Data Processing Addendum

This Data Processing Addendum (DPA) describes the general data-processing commitments that apply when BannerAI processes personal data on behalf of a customer in connection with the service. A separately signed agreement may supplement or replace this page for enterprise customers.

1. Roles

For end-user data submitted or collected through a customer's BannerAI integration, the customer generally acts as controller/business and BannerAI generally acts as processor/service provider, subject to applicable law and the parties' specific circumstances.

2. Processing instructions

BannerAI processes customer personal data to provide campaign delivery, targeting, analytics, attribution, frequency controls, behavioral audiences, support, security and related contracted functionality, and otherwise on documented customer instructions.

3. Categories of data

Data may include visitor/session identifiers, IP/network information, browser/device characteristics, page/app-screen activity, traffic-source/UTM data, campaign impressions/clicks/conversions and custom attributes configured by the customer. Customers must not intentionally submit special-category/highly sensitive data unless expressly supported and lawfully agreed.

4. Confidentiality and security

Personnel and service providers authorized to process customer data are subject to appropriate confidentiality obligations. BannerAI maintains reasonable technical and organizational safeguards designed to protect customer data against unauthorized access, loss, misuse or alteration.

5. Subprocessors

BannerAI may use infrastructure, hosting, storage, payment, security, communication and support subprocessors. We remain responsible for requiring appropriate data-protection obligations from subprocessors that process customer personal data on our behalf.

6. Assistance

Taking into account the nature of processing, BannerAI will provide reasonable assistance to customers with data-subject requests, security incidents and compliance obligations where required by applicable law and the service arrangement.

7. Retention and deletion

BannerAI uses bounded retention for selected raw events and compact long-term aggregates for statistics. At termination, customer data will be deleted or returned according to our service processes, legal obligations and backup lifecycle, unless retention is required by law.

8. International transfers

Where legally required, the parties will use appropriate transfer mechanisms or contractual safeguards for cross-border processing.

9. Audits and information

We will make available information reasonably necessary to demonstrate compliance with applicable processor obligations and may satisfy audit requests through security documentation, questionnaires, certifications or a scoped audit process where appropriate.

10. Contact

Data-protection questions may be sent to admin@vruxsol.com.