for a documented legal, security or dispute purpose.
Security, IVT, consent-evidence, dispute, Account, billing, tax, compliance and legal records. These records may be held separately as independent-controller records for the period reasonably necessary for their purpose and applicable law.
Blockchain-Ads maintains measures appropriate to the risk, which include:
Security measures may evolve with risk and technology, provided the overall level of protection is not materially reduced.
Access is limited to qualified advertisers.
