Partners Data Processing Agreement
This Data Processing Agreement (the “DPA”) is entered into between VIEGIX LTD, a legal entity incorporated and existing under the laws of Cyprus, registration number ΗΕ 487784, with its registered office at Agias Faneromenis, 143-145 PATSIAS COURT, Flat/Office 201, 6031 Larnaca, Cyprus (hereinafter the “Company” or “OnlyTraffic”), on the one hand, and the Partner, that has accepted the applicable OnlyTraffic Terms of Service governing the cooperation between the Company and the Partner (hereinafter the “Partner” or “You”), on the other hand.
This DPA is intended to cover different configurations of the Processing of Personal Data between the Company and the Partner. The respective roles of the Parties shall be determined by the nature and purposes of the relevant Processing activities and in accordance with Applicable Data Protection Laws. Depending on the particular Processing activity, the following configurations may apply:
Controller-to-Processor Configuration. Where the Company determines the purposes and means of the Processing of Personal Data and the Partner Processes such Personal Data on behalf of the Company in connection with the provision of the Services, the Company shall act as the Data Controller and the Partner shall act as the Data Processor.
Processor-to-Sub-processor Configuration. Where the Company Processes Personal Data on behalf of a third-party Data Controller (Agencies), pursuant to the applicable Data Processing Agreement entered into between the Company and such Agency, available at https://onlytraffic.com/dpa, and engages the Partner to carry out certain Processing activities in connection with the provision of the Services, the Company shall act as the Data Processor and the Partner shall act as the Sub-processor in respect of such Personal Data, while the relevant third party shall remain the Data Controller.
The applicable configuration and the respective roles of the Parties shall be determined separately in respect of each relevant Processing activity. Where the Partner acts as a Sub-processor, the provisions of this DPA applicable to the Partner as a Data Processor shall apply mutatis mutandis, to the extent applicable to the relevant Processing and taking into account the respective roles of the Parties.
The Company and the Partner are hereinafter collectively referred to as the “Parties” and individually as a “Party”.
WHEREAS, the Company operates the OnlyTraffic platform, a unified ecosystem accessible via the Website that facilitates cooperation between the Company, Agencies, Creators and Partners and provides access to statistical, analytical, tracking and other tools (the “Platform”);
WHEREAS, the Partner provides advertising, promotional, traffic acquisition and related services to the Company in accordance with the applicable terms governing the cooperation between the Company and the Partner (the “Services”);
WHEREAS, for the purpose of receiving the Services from the Partner and enabling the Partner to properly perform such Services, the Company may provide the Partner, through the Platform, with access to certain Personal Data relating to Creators, fans and visitors;
WHEREAS, in connection with the provision of the Services, the Partner may Process such Personal Data solely on behalf of and in accordance with the Applicable Data Protection Laws and, where applicable, documented instructions of the Company;
WHEREAS, the Parties wish to establish the terms and conditions applicable to such Processing and their respective rights and obligations under Applicable Data Protection Laws.
NOW, THEREFORE, the Parties agree as follows:
1. DEFINITIONS
1.1. “Applicable Data Protection Laws” means all applicable international, federal, state, provincial, and local laws, rules, regulations, directives, and governmental requirements relating in any way to the privacy, confidentiality, protection, transfer, or security of Personal Data, including, without limitation: the EU General Data Protection Regulation 2016/679; the e-Privacy Directive 2002/58/EC (as amended and replaced from time to time) and their national implementing legislations; USA Data Protection Law; laws regulating unsolicited email communications; security breach notification laws; laws imposing minimum security requirements; laws requiring the secure disposal of records containing certain Personal Data; and all other similar applicable international, federal, state, provincial, and local requirements and privacy regulations, as amended from time to time.
1.2. “Data Controller” means a natural person or a legal entity, which determines the purposes and means of the Processing of Personal Data covered by this DPA.
1.3. “Data Processor” means a natural person or a legal entity, which Processes Personal Data on behalf of and in accordance with the documented instructions of the Data Controller under this DPA.
1.4. “Sub-processor” means a third-party subcontractor engaged by the Data Processor, and may process the Data Controller’s personal data on behalf of the Data Processor.
1.5. The terms “Controller”, “Data Subject”, “Personal Data Breach”, “Processing”, “Processor” and “Supervisory Authority” have the meanings assigned to them in the GDPR.
