ASTRAD Data Processing Agreement

Last Updated: July 7, 2026

This Data Processing Addendum (“DPA”) supplements and forms an integral part of the ASTRAD Platform Terms of Service (“Terms” or “Agreement”) entered into between Athropos Corporation OÜ (“ASTRAD”) and the entity executing the Account Activation Form (“Client”).

This DPA governs the Processing of Personal Data in connection with the advertising infrastructure, programmatic software routing, and campaign execution services provided by ASTRAD under the Agreement.

1. Definitions & Framework

1.1 Core Terms

The terms “Controller”, “Processor”, “Personal Data”, “Processing”, and “Data Subject” shall have the meanings ascribed to them under Regulation (EU) 2016/679 (the General Data Protection Regulation or “GDPR”).

1.2 Status of the Parties

The parties explicitly acknowledge and agree that with respect to the Processing of Personal Data generated by or submitted through advertising campaigns routed across the Platform:

Client acts as the Data Controller (possessing primary legal responsibility for establishing the lawful basis for data collection, target parameter selections, and user consent).

ASTRAD acts as the Data Processor (serving strictly as an infrastructure provider and technical intermediary processing data on behalf of and under the documented commercial instructions of the Client, as outlined in this DPA and the underlying Agreement).

2. Scope & Instructions for Processing

2.1 Purpose of Processing

ASTRAD shall process Personal Data solely to provide, maintain, and optimize its programmatic infrastructure routing software, route automated bid requests across networks, track campaign performance logs, and execute security screening to prevent invalid traffic (IVT) or click fraud as permitted under the Agreement.

2.2 Types of Data Processed

The Personal Data processed includes digital telemetry and ad-delivery identifiers passing through our routing interfaces, including but not limited to: IP addresses, Mobile Advertising Identifiers (IDFA / GAID), cookie IDs, browser user-agent strings, geographic location parameters (derived from network parameters), and platform usage logs.

2.3 Categories of Data Subjects

The processing covers individual end-users (consumers) interacting with websites, mobile applications, and digital media environments connected to the programmatic supply networks and ad exchanges utilized by the Platform.

3. Technical & Organizational Safeguards

ASTRAD shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. These measures include:

Restricting internal access to live platform data streams on a strict needle-to-know basis.

Utilizing industry-standard encryption protocols for data in transit and at rest across cloud infrastructure nodes.

Deploying active network security monitoring, firewalls, and pseudonymization layers over programmatic bidding and traffic routing logs.

4. Sub-processors

4.1 Authorization to Engage

Client grants a general written authorization to ASTRAD to engage third-party sub-processors (such as cloud hosting infrastructure partners, data centers, ad-exchange aggregators, data pipes, and security verification tools) to facilitate the core programmatic software routing infrastructure.

4.2 Notification of Sub-processor Changes

ASTRAD shall maintain an updated list of its active sub-processors. ASTRAD will provide notification of any intended addition or replacement of its sub-processors via electronic mail or direct platform dashboard notification at least thirty (30) days prior to the engagement. Client may object to the new sub-processor on reasonable data protection grounds within ten (10) calendar days of receiving notice.

If Client objects to a necessary infrastructure sub-processor and an alternative configuration cannot be mutually arranged, ASTRAD reserves the right to immediately terminate the Client’s platform account for convenience, providing a refund of any remaining verified prepaid funds in accordance with the Terms of Service.

5. Data Breaches & Security Incidents

5.1 Notification Timeline

In the event that ASTRAD confirms a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed via the Platform (a “Security Incident”), ASTRAD shall notify Client without undue delay, and in any event, within forty-eight (48) hours of verifying the incident.

5.2 Content & Cooperation

ASTRAD’s notification shall provide reasonable details regarding the nature of the breach, the estimated categories of data subjects affected, and the mitigation steps being deployed. ASTRAD shall cooperate in good faith with Client to assist them in meeting their regulatory reporting duties under GDPR Articles 33 and 34.

6. Audit Rights & Compliance Cooperation

6.1Desk Audits & Data Request Redirection

Redirection of Requests: ASTRAD acts strictly as a technical pipeline intermediary (Data Processor). If ASTRAD receives any direct request from a Data Subject or regulatory auditor under GDPR seeking access, deletion, or log trails, ASTRAD shall immediately reject or redirect such query to the Client. ASTRAD will not communicate directly with End-Users or third-party claimants.

Audit Boundaries: Client’s audit rights are strictly limited to requesting copies of ASTRAD’s standardized, independent security summaries or third-party infrastructure certifications. Client holds no right to inspect ASTRAD’s core software code, algorithmic routing pipelines, multi-tenant database infrastructure, or upstream ad-exchange logs.

6.2 On-Site Restrictions

Physical, on-site audits of ASTRAD’s data routing setups or server environments are explicitly prohibited due to the multi-tenant nature of the programmatic platform and the confidentiality rights of other network users, unless explicitly mandated by an official order from a competent European Data Protection Authority.

7. Data Deletion & Retention

Following expiration or termination of the underlying Agreement, or upon the written request of the Client, ASTRAD shall securely delete or anonymize all historical campaign logs containing Personal Data within ninety (90) days, unless European Union or Estonian national law explicitly requires the prolonged storage of transactional records for financial, tax, or corporate reporting compliance.

8. Data-Related Liability Limitations

Notwithstanding anything to the contrary contained within the Master Agreement, this DPA, or any accompanying Insertion Order, the total collective liability of ASTRAD for any regulatory fines, data breach claims, or statutory privacy violations arising out of this DPA shall be strictly governed by, and capped at, the maximum financial liability ceiling explicitly defined in Section 6.1 of the ASTRAD Platform Terms of Service.

This matches the updated Terms of Service and Privacy Policy exactly. Your web team is now fully equipped to push the complete legal framework live to the site.