Last updated: 7.11.2026
This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions between Adspire d.o.o. (“Adspire” or the “Processor”) and the customer (“Customer” or the “Controller”).
This DPA applies where Adspire processes personal data on the Customer’s behalf in connection with the Adspire.AI platform and related services (the “Service”).
1. Definitions and roles
“Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in Regulation (EU) 2016/679 (the “GDPR”).
For processing covered by this DPA, the Customer acts as controller and Adspire acts as processor. Where the Customer acts as a processor for another controller, the Customer appoints Adspire as a subprocessor and confirms that it has the necessary authority to do so.
This DPA does not govern processing for which Adspire acts as an independent controller, such as managing its own customer accounts, billing, website analytics or marketing. That processing is described in the Privacy Policy.
2. Details of processing
2.1. Subject matter and duration
Adspire processes personal data to provide, maintain, secure and support the Service and its features, including connected integrations and AI-assisted features selected or used by the Customer.
Processing continues for the term of the Customer’s use of the Service and for any applicable period needed to return or delete data, subject to legally required retention.
2.2. Nature and purposes
Depending on the features used by the Customer, processing may include:
- Receiving, hosting, storing, organizing, retrieving and transmitting data.
- Importing and synchronizing content from connected services.
- Generating, analyzing, modifying and organizing marketing content and media using AI-assisted tools.
- Supporting integrations and processing associated events and webhooks.
- Providing customer support, troubleshooting, security monitoring and technical maintenance.
- Returning or deleting data when the Service ends.
2.3. Categories of data subjects
Depending on the Customer’s use of the Service, data subjects may include:
- The Customer’s employees, contractors and account users.
- The Customer’s clients, prospects and business contacts.
- Individuals whose information appears in content or data imported, uploaded or generated by the Customer.
- Website visitors and other individuals whose information is included in connected services.
2.4. Categories of personal data
Depending on the Customer’s use of the Service, personal data may include:
- Names, email addresses and other contact details.
- Account, workspace and user identifiers.
- Marketing content, communications, engagement information and related metadata.
- Text, images, files and other content uploaded or connected by the Customer.
- Technical and usage information, including IP addresses, device information and logs.
- Data contained in integration events, webhooks and connected services.
The Customer is responsible for determining what personal data is submitted to the Service and for ensuring that it has a lawful basis to process it.
2.5. Special categories of data
The Customer should not submit special categories of personal data, such as health data, or data relating to criminal convictions and offences, unless the parties have expressly agreed otherwise in writing and the Customer has established a lawful basis and any additional conditions required by applicable law.
3. Customer instructions
Adspire will process personal data only on the Customer’s documented instructions, including with respect to transfers outside the European Economic Area (“EEA”).
The Terms, this DPA, the Customer’s configuration of the Service and the Customer’s use of its features constitute documented instructions. Additional instructions must be agreed in writing where necessary.
If applicable EU or Member State law requires Adspire to process personal data otherwise than instructed, Adspire will inform the Customer before processing unless the law prohibits such notice on important grounds of public interest.
Adspire will promptly inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.
4. Confidentiality
Adspire will ensure that persons authorized to process personal data are subject to an appropriate duty of confidentiality.
Access to personal data will be limited to persons who need it to perform their duties.
5. Security
Adspire will implement appropriate technical and organizational measures designed to protect personal data, taking into account the nature, scope, context and purposes of processing and the risks to individuals.
The measures applicable to the Service are described in Appendix 2. Adspire may update them as the Service evolves, provided that the overall level of protection is not reduced.
No service can guarantee absolute security. The Customer is responsible for its own account administration, access permissions, connected integrations and secure use of the Service.
6. Subprocessors
6.1. Authorization
The Customer grants Adspire general written authorization to use subprocessors to process personal data for the purposes described in this DPA.