1.6. “USA Data Protection Law” means regulations and rules of the state where Data Subjects are located, in particular if the Data Subjects are in:
1.6.1. California, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) applies,
1.6.2. in Virginia: Virginia Consumer Data Protection Act,
1.6.3. in Colorado: Colorado Privacy Act;
1.6.4. in Connecticut: The Connecticut Data Privacy Act,
1.6.5. in Utah: Utah Consumer Privacy Act,
1.6.6. in Florida: Florida Digital Bill of Rights,
1.6.7. in Oregon: The Oregon Consumer Privacy Act,
1.6.8. in Texas: Texas Data Privacy And Security Act,
1.6.9. in Nevada: CHAPTER 603A, SECURITY AND PRIVACY OF PERSONAL INFORMATION,
1.6.10. in Montana: Montana's Consumer Data Privacy Act,
1.6.11. in Iowa: Iowa Act Relating to Consumer Data Protection,
1.6.12. in Delaware: Delaware Personal Data Privacy Act,
1.6.13. in Nebraska: Nebraska Data Privacy Act,
1.6.14. in New Hampshire: New Hampshire Senate Bill 255,
1.6.15. in New Jersey: New Jersey Senate Bill 332,
1.6.16. in Tennessee: Tennessee Information Protection Act,
1.6.17. in Minnesota: Minnesota Consumer Data Privacy Act,
1.6.18. in Maryland: Maryland Online Data Privacy Act,
1.6.19. in Indiana: Indiana Consumer Data Protection Act (from 01/01/2026),
1.6.20. in Kentucky: Kentucky Consumer Data Protection Act (from 01/01/2026),
1.6.21. in Rhode Island: Rhode Island Data Transparency and Privacy Protection Act (from 01/01/2026).
1.7. Capitalized terms used but not defined herein have the meanings assigned to them in the Terms of Service and Privacy Policy.
2. COMPANY OBLIGATIONS
2.1. Company shall provide its Data Subjects with all privacy notices, information, and any necessary choices and shall obtain any necessary consents to enable Partner to comply with Applicable Data Protection Law. Where required by Applicable Data Protection Law, the Company shall promptly inform the Partner when the Personal Data processed hereunder must be corrected, updated, and/or deleted.
2.2. Company shall ensure that at the point of transferring Personal Data to Partner, such Personal Data is adequate, relevant and limited to what is necessary in relation to the processing contemplated under this DPA.
2.3. The Company affirms and guarantees, and will continue to ensure, that it possesses all necessary legal bases, consents, and rights as mandated by Applicable Data Protection Laws to transfer, disclose, or otherwise provide Personal Data to the Partner, and to allow its processing in line with the Privacy Policy and this DPA.
2.4. Specifically, and without limiting the general statements above, the Company recognizes and agrees that it will bear sole responsibility for: (i) the accuracy, quality, and legality of the Personal Data it controls and the methods by which it obtained such Personal Data; (ii) fulfilling all necessary transparency and legality obligations under Applicable Data Protection Laws regarding the collection and utilization of the Personal Data, which includes any required notifications, consents, and authorizations necessary for the Data Controller's or Data Processor's use of the Partner’s Services; (iii) confirming that it has the authority to transfer or grant access to the Personal Data to the Partner for processing as stipulated in the Terms of Service (including this DPA); and (iv) ensuring that the instructions provided to the Partner regarding the processing of Personal Data are in compliance with applicable laws, including Applicable Data Protection Laws.
2.5. The Company specifically represents, warrants, and guarantees that:
2.5.1. it holds valid, binding authorization and express written power from each Creator or has lawfully obtained the relevant information and/or authorization from an Agency acting on behalf of or in relation to such Creator, to manage their account, submit credentials (where applicable), and access account data;
2.5.2. its instructions to the Partner and the provision of account credentials do not violate any applicable third-party terms of service, platform agreements, or applicable laws;
2.5.3. it shall promptly inform the Partner when any Personal Data must be corrected, restricted, or deleted.
3. PARTNER OBLIGATIONS
3.1. The Partner shall Process Personal Data solely on behalf of the Company and only to the extent necessary to provide the Services to the Company in accordance with this DPA and the Data Controller’s documented instructions. Where the Company acts as a Data Processor on behalf of a third-party Data Controller, the Partner shall Process such Personal Data as a Sub-processor, subject to the Applicable Data Protection Laws, instructions, restrictions and requirements communicated to the Partner by the Company.
3.2. Regardless of whether the Partner acts as a Data Processor or a Sub-processor, the Partner shall comply with the following obligations:
3.2.1. The Partner shall not Process, disclose, sell, share, retain or otherwise use Personal Data for its own purposes or for any purpose other than the provision of the Services to the Company, except where otherwise required by Applicable Law.
