Data Processing Agreement
This Data Processing Agreement (hereinafter the “DPA”) is a written agreement between the Agency, that has accepted the Company Terms of Service, (hereinafter the “Data Controller”, “Agency”, “You”), on the one hand, and VIEGIX LTD, a legal entity incorporated and existing under the laws of Cyprus, registration number: ΗΕ 487784, with its registered office at Agias Faneromenis, 143-145 PATSIAS COURT, Flat/Office 201, 6031 Larnaca, Cyprus (hereinafter the “Data Processor”, “Company”, “OnlyTraffic”), on the other hand. It forms an integral part of any written agreement between You and Company under which Company processes Personal Data on your behalf (each, an “Agreement”), except with respect to any Agreement under which You and Company have entered into data processing terms that address the subject matter hereof.
Data Controller and Data Processor are hereinafter collectively referred to as the “Parties” and the “Party” if referred to separately.
Taking into account that:
WHEREAS, the Data Controller uses the OnlyTraffic platform, a unified ecosystem accessible via the Website through which Agencies may order, pay for and use the Company’s services and access statistical, analytical and other tools made available by the Company (the “Platform”);
WHEREAS, in connection with the Data Controller’s use of the Platform and the Services available through it, the Data Processor may process Personal Data on behalf of and in accordance with the instructions of the Data Controller. The Parties therefore enter into this DPA to establish the terms and conditions applicable to such Processing and their respective rights and obligations in relation thereto;
WHEREAS, this DPA forms an integral part of the OnlyTraffic Terms of Service governing the Data Controller’s use of the Platform and the relevant Services. Unless otherwise defined in this DPA, capitalized terms shall have the meanings assigned to them in the Terms of Service or, where applicable, under the GDPR.
NOW, THEREFORE, the Parties have concluded this DPA and agreed as follows:
1. DEFINITIONS
1.1. “Applicable Data Protection Laws” means all applicable international, federal, state, provincial, and local laws, rules, regulations, directives, and governmental requirements relating in any way to the privacy, confidentiality, protection, transfer, or security of Personal Data, including, without limitation: the EU General Data Protection Regulation 2016/679; the e-Privacy Directive 2002/58/EC (as amended and replaced from time to time) and their national implementing legislations; USA Data Protection Law; laws regulating unsolicited email communications; security breach notification laws; laws imposing minimum security requirements; laws requiring the secure disposal of records containing certain Personal Data; and all other similar applicable international, federal, state, provincial, and local requirements and privacy regulations, as amended from time to time.
1.2. “Data Controller” means a legal entity represented by an authorized individual who accepts the Terms of Service on behalf of such Agency, and that determines the purposes and means of the processing of Personal Data.
1.3. “Data Processor” means Company that processes Personal Data on behalf of the Data Controller under this DPA.
1.4. “Sub-processor” means a third-party subcontractor engaged by the Data Processor, and may process the Data Controller’s personal data on behalf of the Data Processor.
1.5. The terms “Controller”, “Data Subject”, “Personal Data Breach”, “Processing”, “Processor” and “Supervisory Authority” have the meanings assigned to them in the GDPR.
1.6. “USA Data Protection Law” means regulations and rules of the state where Data Subjects are located, in particular if the Data Subjects are in:
1.6.1. California, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) applies,
1.6.2. in Virginia: Virginia Consumer Data Protection Act,
1.6.3. in Colorado: Colorado Privacy Act;
1.6.4. in Connecticut: The Connecticut Data Privacy Act,
1.6.5. in Utah: Utah Consumer Privacy Act,
1.6.6. in Florida: Florida Digital Bill of Rights,
1.6.7. in Oregon: The Oregon Consumer Privacy Act,
1.6.8. in Texas: Texas Data Privacy And Security Act,
1.6.9. in Nevada: CHAPTER 603A, SECURITY AND PRIVACY OF PERSONAL INFORMATION,
1.6.10. in Montana: Montana's Consumer Data Privacy Act,
1.6.11. in Iowa: Iowa Act Relating to Consumer Data Protection,
1.6.12. in Delaware: Delaware Personal Data Privacy Act,
1.6.13. in Nebraska: Nebraska Data Privacy Act,
1.6.14. in New Hampshire: New Hampshire Senate Bill 255,
1.6.15. in New Jersey: New Jersey Senate Bill 332,
1.6.16. in Tennessee: Tennessee Information Protection Act,
1.6.17. in Minnesota: Minnesota Consumer Data Privacy Act,
1.6.18. in Maryland: Maryland Online Data Privacy Act,
1.6.19. in Indiana: Indiana Consumer Data Protection Act (from 01/01/2026),
1.6.20. in Kentucky: Kentucky Consumer Data Protection Act (from 01/01/2026),
1.6.21. in Rhode Island: Rhode Island Data Transparency and Privacy Protection Act (from 01/01/2026).
