When the platform processes personal data on your behalf, the Data Processing Agreement applies. You are the controller and decide why and how data is processed; 3DMA Ltd., dba AdTech Europe, is the processor.
What data is processed
Online identifiers (cookie IDs, advertising IDs), IP addresses, device and browser information, approximate location, and ad interaction events (impressions, clicks, conversions). The data subjects are visitors to your sites and apps and people who see or interact with your ads.
Processor commitments
- Process data only on your documented instructions.
- Confidentiality for everyone with access.
- Security measures under Article 32 GDPR: encryption in transit, least-privilege access, logging, regular backups, network protection.
- Help with data subject requests and impact assessments.
- Breach notification within 48 hours.
Sub-processors
The current list (sub-processors page) includes OVHcloud (platform hosting, EU), Cloudflare, Google Workspace, Zoom, Re:amaze, Stripe, PayPal and ManBiz. New sub-processors come with at least 30 days' notice to object.
International transfers
Where data leaves the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.
Audits
On reasonable written request, once a year, information to show compliance is provided.
This summary is not legal advice; the DPA itself is authoritative. Privacy questions: info@adtech.eu.
Related: Security and data protection · Data ownership and privacy in the DMP