Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between the customer that holds a 1000ants account (the "Customer") and TwentyOne Monkeys OÜ, trading as 1000ants ("1000ants"). It governs the processing of personal data that 1000ants carries out on the Customer's behalf when providing the 1000ants service (the "Services"), as required by Art. 28(3) of the General Data Protection Regulation (Reg. (EU) 2016/679, "GDPR").

1. Parties and Roles

The Customer is the controller of the personal data described in §3 ("Customer Data"). 1000ants, TwentyOne Monkeys OÜ, registry code 17570457, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, is the processor. Where the Customer itself acts as a processor for its own clients (for example as an agency), 1000ants acts as the Customer's sub-processor, and the Customer warrants that its clients' instructions and authorisations cover the processing described in this DPA.

This DPA does not cover personal data for which 1000ants is itself the controller, such as the account data of the Customer's users, billing data and website data. That processing is described in our Privacy Policy.

2. Subject Matter, Duration, Nature and Purpose

• Subject matter: the processing of Customer Data that 1000ants receives from the Customer, from the third-party accounts the Customer connects and from the Customer's use of the Services.
• Duration: the term of the Services, plus the period needed to delete or return Customer Data under §11.
• Nature: collection, storage, organisation, analysis, transmission to the sub-processors in §7, and the changes the Customer approves on its connected accounts.
• Purpose: providing the Services to the Customer: analyses, reports, recommendations, drafts and the approved changes to the Customer's connected accounts and content, as described in §2 of the Terms; and improving the Services as set out in §4 and §13.

3. Categories of Personal Data and Data Subjects

Data subjects may include:

• the Customer's employees and other users of its 1000ants workspace;
• contacts, leads and customers in a CRM the Customer connects;
• people who interact with the Customer's channels, for example by commenting on the Customer's posts;
• business contacts and users appearing in the ad, analytics and content accounts the Customer connects (for example the person who made a change in an ad account);
• recipients of messages the Customer drafts or sends through the Services.

Categories of personal data may include:

• identification and contact data (names, usernames, e-mail addresses, platform IDs);
• business and transaction data (company, role, deal and lead details, status changes, amounts);
• content and interaction data (comments, replies, messages, posts and their metrics);
• technical and usage data from connected accounts (change histories, click identifiers, audience and performance reports).

The Services are not designed for special categories of personal data (Art. 9 GDPR) or for data of children. The Customer will not intentionally submit such data.

4. Instructions

1000ants processes Customer Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in that case 1000ants informs the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

The Terms, this DPA and the Customer's use of the Services are the Customer's documented instructions. In particular, connecting an account to 1000ants is the Customer's instruction to retrieve, process and store its data to provide and improve the Services within the terms of that platform; a request to an agent is the instruction to perform that task; and an approval is the instruction to carry out that specific change. Further instructions may be given in writing, including by e-mail.

1000ants informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, and may suspend the instruction until the Customer confirms or changes it.

5. Confidentiality

1000ants ensures that the persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process Customer Data only as instructed.

6. Security

1000ants implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing (Art. 32 GDPR), and reviews them as the Services and the risks change.

7. Sub-processors

The Customer gives 1000ants a general authorisation to engage sub-processors. The sub-processors authorised at the date of this DPA are the providers listed in §5 of the Privacy Policy, with the purpose, data and location stated there. Providers that receive data only as the operator of a platform the Customer connects act on the Customer's own connection and under their own terms.

1000ants imposes on each sub-processor, by contract, data protection obligations that provide at least the level of protection of this DPA, and remains fully liable to the Customer for the performance of the sub-processor's obligations.

1000ants informs the Customer of any intended addition or replacement of a sub-processor at least 30 days before it takes effect, by e-mail to the address on file for the workspace or in the product. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may stop using the affected part of the Services or terminate the Services under the Terms, without penalty, before the change takes effect.

8. International Transfers

1000ants and some of its sub-processors process Customer Data outside the European Economic Area, mainly in the United States. Such transfers take place only with the safeguards of Chapter V GDPR: the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), and, where the recipient is certified, the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), as set out in §6 of the Privacy Policy. The Customer may request a copy of the safeguards in place.

