Data Processing Agreement

Studio Primary · Version 2026-09-24 · Effective 24 September 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Studio Primary, trading as Studio Primary, KvK 82701237, Eindhoven, The Netherlands ("Processor"), and the customer that accepts it in the Service ("Controller"), consisting of the Terms of Service and this DPA (the "Agreement"). It fulfils the requirements of Article 28(3) of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Terms defined in the Terms of Service or in the GDPR have the same meaning here.

Where the Controller itself acts as a processor on behalf of its own clients, the Processor acts as its sub-processor, and the Controller warrants that its instructions and this DPA are consistent with its own agreements with those clients.

1. Subject matter and instructions

1.1 The Processor processes Personal Data on behalf of the Controller solely to provide the Service as described in the Agreement and in Annex 1, and only on the Controller's documented instructions. The Agreement, the Controller's configuration of its workspace, and actions and approvals by its Authorised Users in the Service constitute the Controller's complete documented instructions, including with regard to transfers to third countries.

1.2 The Processor may process Personal Data otherwise only where required by Union or Member State law to which it is subject; in that case it will inform the Controller before processing, unless that law prohibits this on important grounds of public interest.

1.3 The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law. The Processor is not obliged to perform a comprehensive legal examination of instructions.

1.4 The Controller is responsible for the lawfulness of the processing, including having a legal basis, informing data subjects, obtaining consents (including for electronic marketing), and for the accuracy of the Personal Data. The Controller shall not instruct processing of special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR), nor of personal data of children, unless expressly agreed in writing.

2. Confidentiality

2.1 The Processor ensures that persons authorised to process Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality, and process Personal Data only as needed to provide the Service.

3. Security

3.1 The Processor implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The Processor may update these measures, provided the overall level of security is not reduced.

3.2 The Controller is responsible for the security measures within its own control, including the management of users, roles, passwords and credentials, the approval of changes, and the security of the systems and third-party accounts it connects.

4. Sub-processors

4.1 The Controller gives the Processor general written authorisation to engage sub-processors. The sub-processors engaged on the effective date are listed in Annex 3.

4.2 The Processor will inform the Controller of any intended addition or replacement of sub-processors at least fourteen (14) days in advance, through the Service, by email or by updating Annex 3 with a new version of this DPA. The Controller may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the Agreement with regard to the affected Service as its sole remedy.

4.3 The Processor imposes on each sub-processor data-protection obligations that are substantially equivalent to those in this DPA, and remains responsible towards the Controller for the performance of its sub-processors in accordance with Article 28(4) GDPR, subject to the limitations of liability in the Agreement.

4.4 AI providers. Whether an AI model provider reached through OpenRouter may retain Personal Data or use it to train or improve its models depends on that provider's data policy and on the data-policy settings of the OpenRouter account used. For platform AI access, the Processor informs the Controller on request which settings apply. The Processor gives no undertaking that data is excluded from training or retention. The Controller decides which Personal Data it submits to AI features and shall not submit Personal Data whose processing under those settings it does not accept; where it requires exclusion from training, it shall use its own OpenRouter key with training and retention disabled.

4.5 Controller-instructed third parties are not sub-processors. Third-party services that the Controller connects or configures with its own account or credentials — including Google, Meta, LinkedIn, Reddit, Microsoft, its own AI provider key, its own email (SMTP) server, and any website on which it installs a script — are engaged by the Controller. Data exchanged with them is transferred on the Controller's instruction and under the Controller's own agreement with those parties, and the Processor has no responsibility for their processing.

5. International transfers

5.1 The Processor transfers Personal Data to a country outside the European Economic Area only on the Controller's instructions (including by the Controller's use of features that rely on a sub-processor listed in Annex 3) and in compliance with Chapter V GDPR, on the basis of an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or Standard Contractual Clauses, supplemented where necessary.

6. Assistance

6.1 Data subject requests. Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. The Service allows the Controller to view, correct, export and delete the Personal Data it manages. The Processor forwards any request received directly from a data subject relating to the Controller's data to the Controller without undue delay and does not respond itself, except to refer the data subject to the Controller.

6.2 Other obligations. The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to the Processor.

6.3 Assistance that goes beyond what the Service provides as standard may be charged at the Processor's usual rates, unless the assistance is required because of a breach of this DPA by the Processor.

7. Personal data breaches

7.1 The Processor notifies the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller's Personal Data.

7.2 The notification describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases.

7.3 The Controller is responsible for assessing whether to notify the supervisory authority and data subjects. The Processor will not notify the supervisory authority or data subjects of a breach concerning the Controller's data on the Controller's behalf without the Controller's instruction, unless required by law.