The subprocessors currently authorized for customer-controlled personal data are listed in Appendix 1. A provider’s inclusion in Appendix 1 does not necessarily mean it processes every Customer’s data; processing depends on the Service and features used.
Adspire will enter into a binding agreement with each subprocessor that imposes applicable data protection obligations providing the level of protection required by Article 28 of the GDPR. Adspire remains responsible to the Customer for the performance of its subprocessors’ data protection obligations.
6.2. Changes and objections
Adspire will notify the Customer of intended additions or replacements of subprocessors at least [NOTICE PERIOD] before the change, through [EMAIL / CUSTOMER NOTIFICATION METHOD].
The Customer may object on reasonable data protection grounds by notifying Adspire at [email protected] within [OBJECTION PERIOD] after receiving the notice. The parties will discuss the objection in good faith and consider reasonable alternatives.
If the parties cannot resolve a valid objection, the Customer may stop using the affected feature or, where the affected processing is essential to the Service, terminate the affected Service in accordance with [APPLICABLE TERMINATION TERMS].
7. AI-assisted processing and integrations
The Customer may use AI-assisted features to process content, prompts, reference images and other data. Depending on the feature and configuration, the relevant input may be transmitted to an AI provider listed in Appendix 1.
The Customer should avoid submitting personal data that is not necessary for the requested task. The Customer remains responsible for reviewing AI-generated outputs before using or publishing them.
Adspire will process customer-controlled personal data through AI providers only as instructed or authorized by the Customer and in accordance with the applicable provider agreements.
AI provider retention and model training: [DESCRIBE THE ACTUAL CONTRACTUAL TERMS AND CONFIGURATION FOR EACH ACTIVE AI PROVIDER. DO NOT STATE THAT TRAINING IS DISABLED OR THAT INPUTS ARE NOT RETAINED UNLESS VERIFIED.]
If the Customer connects a third-party service or instructs Adspire to send data to it, that third party’s role and processing may be governed by the Customer’s agreement with that provider. A customer-selected integration is not automatically an Adspire subprocessor.
8. International transfers
Adspire will not transfer customer-controlled personal data outside the EEA except on the Customer’s documented instructions or where otherwise authorized under this DPA and applicable law.
Where an international transfer requires a transfer mechanism under Chapter V of the GDPR, Adspire will ensure that an applicable mechanism is in place, such as:
- An applicable European Commission adequacy decision; or
- Appropriate safeguards, including applicable Standard Contractual Clauses, together with supplementary measures where required.
The parties will cooperate to implement transfer documentation where necessary. Details of applicable processing locations and transfer arrangements are set out in Appendix 1.
9. Assistance with data subject requests
Taking into account the nature of the processing, Adspire will assist the Customer, through appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights under the GDPR.
If Adspire receives a request directly relating to data processed on the Customer’s behalf, it will notify the Customer without undue delay, unless prohibited by law. Adspire will not respond to the request on the Customer’s behalf unless instructed or legally required to do so.
10. Personal data breaches
Adspire will notify the Customer without undue delay after becoming aware of a personal data breach affecting data processed on the Customer’s behalf.
Taking into account the information available to it, Adspire will provide the Customer with relevant information about the breach and reasonable assistance to help the Customer meet its applicable notification obligations. Information may be provided in stages as it becomes available.
The Customer remains responsible for determining whether notification to a supervisory authority or affected individuals is required.
11. Additional assistance
Taking into account the nature of processing and the information available to Adspire, Adspire will assist the Customer in meeting its GDPR obligations concerning:
- Security of processing.
- Personal data breach notifications.
- Data protection impact assessments.
- Prior consultation with a supervisory authority where required.
The parties may agree on reasonable arrangements for assistance that goes beyond the Service’s standard functionality.
12. Return and deletion of data
At the Customer’s choice, following termination of the Service, Adspire will delete or return the personal data processed on the Customer’s behalf and delete existing copies, unless EU or Member State law requires continued storage.
