Archived · No longer in effect
This version applied from 24 January 2025 until 23 September 2026. It has been replaced by Version 1.3. Read the current version →
This Data Processing Addendum (the “DPA”) forms part of the agreement between BlockchainAds Labs LLC, a company incorporated in Saint Vincent and the Grenadines with its registered office at Suite 305, Griffith Corporate Centre, Beachmont, Kingstown, Saint Vincent and the Grenadines (“Blockchain-Ads”), and the advertiser that accepts it (the “Advertiser”). That agreement is the Advertiser Terms and Conditions together with any Order Form (the “Agreement”).
The Advertiser accepts this DPA by accepting the Agreement. The DPA takes effect on that acceptance, and its Processor terms apply whenever Processing within its scope takes place. Capitalised terms not defined here have the meanings given in the Agreement.
This DPA covers only Personal Data that Blockchain-Ads processes on the Advertiser’s behalf. Processing for which a party independently decides the purposes and essential means stays outside it.
1.1 Applicable Data Protection Law means every privacy or data protection law that applies to the relevant Processing, including, where applicable, Regulation (EU) 2016/679 (the “EU GDPR”); the EU ePrivacy Directive and its national implementations; the UK GDPR and the Data Protection Act 2018; and the California Consumer Privacy Act as amended (the “CCPA”).
1.2 Campaign Data means Personal Data processed through the Platform on the Advertiser’s behalf to deliver, measure, secure, attribute, optimise or report its Campaigns. It includes data received through pixels, tags, SDKs, APIs, server-to-server and conversion integrations and, where the Advertiser enables it, wallet-related events and wallet or wallet-derived identifiers.
1.3 Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Subprocessor have the meanings given by Applicable Data Protection Law.
1.4 On a data processing matter within its scope, this DPA prevails over the Agreement. Transfer clauses incorporated under Section 7 prevail over both where the law requires it.
2.1 Blockchain-Ads as Processor. For all Campaign Data, Blockchain-Ads acts as Processor on the Advertiser’s behalf, and the Advertiser is Controller. The Advertiser decides the Campaign purposes, Account settings, audiences, pixel and tag setup, deployed properties, tracked events and whether retargeting runs. The Advertiser’s documented instructions are the Agreement, this DPA, its Account settings and authorised Campaign instructions, and lawful written instructions consistent with them.
2.2 Limited operational data. Blockchain-Ads uses a limited set of data to run the Platform itself: Account administration, contracting, billing and payment records, Platform security, fraud and Invalid Traffic prevention, compliance and legal claims. For that limited set only, Blockchain-Ads decides the purposes and carries the responsibilities Applicable Data Protection Law gives the party that decides them. The privacy notice provided on the Platform governs that Processing. Blockchain-Ads never uses an Advertiser’s pixel, conversion or event data to build its own audiences or cross-client audience products unless the Advertiser separately authorises it and the Processing is lawful. No publicity or branding right in the Agreement permits use of Advertiser-specific Personal Data, confidential results or event-level records in public marketing.
2.3 Exchanging data or taking part in the same advertising supply chain does not by itself make the parties joint controllers. If an activity legally creates joint controllership, the parties will document the allocation of their duties before it starts.
3.1 Schedule 1 sets out the subject matter, nature, purpose and duration of the Processing and the categories of Personal Data and Data Subjects.
3.2 Blockchain-Ads processes Campaign Data only on the Advertiser’s documented instructions, unless the law requires other Processing. In that case Blockchain-Ads informs the Advertiser first, unless the law prohibits it.
3.3 Blockchain-Ads does not use Campaign Data to train general-purpose AI or machine-learning models. It will not give Campaign Data to a third-party AI provider for that provider’s model training without a new lawful documented instruction. Data received through a connected third-party API stays subject to that provider’s binding data-use restrictions.
3.4 Blockchain-Ads will promptly tell the Advertiser if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected Processing until the parties resolve it.
4.1 The Advertiser warrants that:
4.2 The Advertiser remains responsible for the accuracy, quality and lawful source of Campaign Data. Managed assistance from Blockchain-Ads leaves with the Advertiser its responsibility for a lawful basis, collection notices, consent signals and instructions. Blockchain-Ads’ own duties under this DPA and under Section 2.2 remain in full.
4.3 The Advertiser will indemnify Blockchain-Ads, its affiliates and their personnel against third-party and Data Subject claims, regulatory proceedings and fines, to the extent lawfully indemnifiable, arising from the Advertiser’s breach of this DPA, unlawful instructions, missing or invalid notice or consent, or unlawful collection or disclosure of Campaign Data. The indemnity does not apply to the extent a loss is caused by Blockchain-Ads’ breach, negligence, fraud or wilful misconduct.
