Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") is between NGSMEDIA LLC (trading as "Affiliateo") and the customer entity that has accepted Affiliateo's Terms of Service("Customer"). This DPA forms part of the Terms of Service and governs how Affiliateo processes personal data on Customer's behalf when Customer installs the Affiliateo tracking script, mobile SDK, or any equivalent integration provided by Affiliateo (the "Service").

By accepting the Terms of Service and using the Service, Customer agrees to this DPA. Capitalized terms not defined here have the meaning given to them in the Terms of Service or in the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR").

Contents

1. 1. Key Terms
2. 2. Scope of Processing
3. 3. Roles and Responsibilities
4. 4. Data Retention
5. 5. Subprocessors
6. 6. International Data Transfers
7. 7. Security Measures
8. 8. Data Subject Requests
9. 9. Data Access and Exports
10. 10. Breach Notification
11. 11. Audits
12. 12. Termination and Deletion
13. 13. Governing Law
14. 14. Contact

1. Key Terms

2. Scope of Processing

When Customer installs the Affiliateo tracking script or mobile SDK on its websites or applications, Affiliateo collects and processes the following categories of personal data on Customer's behalf:

• •IP address, user agent string, browser family, device type, and operating system.
• •Approximate geolocation derived from IP address (country, region, and city, with latitude and longitude rounded to roughly 1 km).
• •Persistent identifiers stored on the visitor's device (in browser localStorage for web, in equivalent on-device storage for mobile apps), including a randomly generated visitor ID, the referring affiliate code, the app ID, and Apple/Google in-app purchase attribution tokens where applicable.
• •Page or screen activity, referrer URL, UTM parameters, and session timing.
• •Payment metadata that Customer sends to Affiliateo at conversion time (for example, the affiliate reference embedded in Stripe checkout metadata) so that the correct affiliate can be credited.

Affiliateo processes this data exclusively to:

• •Attribute clicks, signups, and purchases to the affiliate that referred them.
• •Generate analytics, dashboards, funnels, and reports for Customer.
• •Calculate, process, and pay out affiliate commissions on Customer's behalf.
• •Detect and prevent fraud, abuse, and security incidents affecting the Service.

Affiliateo will not use Customer's data for Affiliateo's own marketing or profiling, and will not sell or share Customer's data with third parties except as described in Section 5 (Subprocessors) or as required by law.

3. Roles and Responsibilities

4. Data Retention

Affiliateo retains personal data processed on Customer's behalf only for as long as necessary to provide the Service and to meet legal obligations. Specific retention periods are documented in the Privacy Policy. In summary:

Customer may request earlier deletion of specific records at any time by contacting support@affiliateo.com.

5. Subprocessors

Affiliateo engages the following subprocessors to provide the Service:

Affiliateo may engage additional or replacement subprocessors. Material changes to this list will be reflected on this page. Customer may object to a new subprocessor on reasonable data-protection grounds by contacting support@affiliateo.com within 30 days of the change.

6. International Data Transfers

Affiliateo's infrastructure and the majority of its subprocessors are located outside the European Economic Area, primarily in the United States. Personal data of EU, EEA, and UK residents will therefore be transferred internationally.

Where required, Affiliateo relies on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with the equivalent commitments made by its subprocessors, to safeguard such transfers. By accepting this DPA, Customer authorizes Affiliateo to enter into the SCCs with subprocessors on Customer's behalf where required to enable the Service.

7. Security Measures

Affiliateo implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including:

• •Encryption of data in transit using TLS 1.2 or higher across all public endpoints.
• •Encryption of data at rest via Affiliateo's infrastructure providers (Supabase, Cloudflare R2).
• •Row-level security policies enforced by the database so that Customer data is isolated and only accessible to authorized roles.
• •Role-based access controls limiting administrative access to authorized Affiliateo personnel.
• •Rate limiting, bot detection (Cloudflare Turnstile), and signed webhook verification on financial endpoints.
• •Regular automated backups maintained by the database provider.
• •Hosting with vendors that maintain industry-recognized security certifications (SOC 2, ISO 27001, or equivalent).

8. Data Subject Requests

As controller, Customer is responsible for responding to requests from its visitors to exercise their rights under GDPR Articles 15-22 or equivalent law (access, rectification, erasure, restriction, portability, and objection).

Affiliateo will provide reasonable assistance, taking into account the nature of the processing, by making available to Customer the visitor data held by Affiliateo and by deleting specific records on Customer's instruction. Requests may be sent to support@affiliateo.com.

9. Data Access and Exports

Affiliateo provides Customer with access to the personal data processed on Customer's behalf through its dashboard. Exports reflect the data as stored by the Service. Affiliateo does not provide consolidated archive exports or raw event logs beyond what is retained in the Service.

10. Breach Notification

Affiliateo will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data and will provide Customer with the information reasonably necessary to enable Customer to comply with its own notification obligations under GDPR Article 33 or equivalent law.

11. Audits

Affiliateo will, on Customer's reasonable written request and no more than once per twelve-month period (except where required by a supervisory authority), provide Customer with information necessary to demonstrate compliance with this DPA. This may take the form of subprocessor attestations, summaries of security controls, or written responses to a reasonable questionnaire.

12. Termination and Deletion

On termination of the Terms of Service, Affiliateo will, at Customer's choice, return or delete the personal data processed on Customer's behalf, except where retention is required by law (for example, transaction records for tax and accounting). Deletion of app data, analytics, and visitor records follows the retention windows set out in Section 4.

13. Governing Law

This DPA is governed by the laws of the State of Wyoming, United States, without regard to its conflict-of-law principles, and is incorporated into and subject to the dispute-resolution provisions of the Terms of Service. Where EU or UK data protection law applies, the EU Standard Contractual Clauses and UK International Data Transfer Addendum take precedence to the extent of any conflict in respect of restricted international transfers.

14. Contact

Questions about this DPA or requests related to data protection may be sent to:

By using the Service, Customer agrees to this DPA.