Data Processing Agreement

This Data Processing Agreement ("DPA") is between Mars Media Group ("MarsDSP", "we") and the advertiser or agency that holds a MarsDSP account ("you"). It forms part of the Terms of Service and applies whenever we process personal data on your behalf. You accept it with the Terms; there is nothing to sign.

For measurement data you send us (pixel events, conversion API calls and postbacks from your measurement partners) you are the controller and we are your processor or service provider. For account data (your users, team and billing) we are the controller, as the Privacy Policy describes.

• Subject matter and purpose: measuring and optimizing your campaigns, attributing conversions, building the audiences you ask for and reporting results to you.
• Data subjects: visitors of your sites and users of your apps who interact with your ads.
• Data: event name, value, currency and time; with consent, a click identifier; device identifiers and emails only as one-way hashes; IP address and user agent for fraud checks.
• Duration: for as long as your account is open, then deleted as the Deletion section describes.

We process the data only on your documented instructions: the Terms, this DPA and the settings you choose in the product (for example the pixel's consent mode). If an instruction seems to break data protection law, we tell you.

We keep appropriate technical and organizational measures, described in the Trust center: encryption in transit, role-based access, an append-only activity log, separation between brands, a managed database with daily backups, and secrets kept only in the hosting platform's encrypted settings.

Everyone at Mars Media Group who can reach the data is bound by confidentiality.

You allow us to use the subprocessors listed in the Trust center. We bind each one to data protection terms at least as protective as this DPA and stay responsible for them. We update the list before a new subprocessor starts; you may object by writing to [email protected], and if we cannot address the objection you may close your account.

We help you answer data subject requests (access, correction, deletion, objection) and with data protection impact assessments where needed.

If we become aware of a personal data breach affecting your data, we tell you without undue delay, with what we know and what we are doing about it, and keep you updated.

Where data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum), which are incorporated into this DPA by reference.

When your account closes, we delete or anonymize your measurement data, unless the law requires us to keep it. Backups roll over on their normal schedule.

On request we give you the information needed to show that we meet this DPA. Where that is not enough, an audit can be agreed in writing, with reasonable notice and confidentiality, at most once a year.

Liability, governing law and jurisdiction follow the Terms of Service. If this DPA and the Terms conflict on personal data, this DPA wins.