1.7. Capitalized terms used but not defined herein have the meanings assigned to them in the Terms of Service and Privacy Policy.
2. DATA CONTROLLER OBLIGATIONS
2.1. Data Controller shall provide its Data Subjects with all privacy notices, information, and any necessary choices and shall obtain any necessary consents to enable Data Processor to comply with Applicable Data Protection Law. Where required by Applicable Data Protection Law, the Data Controller shall promptly inform the Data Processor when the Personal Data processed hereunder must be corrected, updated, and/or deleted.
2.2. Data Controller shall ensure that at the point of transferring Data Controller Personal Data to Data Processor, the Data Controller Personal Data is adequate, relevant and limited to what is necessary in relation to the processing contemplated under this DPA.
2.3. The Data Controller affirms and guarantees, and will continue to ensure, that it possesses all necessary legal bases, consents, and rights as mandated by Applicable Data Protection Laws to transfer, disclose, or otherwise provide Personal Data to the Data Processor, and to allow its processing in line with the Privacy Policy and this DPA.
2.4. Specifically, and without limiting the general statements above, the Data Controller recognizes and agrees that it will bear sole responsibility for: (i) the accuracy, quality, and legality of the Personal Data it controls and the methods by which it obtained such Personal Data; (ii) fulfilling all necessary transparency and legality obligations under Applicable Data Protection Laws regarding the collection and utilization of the Personal Data, which includes any required notifications, consents, and authorizations necessary for the Data Controller's use of the Data Processor’s Services; (iii) confirming that it has the authority to transfer or grant access to the Personal Data to the Data Processor for processing as stipulated in the Terms of Service (including this DPA); and (iv) ensuring that the instructions provided to the Data Processor regarding the processing of Personal Data are in compliance with applicable laws, including Applicable Data Protection Laws.
2.5. The Data Controller specifically represents, warrants, and guarantees that:
2.5.1. it holds valid, binding authorization and express written power from each Creator to manage their account, submit credentials (where applicable), and access account data;
2.5.2. its instructions to the Data Processor and the provision of account credentials do not violate any applicable third-party terms of service, platform agreements, or applicable laws;
2.5.3. it shall promptly inform the Data Processor when any Personal Data must be corrected, restricted, or deleted.
3. DATA PROCESSOR OBLIGATIONS
3.1. To the extent necessary to enable the Data Controller to comply with its obligations under Applicable Data Protection Law and the provisions of this DPA, the Data Processor further agrees to comply with any required provisions of the GDPR Schedule to the extent applicable.
3.2. Data Processor shall ensure that when engaging with another data processor (a “Sub-processor”) for the purposes of carrying out specific processing activities on behalf of Data Controller, there is an agreement between Data Processor and the relevant Sub-processor that provides at least the same level of protection for Data Controller Personal Data as set forth in this DPA.
3.3. Data Processor shall ensure that persons authorized to process Data Controller’s Personal Data are under an appropriate obligation of confidentiality in accordance with applicable laws or regulations governing the same.
3.4. Considering the current best practices, the implementation costs, and the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of individuals, the Data Processor will undertake technical and organizational measures to achieve a level of security that is suitable for that risk. In determining the appropriate security level, the Data Processor will particularly consider the risks associated with Data Processing, especially those arising from unauthorized or unlawful processing, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Personal Data of the Data Controller that is transmitted, stored, or otherwise processed.
3.5. In the event of an actual security breach affecting the Data Controller’s Personal Data contained in Data Processor’s systems, Data Processor shall investigate the circumstances, extent and causes of the security breach and report the results to the Data Controller and continue to keep the Data Controller informed on a regular basis of the progress of the Data Processor’s investigation until the issue has been effectively resolved. The obligations herein shall not apply to security breaches caused by the Data Controller.
3.6. Data Processor shall notify the Data Controller without undue delay and no later than 48 hours upon Data Processor becoming aware of an actual security breach affecting the Data Controller’s Personal Data, providing the Data Controller with sufficient information.
