AdKit Data Processing Agreement

9 October 2026.

1. Scope

This agreement supplements the AdKit service terms between Jeannen Ventures PTE LTD, 160 Robinson Road, #14-04 Singapore Business Federation Center, 068914, Singapore (AdKit), and Customer. It applies only to personal data AdKit processes on Customer's behalf where GDPR Article 28 requires a processor agreement (Customer Data).

Customer acts as controller or as a processor authorised to appoint AdKit and provide instructions on the controller's behalf. AdKit acts as processor or subprocessor. Customer is responsible for the lawfulness of its instructions and disclosure of Customer Data. This agreement does not cover AdKit's processing for its own purposes.

2. Processing obligations

AdKit shall:

• Process Customer Data only on Customer's documented instructions, including instructions concerning international transfers, unless Union or Member State law requires otherwise. AdKit shall inform Customer of that legal requirement before processing unless that law prohibits notice on important public-interest grounds.
• Immediately inform Customer if, in AdKit's opinion, an instruction infringes GDPR or other Union or Member State data protection law.
• Ensure persons authorised to process Customer Data have committed to confidentiality or are under an appropriate statutory duty of confidentiality.
• Take the measures required by GDPR Article 32.
• Taking account of the nature of processing, assist Customer through appropriate technical and organisational measures, insofar as possible, with requests to exercise data subject rights under GDPR Chapter III.
• Assist Customer with compliance with GDPR Articles 32–36, taking account of the nature of processing and information available to AdKit.
• Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data.
• At Customer's choice, return or delete Customer Data after the relevant processing services end, and delete existing copies unless Union or Member State law requires storage.
• Make available information necessary to demonstrate compliance with GDPR Article 28 and allow and contribute to audits, including inspections, by Customer or its mandated auditor.

Requests go to [email protected]. AdKit sends breach and subprocessor-change notices to Customer's designated email.

3. Subprocessors

Customer gives general written authorisation for AdKit to engage the subprocessors listed in the Processing Schedule. AdKit shall inform Customer of intended additions or replacements in advance, giving Customer an opportunity to object before the change.

AdKit shall impose the same applicable data protection obligations on each subprocessor by contract, including sufficient guarantees to implement appropriate technical and organisational measures. AdKit remains fully liable to Customer for performance of the subprocessor's obligations as required by GDPR Article 28(4).

4. International transfers

AdKit shall comply with GDPR Chapter V for transfers subject to those requirements.

Where Customer transfers Customer Data to AdKit and Commission Implementing Decision (EU) 2021/914 applies to that transfer, its Standard Contractual Clauses apply: Module Two where Customer acts as controller and Module Three where Customer acts as processor, completed as specified in the Transfer Schedule.

5. Effect

This agreement forms part of the AdKit service terms accepted by Customer and prevails for its subject matter, subject to mandatory law and applicable Standard Contractual Clauses.

Processing Schedule

Customer: The contracting customer under the accepted service terms.

Subject and purpose: Providing Customer-requested project setup, advertising account and campaign management, reporting, benchmarking, saved content and content generation.

Nature: Receiving, organising, storing, retrieving, modifying, transmitting and deleting Customer Data for those services, including content generation where requested.

Duration: For the duration of the relevant services and until return or deletion under clause 2.

Data subjects: Customer's authorised users and personnel, clients, and people whose personal data appears in Customer's supplied content, advertising accounts or requested reports.

Personal data: Names, business contact details, invitation emails, account/user identifiers, authorisation credentials, click identifiers submitted for conversion uploads, and personal data in supplied content, uploads, prompts and reports.

Security measures: Database administration is restricted to authorised personnel. Database service accounts use password authentication and assigned roles. Database traffic, storage and snapshots are encrypted; backups and point-in-time recovery are enabled. Stored Meta access tokens are encrypted.

Subprocessors:

Transfer Schedule

Options: Clause 7 and the optional provision in Clause 11(a) do not apply. Clause 9(a): Option 2, seven days' prior notice. Clause 17: Option 1, Irish law. Clause 18(b): Irish courts.

Annex I.A: Exporter: Customer, with particulars below. Importer: AdKit, at the address in clause 1; contact: Nicolas Jeanne, operator, [email protected]; role: processor or subprocessor. Activities: Customer providing data for, and AdKit providing, the services in the Processing Schedule. Both parties' signature and date: their binding acceptance of the service terms incorporating this agreement.

Module Three notices: Controller's notice email, or Customer's designated email with authority to receive notices on the controller's behalf.

Controller notice email: Complete if Module Three applies

Annex I.B: Data subjects, data categories, nature, purpose and retention: the Processing Schedule. Frequency: as needed during the services. Recipient: AdKit in Singapore. Subprocessors' processing: the listed purposes for the same duration.

Sensitive data and safeguards: Complete applicable categories and specific safeguards; enter none only if accurate

Annex I.C - Competent supervisory authority: Complete under Clause 13

Annex II: Security measures in the Processing Schedule. Authorised personnel handle clause 2 assistance requests using authorised access to Customer Data.