5.1 For Campaign Data it processes as Processor, Blockchain-Ads will:
5.2 This assistance is part of the Service and carries no separate fee. Its scope is the assistance described in this DPA. Legal duties and deadlines never depend on a further commercial approval.
6.1 The Advertiser gives general written authorisation for Blockchain-Ads to appoint Subprocessors to provide the Service.
6.2 Blockchain-Ads keeps current information on the Subprocessors that process Campaign Data on its behalf. It is available through the Platform, an online notice or on request to privacy@blockchain-ads.com. This DPA does not commit Blockchain-Ads to any particular provider, country, data centre or hosting region.
6.3 Supply Partners, payment providers and services that the Advertiser selects, controls and connects become Subprocessors only if Blockchain-Ads itself appoints them to process Campaign Data on its behalf. The Platform interoperating with them, or sending them an instruction the Advertiser authorised, is not enough. The Advertiser remains responsible for the services it connects, their permissions and their configuration.
6.4 Where the law requires it, Blockchain-Ads gives prior notice of a new or replacement Subprocessor by Account email, Platform notice or another reasonable electronic method, early enough for the Advertiser to object within the legally required period.
6.5 The Advertiser may object on reasonable, documented data protection grounds. The parties will try to resolve the objection in good faith. If they cannot, the Advertiser may stop only the affected Processing or Campaign. Refunds and Advertising Credit remain governed by the Agreement, and an objection creates no automatic refund right.
6.6 Blockchain-Ads imposes on each Subprocessor data protection obligations at least as protective as this DPA for the relevant Processing and remains responsible for its performance as Applicable Data Protection Law requires.
7.1 The Advertiser authorises Blockchain-Ads and its Subprocessors to process Campaign Data in the countries where the authorised Processing takes place, subject to this Section. Processing locations may change, and this DPA guarantees none.
7.2 EU transfers. Where a transfer from the EEA to Blockchain-Ads requires, and may lawfully use, the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, those unmodified clauses are incorporated by reference with these selections: Module Two (Controller to Processor); Clause 7 (docking) applies; Clause 9(a) uses Option Two, with notice under Section 6.4 giving the opportunity to object before a new Subprocessor starts; the optional wording in Clause 11 is omitted; Clause 17 uses Irish law; and Clause 18 uses the courts of Ireland. Schedule 1 is Annex I and Schedule 2 is Annex II. A transfer outside this configuration must not start until a valid mechanism is in place.
7.3 UK transfers. Where a UK restricted transfer requires it, the mandatory clauses of the current approved UK International Data Transfer Addendum to the EU standard contractual clauses are incorporated, using the selections in Section 7.2, the details in Schedule 1 and the measures in Schedule 2. If another lawful UK mechanism is used, that mechanism governs instead.
7.4 Before a restricted transfer starts, the parties complete any legally required transfer assessment and put effective supplementary measures in place. Blockchain-Ads provides the information reasonably needed for that assessment. Accepting this DPA does not by itself make any particular transfer lawful.
7.5 If a transfer mechanism is invalidated, replaced or becomes unavailable, the parties cooperate on a valid replacement, and Blockchain-Ads may suspend the affected Processing until one is in place.
8.1 Blockchain-Ads maintains measures appropriate to the nature and risk of Campaign Data, including those in Schedule 2. It may update them where the overall level of protection is not materially reduced.
8.2 A breach notification includes the information reasonably available to Blockchain-Ads on the nature of the incident, the affected data, likely consequences, containment and a contact point. Notification is not an admission of fault or liability.
8.3 The Advertiser secures its own properties, Account credentials, integrations, endpoints and authorised users, and promptly tells Blockchain-Ads of any suspected compromise affecting Campaign Data.
9.1 On reasonable written request, Blockchain-Ads provides the information reasonably needed to demonstrate compliance with this DPA, through security documentation, questionnaires, certifications or independent audit reports.
9.2 If that information is demonstrably insufficient and the law requires further inspection, the Advertiser may conduct one audit in any 12-month period on at least 30 days’ notice. The audit takes place during business hours, avoids unreasonable disruption, protects other customers’ data and Blockchain-Ads’ confidential information, and follows reasonable security and confidentiality requirements.
9.3 The Advertiser bears its reasonable external audit costs unless the audit establishes a material breach by Blockchain-Ads. Additional audits are permitted where a regulator requires one or after a material Personal Data Breach affecting the Advertiser’s Campaign Data. Mandatory inspection and audit rights remain unaffected.
10.1 If Blockchain-Ads receives a request relating only to Campaign Data it processes as Processor, it may refer the requester to the Advertiser and will reasonably help the Advertiser respond.
10.2 Each party is responsible for requests and regulator communications about the data for which it is Controller.
10.3 Where lawful and practicable, the Advertiser will tell Blockchain-Ads before making a statement to a regulator that attributes a breach or violation to Blockchain-Ads, and will give it a reasonable opportunity to respond. This never requires permission to contact an authority, delays a mandatory report or restricts a protected complaint or disclosure.