3.7. Upon termination or expiration of the Services involving the Processing of Personal Data, the Data Processor shall, at the choice of the Data Controller, delete or return all Personal Data to the Data Controller and delete existing copies, unless Union or Member State law requires retention of the Personal Data.
4. INSTRUCTIONS
4.1. Roles and Instructions. The Parties acknowledge and agree that, with respect to the Processing of Personal Data under this DPA, the Data Controller acts as the data controller and the Data Processor acts as the data processor on behalf of the Data Controller. The Data Processor shall process Personal Data in accordance with Applicable Data Protection Laws and, where applicable, in accordance with the documented instructions of the Data Controller. In the event of any conflict or inconsistency between the Data Controller’s instructions and Applicable Data Protection Laws, the requirements of Applicable Data Protection Laws shall prevail.
4.2. Details of Processing. The Data Controller instructs the Data Processor to process Personal Data as necessary to provide the Platform and the services available through it in accordance with the Terms of Service. The Processing shall be carried out on the following basis:
Subject Matter: provision, operation, and maintenance of the Platform and related Services to the Data Controller;
Nature and Purpose: Processing necessary for the provision, operation and support of the Platform and related Services, including access to statistical, analytical and other tools made available through the Platform;
Categories of Data Subjects:
- Creators whose Personal Data is provided to or otherwise processed through the Platform by or on behalf of the Data Controller;
- Fans/Customers of Creators who interact with managed accounts or purchase content;
- Visitors and End-users of promotional links, tracking URLs, and advertising campaigns.
Types of data: any data or information relating to such individuals that is submitted, collected or otherwise processed through the Platform in connection with the Data Controller’s use of the services that may constitute Personal Data under Applicable Data Protection Laws, including, as applicable:
- Account Access Data
- OnlyFans account session data: session cookies, authentication tokens, and browser user agent data.
- Login credentials: username and password, only where voluntarily provided by the Creator for the purpose of automatic session recovery; such credentials are stored in encrypted form. The same applies to the 2FA key, where provided.
- Account Profile Data (Publicly Available Platform Data)
- Nickname, display name, profile description, profile picture, registration date, account metrics (including number of posts, photos/videos, subscribers, and likes), subscription price, and active promotions.
- Account Financial Data
- Transactions: transaction type (including subscriptions, tips, paid messages, posts, and streams), amounts (gross amount, platform fee, net amount, and taxes), transaction date, status, and chargeback information.
- Interaction and Analytics Data
- Chat interactions: only metadata relating to each message is stored, including timestamp, direction (incoming/outgoing), price of a paid message and whether it was purchased, number and type of attachments (photo/video/audio), and message length in characters.
- Fan purchase history and aggregated fan statistics: total spending, tips, paid content purchases, and number of messages.
- Subscriber/fan lists: numerical platform ID and nickname, subscription status and dates, and total spending, to the extent they constitute Personal Data under applicable Data Protection Law.
- Posts and stories: text, price, view and purchase statistics, and story viewers.
- Profile analytics: daily profile traffic and distribution of views by country.
- Content Data
- Promotional materials: banners, teasers, and other promotional materials independently uploaded by the Creator or the Creator’s agency for promotional purposes.
- Technical Data
- Advertising link visitor data: IP address, country, and click user agent, processed for fraud prevention and conversion tracking purposes.
Duration: for the duration of the Data Controller’s use of the Platform and related services and, thereafter, for such period as may be required or permitted under this DPA or Applicable Data Protection Law.
4.3. Compliance and International Transfers. The Data Processor shall process Personal Data in accordance with this DPA and Applicable Data Protection Law. If compliance with applicable requirements relating to international transfers of Personal Data is materially affected by circumstances beyond the Data Processor’s reasonable control, including the invalidation, amendment or replacement of an applicable transfer mechanism, the Parties shall cooperate in good faith to implement a lawful and reasonably practicable alternative.
5. SUB-PROCESSING
5.1. The Data Controller hereby grants the Data Processor a general authorization to engage Sub-processors for the Processing of Personal Data where necessary for the provision of the Services, without the need to obtain any additional, separate or prior approval or consent from the Data Controller.
5.2. The Data Processor shall enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective than those imposed on the Data Processor under this DPA and Applicable Data Protection Law, to the extent applicable to the Processing performed by such Sub-processor.