8. Deletion and return

8.1 At the end of the Agreement, the Controller may export its Personal Data using the export features of the Service within thirty (30) days. After that period the Processor deletes the Personal Data, unless Union or Member State law requires its storage. Backups are overwritten in the regular backup cycle (at most 35 days). Data that the Controller deletes in the Service during the Agreement may be retained in a recoverable bin for up to six (6) months before permanent deletion, unless the Controller deletes it permanently earlier.

9. Information and audits

9.1 The Processor makes available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 GDPR, primarily through this DPA, its annexes and written answers to reasonable questions.

9.2 If that information is demonstrably insufficient, the Controller may, at most once per year and with at least thirty (30) days' written notice, have an audit performed by an independent auditor bound by confidentiality, during normal business hours, without disrupting the Service and without access to data of other customers or to confidential information about the Processor's security that would put the Service at risk. The Controller bears the costs of the audit, unless it reveals a material breach of this DPA by the Processor. Audits required by a supervisory authority are always permitted.

10. Liability and term

10.1 The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service, to the extent permitted under Article 82 GDPR and other mandatory law. The Controller indemnifies the Processor against claims of data subjects, supervisory authorities and other third parties to the extent they arise from the Controller's instructions or its breach of data protection law.

10.2 This DPA applies for as long as the Processor processes Personal Data on behalf of the Controller, and survives termination of the Agreement for that time.

10.3 In case of conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA prevails. This DPA is governed by the law and jurisdiction clauses of the Terms of Service.

---

Annex 1 — Description of the processing

Nature and purpose. Hosting, storage, retrieval, analysis, generation, organisation, transmission and deletion of data in order to provide the Service: planning, generating, measuring and managing marketing activities, advertising accounts, websites, content, email, social media, reviews and reporting for the Controller and its clients, including processing by AI models and approved changes to connected platforms.

Duration. The term of the Agreement, plus the retention and deletion periods in section 8.

Categories of data subjects.

• the Controller's Authorised Users, in their capacity as users of the Controller's workspace;
• contact persons of the Controller's clients;
• recipients of email campaigns and drips sent by the Controller;
• authors of customer reviews on connected business listings;
• people who appear in images, videos and documents uploaded by the Controller;
• website visitors of the Controller's clients, only in aggregated statistics (analytics and search data are received as aggregates, not as individual profiles);
• people mentioned in content, briefs, social posts, competitor research and other material the Controller enters or has generated.

Categories of personal data.

• names, business contact details, job titles;
• email addresses and subscription/consent status of email recipients;
• review author names and review texts;
• images and videos in which people may be recognisable;
• content, notes and messages entered by users;
• advertising account identifiers and settings;
• search terms typed by the public, as reported by advertising and search platforms (these rarely contain personal data);
• technical data (IP addresses, user agents) in logs.

Special categories. None instructed (see section 1.4).

Annex 2 — Technical and organisational measures

Access control

• Every workspace (tenant) is strictly separated at the application layer. Every request is authorised against the workspace of the signed-in user, and cross-workspace access is tested automatically.
• Role-based access (viewer, editor, approver, admin), with workspace-administrator control over users.
• Passwords are stored only as bcrypt hashes, with a minimum length of 8 characters. Changing a password requires the current password. Reset links are single-use, stored hashed, and expire after one hour.
• Sessions are held in signed, HttpOnly cookies.
• Administrative access to production systems is limited to authorised personnel.

Encryption

• All traffic is encrypted in transit with TLS.
• Stored third-party credentials, API keys and OAuth tokens are encrypted at rest with AES-256-GCM. Keys are held separately from the database.
• Secrets are redacted from error logs and error messages.

Integrity and accountability

• An audit log records creations, changes and deletions in the workspace, with actor and time.
• Changes to connected advertising platforms go through an explicit approval step, which is recorded, unless the Controller enables automation.
• Acceptance records are append-only and protected against modification at database level.

Availability and resilience

• Regular database backups, overwritten within at most 35 days.
• Health monitoring and error monitoring.
• Background jobs are retried and dead-lettered, and never silently lose data.

Secure development

• Automated tests, including tests for tenant isolation.
• Validation of all input.
• Protection against server-side request forgery when fetching URLs.
• Dependencies are kept up to date.

Data minimisation

• Analytics and search data are processed as aggregates.
• AI requests contain only the data needed for the requested output.

Organisation

• Personnel with access are bound by confidentiality.
• Incident response in accordance with section 7.
• Sub-processors are assessed before engagement.

Annex 3 — Sub-processors

Services the Controller connects with its own accounts or keys (Google, Meta, LinkedIn, Reddit, Microsoft, its own AI provider key, its own SMTP server) are not sub-processors of the Processor; see section 4.5.