11.1 During the Service, Campaign Data is kept under the Platform’s retention settings and Schedule 1. Pixel, conversion, audience-event and wallet-related Campaign Data is kept for up to 12 months from collection, unless deleted earlier or lawfully kept longer for a documented legal, security or dispute purpose.
11.2 After the affected Service ends, Blockchain-Ads may delete Campaign Data through its ordinary deletion process. An Advertiser that wants a copy returned must request it at or before termination, and before deletion begins. Where the law requires return and the request is timely, Blockchain-Ads uses a reasonably available secure return method. Mandatory legal requirements on return, deletion and retention prevail.
11.3 Blockchain-Ads may keep data it holds under Section 2.2, security and audit records, legal-claim records and data the law requires it to keep. Advertiser-specific Personal Data kept this way stays protected and is deleted or de-identified when its purpose ends.
11.4 Aggregated or irreversibly de-identified information that is no longer Personal Data may be kept without a fixed period.
12.1 Where Blockchain-Ads acts as a service provider or contractor for Campaign Data under the CCPA, it will not sell or share that data, retain, use or disclose it outside the direct business relationship, or combine it with Personal Data received from another source, except as the CCPA and its regulations permit.
12.2 Blockchain-Ads certifies that it understands and will comply with Section 12.1 and will tell the Advertiser if it can no longer do so. The Advertiser may take reasonable steps to stop and remediate unauthorised use.
12.3 Section 12 does not cover Processing under Section 2.2. Blockchain-Ads provides any legally required notice and opt-out for that Processing through the privacy notice provided on the Platform.
13.1 Each party is responsible for its own records of Processing, impact assessments, representative and data protection officer appointments, regulator registrations and other accountability duties.
13.2 Where Article 27 of the EU GDPR or the UK GDPR requires Blockchain-Ads to appoint a representative, Blockchain-Ads publishes the representative’s contact details in the privacy notice provided on the Platform before the affected Processing begins.
13.3 Blockchain-Ads will not describe pseudonymous data as anonymous unless it has documented that the data cannot reasonably be linked to an identified or identifiable person.
14.1 Liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where the law or an incorporated transfer mechanism does not permit limitation. Nothing in this DPA limits a Data Subject’s rights or a supervisory authority’s powers.
14.2 This DPA is governed by the laws of Saint Vincent and the Grenadines. Disputes are resolved under the dispute resolution terms of the Agreement, except where an incorporated transfer mechanism mandatorily provides otherwise for claims under that mechanism.
14.3 If a provision is invalid or unenforceable, it is modified to the minimum extent necessary or severed, and the remaining provisions stay in force.
14.4 The Advertiser accepts this DPA and its Schedules through the same electronic or written signature that accepts the Agreement. No separate signature or checkbox is required. The retained acceptance record identifies the DPA version, the Advertiser, its authorised representative and the date, and also evidences agreement to the transfer clauses in Section 7. Blockchain-Ads is bound on the Advertiser’s valid acceptance without a separate countersignature. Acceptance is not consent on behalf of individual Data Subjects.
14.5 Blockchain-Ads may update this DPA under the amendment terms of the Agreement. Updates never change incorporated transfer clauses beyond what those clauses permit.
Data exporter: the Advertiser named in the Account and the acceptance record. Contact: its authorised representative, registered Account email or designated privacy contact. Role: Controller (Module Two). Activities: operating its properties and Campaigns and instructing advertising delivery, measurement and reporting. Signature and date: the acceptance record.
Data importer: BlockchainAds Labs LLC, Suite 305, Griffith Corporate Centre, Beachmont, Kingstown, Saint Vincent and the Grenadines. Contact: privacy@blockchain-ads.com. Role: Processor. Activities: providing the advertising technology and instructed services described in this DPA. Signature and date: through Section 14.4, on the date of the Advertiser’s acceptance.
Frequency and operations: transfers are continuous while an integration or Campaign is active. Processing may include collection, transmission, recording, organisation, storage, retrieval, matching, analysis, measurement, reporting, security, correction and deletion.
Competent supervisory authority (Annex I.C): determined under Clause 13: the authority of the exporter’s establishment in the EEA; where the exporter has none, the authority where its Article 27 representative is established; where no representative is required, the authority of the EEA Member State recorded in the Account’s transfer details in which the affected Data Subjects are located. This must be recorded before the transfer. Irish governing law does not by itself select the Irish authority. For the UK Addendum, the competent authority is the UK Information Commissioner.
Blockchain-Ads maintains measures appropriate to the risk, including:
These measures may evolve with risk and technology, provided the overall level of protection is not materially reduced.
Version 1.2.
Access is limited to qualified advertisers.