5.3. The Data Processor shall remain responsible to the Data Controller for the performance of its Sub-processors’ data protection obligations under this DPA.
6. AUDIT
6.1. The Data Processor shall make available to the Data Controller such information as is reasonably necessary to demonstrate compliance with its obligations under this DPA and Applicable Data Protection Law. Upon reasonable prior written notice, the Data Processor shall allow for and reasonably cooperate with audits or inspections required by a competent Supervisory Authority or reasonably requested by the Data Controller. Any audit requested by the Data Controller shall be conducted by the Data Controller or an independent auditor agreed upon by the Parties, during normal business hours and in a manner that does not unreasonably interfere with the Data Processor’s business operations or compromise the confidentiality or security of information relating to other Users or third parties.
6.2. If the Data Processor reasonably believes that an audit request or instruction relating to an audit infringes Applicable Data Protection Law, the Data Processor shall promptly inform the Data Controller. The Data Processor may suspend the relevant audit activity or withhold the affected information until the Data Controller modifies or confirms the lawfulness of its request or instruction in writing.
6.3. Each Party shall bear its own costs and expenses associated with an audit under this Section, unless otherwise required by Applicable Data Protection Law or agreed by the Parties in writing.
7. LIABILITY
7.1. The liability of each Party arising out of or in connection with this DPA shall be subject to the limitations and exclusions of liability set forth in the Terms of Service. Without prejudice to the foregoing, to the maximum extent permitted by Applicable Law, the Data Processor’s aggregate liability arising out of or in connection with this DPA shall not exceed an amount equal to the total fees actually paid by the Data Controller to the Data Processor during the twelve (12) months immediately preceding the event giving rise to the relevant claim.
7.2. To the extent permitted by applicable law, where the Data Processor has paid compensation, damages or fines under Applicable Data Protection Law, the Data Processor is entitled to claim back from the Data Controller any reimbursement of reasonable expenses, costs, and fees which were incurred as a result of Data Controller's (i) inaccurate, incomplete, or unlawful instructions; and/or (ii) requests for cooperation which are unfounded, excessive, and/or impose unreasonably disproportionate costs to Data Processor.
8. APPLICABLE LAW AND JURISDICTION
8.1. The Processing of the Data Controller’s Personal Data under this DPA is governed by the law of Cyprus.
8.2. The Parties shall attempt to resolve all disputes or disagreements between them regarding the execution of the DPA through direct good-faith negotiations.
8.3. If the Parties do not reach an agreement within 30 (thirty) days, the dispute may be referred to the court of Nicosia, Cyprus.
8.4. Severability. If any portion of this DPA is held invalid or unenforceable, that portion shall be construed in a manner to reflect, as nearly as possible, the original intention of the Parties, and the remaining portions shall remain in full force and effect.
9. FINAL PROVISIONS
9.1. Incorporation and Acceptance. This DPA forms an integral part of the Terms of Service and applies to the Processing of Personal Data by the Data Processor on behalf of the Data Controller in connection with the Services. By accepting the Terms of Service, the Data Controller acknowledges that it has read, understood and agreed to be bound by this DPA. No separate acceptance of this DPA is required.
9.2. Term. This DPA shall become effective upon the Data Controller’s acceptance of the Terms of Service and shall remain in effect for as long as the Data Processor Processes Personal Data on behalf of the Data Controller in connection with the Services.
9.3. Deletion or Return of Personal Data. Upon termination or expiry of the Services involving the Processing of Personal Data, the Data Processor shall, at the Data Controller’s choice, delete or return the Personal Data processed on its behalf and shall ensure that its Sub-processors do the same, unless retention of such Personal Data is required by Applicable Law.
9.4. Relationship with the Terms of Service. This DPA supplements and forms part of the Terms of Service. Matters not expressly addressed in this DPA shall be governed by the Terms of Use. In the event of any conflict between this DPA and the Terms of Use with respect to the Processing of Personal Data, this DPA shall prevail to the extent of such conflict.
9.5. Amendments. The Data Processor may amend or update this DPA from time to time, including where necessary to reflect changes to the Services or Applicable Data Protection Law. Any updated version shall become effective upon its publication on the Website, unless otherwise specified. The Data Controller’s continued use of the Services following the effective date of an updated DPA shall constitute acceptance of such updated DPA.
9.6. Language. In the event that this DPA is made available in more than one language, the English-language version shall prevail in the event of any inconsistency.