9. Assistance to the Customer

Taking into account the nature of the processing, 1000ants assists the Customer with appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR. A request that reaches 1000ants directly is forwarded to the Customer without undue delay; 1000ants does not answer it on its own account except where the law requires.

1000ants further assists the Customer, taking into account the nature of the processing and the information available to it, in ensuring compliance with the obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Where such assistance goes beyond what the Services include, 1000ants may charge a reasonable fee agreed in advance.

10. Personal Data Breaches

1000ants notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, by e-mail to the address on file for the workspace. The notification describes, as far as known at that time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed; information that is not yet available is provided as it becomes available. 1000ants takes reasonable steps to contain and remedy the breach. The Customer remains responsible for notifying the supervisory authority and the data subjects where Art. 33 and 34 GDPR require it.

11. Deletion and Return

During the Services, the Customer can download results from the workspace, receive a copy of its data on request (contact@1000ants.ai), and delete connected accounts, workspaces and the account itself at any time. At the end of the Services, 1000ants deletes Customer Data within the periods stated in §7 of the Privacy Policy, unless Union or Member State law requires it to be stored longer; in that case the data is kept only for that purpose and for that period. Deleting a connected account or workspace during the Services has the same effect for the data it contains. Data from a connected platform whose terms set a deletion period is deleted within that period from the moment the connection is cut; the rest of a deleted account or workspace that can be restored is deleted when the restore period has passed.

Anonymised and aggregated data within the meaning of §13 is not Customer Data and is not covered by this section.

12. Information and Audits

1000ants makes available to the Customer the information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer and bound by confidentiality.

The Customer first uses the information 1000ants provides (this DPA, the Privacy Policy and written answers to reasonable questions). An on-site or remote audit takes place with at least 30 days' written notice, during business hours, no more than once in any twelve months unless a supervisory authority requires it or a personal data breach affecting the Customer has occurred, and without disrupting the Services or exposing data of other customers. Each party bears its own costs.

13. Anonymised and Aggregated Data

13.1 The Customer instructs and authorises 1000ants to create anonymised and aggregated information from Customer Data, from data of accounts the Customer connects and from the use of the Services ("Aggregated Data"), by anonymisation and aggregation so that neither the Customer nor any natural person is identifiable, and to use Aggregated Data to provide, maintain, develop and improve its services — in particular the analyses and recommendations the Services provide — during and after the term of this Agreement.

13.2 Aggregated Data does not identify the Customer, its customers or any natural person, and contains no personal data. 1000ants takes appropriate technical and organisational measures to prevent re-identification and will not attempt to re-identify the Customer or any person.

13.3 Aggregated Data is not Customer Data and belongs to 1000ants. The provisions on return and deletion of Customer Data do not apply to it.

13.4 To the extent that creating Aggregated Data involves personal data, 1000ants does so on the Customer's documented instruction under this clause and, where 1000ants thereby determines the purpose of that step, as a controller on the basis of Art. 6(1)(f) GDPR (its legitimate interest in a better service). The Customer remains responsible for informing data subjects where the law requires it.

13.5 When processing data obtained from third-party platforms that the Customer connects, 1000ants complies with the terms of those platforms and deletes such data as they and the law require.

14. Liability and Precedence

The limitations and exclusions of liability in §12 of the Terms apply to this DPA, to the extent permitted by law. Each party is liable towards data subjects as Art. 82 GDPR provides.

In matters of data protection, this DPA prevails over the Terms. In all other matters the Terms apply. Where the Standard Contractual Clauses apply to a transfer, they prevail over this DPA for that transfer.

15. Term, Changes and Governing Law

This DPA takes effect when the Customer accepts the Terms and remains in force for as long as 1000ants processes Customer Data on the Customer's behalf; §11 and §13 survive its end. 1000ants may update this DPA when the Services or the law change, in the way §15 of the Terms provides for changes to the Terms. The "Last updated" date above shows the current version.

This DPA is governed by the laws of the Republic of Estonia, and the place of jurisdiction is the one stated in §14 of the Terms, without prejudice to the mandatory provisions of the GDPR and to the competence of the supervisory authorities.

Contact

Questions about this DPA, sub-processor notices and audit requests: contact@1000ants.ai.
TwentyOne Monkeys OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia — registry code 17570457.