This Agreement applies when VALTEVO, Unipessoal Lda (adPluga) processes personal data on behalf of a Customer and when the adPluga tag or an SDK collects data on an Integrator's properties. It is part of the Terms of Use and is accepted with them; in a conflict about personal data, this Agreement prevails.
1. Roles
adPluga processes data in three situations, and its role depends on the situation:
- Processor — when it processes data on the Customer's behalf: first-party audiences uploaded by the Advertiser, and the delivery and measurement of the Customer's own campaigns on its own properties.
- Joint controllers — in the collection of data by the tag or SDK on the Integrator's properties when they serve adPluga demand (Marketplace, POOL, DIRETO, mediation). Section 12 sets out each party's responsibilities.
- Controller — for account, billing and Service security data, under the Privacy Policy.
2. Subject matter and duration
Processing serves to provide the Service described in the Terms: delivering, measuring and protecting ads and managing audiences. It lasts while the Customer uses the Service and ends under section 10.
3. Data and data subjects
Categories processed on the Customer's behalf:
- Data subjects — visitors to the Integrator's properties and people included in the Advertiser's audiences.
- Identifiers — the pseudonymous browser or app identifier (with consent only) and the hashed identifiers the Advertiser includes in audiences.
- Technical data — IP address and user agent, stored only as hashes; country; device type; property and slot.
- Events — impressions, clicks, viewability and conversions.
- We do not process special categories of data (Article 9) or data relating to criminal convictions.
4. Customer instructions
adPluga processes the data only on the Customer's documented instructions: these Terms, this Agreement and the configuration the Customer sets in the dashboard or the API. If an instruction infringes the law, adPluga informs the Customer and may suspend it. adPluga does not use Customer data for its own purposes, other than those in section 1 where it is a controller.
5. Confidentiality
Only staff who need the data to provide the Service have access to it, bound by confidentiality, with role-based and audited access.
6. Security
Technical and organisational measures in place (Article 32):
- In transit — TLS on every public connection.
- Pseudonymisation — IP address and user agent stored only as hashes; the browser identifier exists only with consent.
- Isolation — each Customer sees only its own data, through row-level security in the database.
- Access — roles with distinct permissions, network credentials encrypted (AES-GCM) and encrypted backups.
- Minimisation — IP and user-agent hashes and audience members deleted after 365 days; technical logs with the IP in clear deleted after 7 days.
- Creatives — shown in an isolated iframe, with no access to the Integrator's page.
7. Subprocessors
The Customer authorises adPluga to use the subprocessors below. We give at least 30 days' notice before adding or replacing one, and the Customer may object on reasonable grounds. Each is bound by contract to obligations equivalent to those in this Agreement.
- Contabo GmbH (Germany) — servers for the API, database and cache.
- Cloudflare, Inc. (USA) — content delivery network and proxy for every request, storage of creatives and of encrypted backups.
- Amazon Web Services (AWS Amplify, Ireland) — hosting of the website and dashboard.
- Google (Firebase Authentication and Gmail) — sign-in with Google and account emails.
- Stripe Payments Europe, Ltd. (Ireland) — payments and payouts.
- Anthropic PBC (USA) — answers from the dashboard assistant, with the questions of whoever uses it and the account's status; conversations are deleted after 90 days.
8. Assistance to the Customer
adPluga helps the Customer respond to data subject requests (access, rectification, erasure, objection, portability), meet its security obligations, notify breaches and carry out impact assessments, as far as the data it processes on the Customer's behalf allows. A request that reaches adPluga about a Customer's data is forwarded to the Customer.
9. Personal data breaches
adPluga notifies the Customer without undue delay and in any event within 48 hours of becoming aware of a breach affecting data processed on its behalf, with the nature of the breach, the data and data subjects affected, the likely consequences and the measures taken.
10. End of processing
The Customer can delete its audiences at any time through the audiences API, and audience members are deleted automatically after 365 days. When the relationship ends, the Customer requests deletion of the account at privacidade@adpluga.com and adPluga deletes its audiences and configuration data within 30 days. Events are kept for the billing period and legal obligations, without IP and user-agent hashes after 365 days. The Customer may export its reports before deletion.
11. Information and audits
adPluga makes available to the Customer the information needed to demonstrate compliance with this Agreement. The Customer may request an audit, at most once a year and with 30 days' notice, carried out by itself or by an auditor bound by confidentiality, with no access to other Customers' data.
12. Joint controllership of the tag and SDK
When the tag or SDK serves adPluga demand on the Integrator's properties, the parties are joint controllers for the collection and transmission of the data (Article 26). The Integrator informs visitors and collects consent with a CMP registered with the IAB Europe TCF wherever the GDPR applies, and passes on the TC string (Terms, §7). adPluga processes the data after receiving it according to the choice in the TC string, keeps it for the periods in the Privacy Policy and answers data subjects, who may exercise their rights against either party at privacidade@adpluga.com. The essence of this arrangement is in the Privacy Policy (§15 and §16).
13. International transfers
Subprocessors in the USA process data under the EU-U.S. Data Privacy Framework (Commission adequacy decision) when certified, or under the Commission's standard contractual clauses (Decision 2021/914), with supplementary measures such as encryption in transit and pseudonymisation.
14. Final provisions
This Agreement remains in force for as long as the Terms and is governed by Portuguese law. Material changes are communicated with reasonable notice. Contact: privacidade@adpluga.com.