3.2.2. The Partner shall ensure that any person authorized to Process Personal Data is subject to appropriate confidentiality obligations and Processes such Personal Data only to the extent necessary for the performance of their duties and in accordance with the Company’s instructions.
3.2.3. Taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the Processing, as well as the risks to the rights and freedoms of Data Subjects, the Partner shall implement appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including protection against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.
3.2.4. The Partner shall provide reasonable assistance to the Company in ensuring compliance with its obligations relating to security of Processing, Personal Data Breach notifications, data protection impact assessments and consultations with Supervisory Authorities, taking into account the nature of the Processing and the information available to the Partner.
3.2.5. The Partner shall notify the Company without undue delay and, where reasonably practicable, no later than forty-eight (48) hours after becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA. The Partner shall provide the Company with information reasonably necessary to assess and respond to the Personal Data Breach and shall reasonably cooperate with the Company in investigating and mitigating its effects.
3.2.6. Upon termination or expiration of the Services involving the Processing of Personal Data, the Partner shall, at the choice of the Company, delete or return all Personal Data to the Company and delete existing copies, unless Union or Member State law requires retention of the Personal Data.
4. INSTRUCTIONS AND DETAILS OF PROCESSING
4.1. Instructions. The Partner shall process Personal Data in accordance with Applicable Data Protection Laws and, where applicable, in accordance with the documented instructions of the Company. In the event of any conflict or inconsistency between the Company’s instructions and Applicable Data Protection Laws, the requirements of Applicable Data Protection Laws shall prevail. The Partner shall promptly inform the Company if, in its reasonable opinion, an instruction infringes Applicable Data Protection Laws.
4.2. Details of Processing. The Company instructs the Partner to Process Personal Data solely to the extent necessary for the performance of the Services by the Partner for the benefit of the Company, including the promotion of Creators, traffic acquisition, operation and evaluation of advertising campaigns, attribution of traffic and conversions, campaign performance analysis and other related activities agreed between the Parties. The Processing shall be carried out on the following basis:
Subject Matter: Processing of Personal Data made available by the Company to the Partner through the Platform to the extent necessary for the Partner to provide the Services to the Company.
Nature and Purpose: accessing, viewing and otherwise Processing limited Personal Data for the purposes of selecting and evaluating Creator offers, conducting promotional and advertising activities, generating and acquiring traffic, operating and assessing campaigns, tracking traffic and conversions, analysing campaign performance and performing other activities necessary for the provision of the Services to the Company.
Categories of Data Subjects:
- Creators whose offers are made available to the Company for promotion.
Types of data: any data or information relating to such individuals that is submitted, collected or otherwise processed through the Platform in connection with the Company’s use of the services that may constitute Personal Data under Applicable Data Protection Laws, including, as applicable:
- Creator Public Profile and Offer Data
- Creator account nickname or an anonymized code identifier where the Creator’s identity is hidden;
- profile picture/avatar;
- subscription price;
- active promotions;
- restricted or excluded countries; and
- tags associated with the relevant Creator or offer.
- Aggregated Creator Account Statistics
- trends in the number of fans;
- average revenue per fan; and
- aggregated conversion metrics, including first purchases, repeat purchases and high-value spenders.
- Partner Campaign Data
- information relating exclusively to fans attributed to the Partner’s own campaigns, provided in a pseudonymized or otherwise limited form, including numerical fan ID, subscription date, total spending and behavioral indicators; and
- information relating to the Partner’s remuneration generated through such campaigns.
- Advertising and Tracking Data
- click and traffic statistics relating to the Partner’s own advertising or tracking links, including country, timestamp and technical parameters associated with the relevant visit.
- Promotional Content and Materials
- promotional materials provided by the relevant Creator or Agency specifically for advertising and promotional purposes; and
- tracking links made available to the Partner in connection with the relevant campaign.
Duration: for the duration of the Partner’s provision of the Services to the Company and for as long as access to the relevant Personal Data is necessary for such purpose. Following termination or completion of the relevant Services, Personal Data may be Processed only for such period as required by Applicable Law or expressly instructed by the Company.
Access Limitation: The Partner shall have access only to the Personal Data and information made available through its Partner account and only to the extent necessary for the provision of the Services. Where information relates to campaigns, fans, clicks, conversions or similar performance data, the Partner shall have access only to information relating to its own campaigns, unless otherwise expressly authorized by the Company.