The Customer may request return or deletion by contacting [email protected] or using available Service functionality.
Where personal data must remain in backups temporarily, Adspire will protect it and delete it in accordance with the applicable backup retention schedule. Adspire will provide confirmation of deletion upon reasonable request.
13. Information and audits
Adspire will make available to the Customer information reasonably necessary to demonstrate compliance with its obligations under this DPA and Article 28 of the GDPR.
Adspire will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer. Audits must be subject to reasonable advance notice, confidentiality and security requirements, and must avoid unnecessary disruption or access to other customers’ information.
The parties will agree on the scope, timing and practical arrangements in advance, taking into account applicable law and the nature of the request.
14. Liability
Liability arising from this DPA is subject to the Terms and Conditions, to the extent permitted by applicable law. Nothing in this DPA limits liability that cannot lawfully be limited or excluded.
15. Governing law
This DPA is governed by the laws of Slovenia, subject to mandatory applicable data protection law.
16. Contact
Adspire d.o.o.
Podlehnik 9A
Slovenia
Email: [email protected]
Appendix 1: Subprocessors and transfers
The providers below support the Service and may process personal data on Adspire’s behalf, depending on the features the Customer uses. The precise contracting entity, processing locations and applicable transfer safeguards must be confirmed against Adspire’s agreements and production configuration before this appendix is finalized.
Hetzner Online GmbH
Purpose: Hosting infrastructure for the Service and associated systems.
Data: Customer-provided content and other personal data stored or processed by the hosted Service, including account, workspace, integration and technical data as applicable.
Location: Adspire’s hosting is in the EU.
Cloudflare — R2 storage
Purpose: Storage of files and media used by the Service, including generated media where configured.
Data: Files, images and generated media that may contain personal data, together with associated technical information.
Contracting entity and locations: EU.
OpenAI
Purpose: AI-assisted generation and processing of content.
Data: Prompts and content submitted to AI features, together with generated outputs and associated request information. These inputs and outputs may contain personal data supplied by the Customer.
BytePlus — Seedream and Seedance
Purpose: AI-assisted image and video generation.
Data: Prompts, reference images or image URLs, generation settings and generated media. These may contain personal data supplied by the Customer.
PostHog
Purpose: Product analytics and understanding use of the Service. Depending on the production configuration, additional features may be enabled.
Data: User and workspace identifiers, account information such as name and email address, and product usage events. The application also contains configuration for session recording; whether recording is enabled and what it captures must be verified.
Sentry
Purpose: Error reporting and technical monitoring.
Data: Error and diagnostic information, which may include personal data depending on the event and production configuration.
Customer-selected third-party integrations are not automatically Adspire subprocessors. Their roles depend on the relevant data flow and agreements.
Appendix 2: Technical and organizational measures
The measures below describe features present in the Service’s repositories. Adspire must verify that they are enabled and effective in production and complete the outstanding operational details before publishing this appendix as a contractual commitment.
Authentication and access control
The application implements user authentication, workspace membership and authorization checks for access to relevant resources. Connector services use authentication mechanisms for requests between services.
[CONFIRM PRODUCTION ACCESS POLICIES, ADMINISTRATOR ACCESS, MULTI-FACTOR AUTHENTICATION AND THE FREQUENCY OF ACCESS REVIEWS.]
Protection of integration credentials
The connector service implements encryption of stored connector credentials and installation records using AES-256-GCM. Shopify webhook requests are checked against their signatures before processing.
Storage and transmission
The Service uses hosted infrastructure and supports private Cloudflare R2 storage for files and generated media. Adspire’s hosting is in the EU.
Monitoring and logging
The Service supports operational logging, error monitoring and product analytics. The application includes measures intended to redact sensitive URL parameters from PostHog events and selected recording and log data.
Deletion and retention
The application includes functionality for deleting workspace-related records and, in applicable circumstances, associated user records. This does not by itself establish deletion from every connected system, file store, log or backup.