4.3. Compliance and International Transfers. The Partner shall process Personal Data in accordance with this DPA and Applicable Data Protection Law. If compliance with applicable requirements relating to international transfers of Personal Data is materially affected by circumstances beyond the Partner’s reasonable control, including the invalidation, amendment or replacement of an applicable transfer mechanism, the Parties shall cooperate in good faith to implement a lawful and reasonably practicable alternative.
5. SUB-PROCESSING
5.1. The Partner shall not engage any Sub-processor to Process Personal Data under this DPA without the Company’s prior specific or general written authorization.
5.2. Where the Company provides general written authorization, the Partner shall inform the Company in writing of any intended addition or replacement of a Sub-processor, thereby giving the Company a reasonable opportunity to object to such change on reasonable data protection grounds.
5.3. The Partner shall enter into a written agreement with each authorized Sub-processor imposing data protection obligations that are no less protective than those imposed on the Partner under this DPA and Applicable Data Protection Laws, to the extent applicable to the Processing performed by such Sub-processor.
5.4. The Partner shall remain responsible to the Company for the performance of its Sub-processors’ data protection obligations under this DPA.
6. AUDIT
6.1. The Partner shall make available to the Company such information as is reasonably necessary to demonstrate compliance with its obligations under this DPA and Applicable Data Protection Law. Upon reasonable prior written notice, the Partner shall allow for and reasonably cooperate with audits or inspections required by a competent Supervisory Authority or reasonably requested by the Company. Any audit requested by the Company shall be conducted by the Company or an independent auditor agreed upon by the Parties, during normal business hours and in a manner that does not unreasonably interfere with the Partner’s business operations or compromise the confidentiality or security of information relating to other Users or third parties.
6.2. If the Partner reasonably believes that an audit request or instruction relating to an audit infringes Applicable Data Protection Law, the Partner shall promptly inform the Company. The Partner may suspend the relevant audit activity or withhold the affected information until the Company modifies or confirms the lawfulness of its request or instruction in writing.
6.3. Each Party shall bear its own costs and expenses associated with an audit under this Section, unless otherwise required by Applicable Data Protection Law or agreed by the Parties in writing.
7. LIABILITY
7.1. The liability of each Party arising out of or in connection with this DPA shall be subject to the limitations and exclusions of liability set forth in the Terms of Service.
8. APPLICABLE LAW AND JURISDICTION
8.1. The Processing of the Company’s Personal Data under this DPA is governed by the law of Cyprus.
8.2. The Parties shall attempt to resolve all disputes or disagreements between them regarding the execution of the DPA through direct good-faith negotiations.
8.3. If the Parties do not reach an agreement within 30 (thirty) days, the dispute may be referred to the court of Nicosia, Cyprus.
8.4. Severability. If any portion of this DPA is held invalid or unenforceable, that portion shall be construed in a manner to reflect, as nearly as possible, the original intention of the Parties, and the remaining portions shall remain in full force and effect.
9. FINAL PROVISIONS
9.1. Incorporation and Acceptance. This DPA forms an integral part of the applicable terms governing the cooperation between the Company and the Partner and the Partner’s provision of the Services to the Company. By accepting such terms, the Partner acknowledges that it has read, understood and agreed to be bound by this DPA. No separate acceptance of this DPA is required.
9.2. Term. This DPA shall become effective upon the Partner’s acceptance of the Terms of Service and shall remain in effect for as long as the Partner Processes Personal Data on behalf of the Company in connection with the Services.
9.3. Deletion or Return of Personal Data. Upon termination or expiry of the Services involving the Processing of Personal Data, the Partner shall, at the Company’s choice, delete or return the Personal Data processed on its behalf and shall ensure that its Sub-processors do the same, unless retention of such Personal Data is required by Applicable Law.
9.4. Relationship with the Terms of Service. This DPA supplements and forms part of the Terms of Service. Matters not expressly addressed in this DPA shall be governed by the Terms of Use. In the event of any conflict between this DPA and the Terms of Use with respect to the Processing of Personal Data, this DPA shall prevail to the extent of such conflict.
9.5. Amendments. The Company may amend or update this DPA from time to time, including where necessary to reflect changes to the Services or Applicable Data Protection Law. Any updated version shall become effective upon its publication on the Website, unless otherwise specified. The Partner’s continued use of the Platform following the effective date of an updated DPA shall constitute acceptance of such updated DPA.
9.6. Language. In the event that this DPA is made available in more than one language, the English-language version shall prevail in the event of any inconsistency.