Processing terms

The Client is the controller of the personal data it makes available. J-Action LLC, 444 Alaska Ave. Suite #ASA898, 90503 Torrance (CA), USA — Entity ID C1185429, EIN 61-1986610 — acts as processor, limited to the purposes and documented instructions set out in the service agreement.

Non-personal data — catalogues, aggregate channel metrics, volumes — falls outside the Regulation, but is subject to the confidentiality obligations in this annex, which apply to all Client material without distinction.

Client's disclosure obligation. The Client states in its own privacy notice that data is also processed by the Processor, including the Processor's company details. The Processor supplies the wording and the details to be inserted.

Legal basis for marketing activities. Where processing includes remarketing or advertising profiling, collecting data subjects' consent and being able to demonstrate it remain with the Client as controller. The Processor operates strictly within the scope of the consent the Client has collected.

No data is processed for purposes other than those listed without written instruction from the Client.

• Least access. Project-assigned personnel and, for technical and platform administration work, authorised technical staff; named accounts, revoked when the engagement closes or duties change.
• Delegated access and credentials. Where the platform allows it, delegated read-only permissions are used, revocable by the Client. The Client's personal passwords are not requested. Tokens, access keys and service credentials needed for the connections and integrations configured for the Client are stored in the Processor's systems, with restricted access, and used only for that connection. Credentials for the Processor's platforms are stored as hashes.
• Data separation. Multi-client architecture: several clients' data may reside in the same database; every record is associated with the owning client, and user access is limited, by application controls and, where implemented, by database-level access rules, to the data of the client they act for. Technical import, automated processing and platform administration processes run with broader privileges, only on the Processor's systems and with access restricted to authorised technical staff. A dedicated, isolated instance is available as an option, on separate commercial terms.
• Encryption. In transit, over HTTPS/TLS. At rest, according to the measures provided by the infrastructure suppliers.
• Logging. A log of access to the platforms and, where provided, of changes to data, available on request.

The Client authorises the suppliers listed below, contractually bound by equivalent obligations. Any change is notified at least thirty days in advance, within which the Client may object.

Infrastructure. The Processor's software services are delivered as SaaS. The application environments and their configuration are operated by J-Action LLC; the underlying physical infrastructure is provided by the parties listed above. HubSpot, Asana and Notion process relationship and project data, not the operational data handled by the services.

Further recipients. Where the Client requests remarketing activity, the necessary identifiers are transmitted to the advertising platforms named by the Client — Google, Meta and equivalents — which process them under their own contractual terms. Transmission takes place solely on the Client's instruction and within the limits of the consent it has collected. Likewise, where the Client requests it, purchase data is transmitted to the analytics platforms it names, such as Google Analytics.

Authorised personnel. The Processor operates a distributed organisation: the persons it authorises to process the data, whether employees or contractors, access it from several countries, including third countries without an adequacy decision. They process the data only on the Processor's documented instructions and never for their own purposes, and are bound in writing to confidentiality and to the same data protection obligations that this annex places on the Processor, under Article 28(3) and (4) of the Regulation. The Client gives general authorisation for the use of such persons; the Processor remains fully liable to the Client for their conduct, provides an up-to-date list of the countries from which access takes place on request, and informs the Client of any new third country with the notice period set for sub-processors, within which the Client may object. Transfers to those countries are governed by the standard contractual clauses adopted by the European Commission, in the applicable module, supplemented by any additional measures required.

Transfers outside the European Union. Processing takes place on infrastructure located in the European Union and the United States, with access from the countries identified above. Transfers of personal data from the European Union rely on the standard contractual clauses approved by the European Commission, attached to the service agreement.

Values derived from Client data may feed market statistics, on the following cumulative conditions, which give contractual effect to the public policy.

• Minimum threshold. Every published value aggregates at least five distinct clients.
• Non-identifiability. No combination of category, geography and period may isolate a single operator.
• Derived values only. Raw data does not go into the statistics and is never shared with other clients.
• Exclusion of interested parties. No data attributable to the Client is shared with its competitors, its suppliers, or the brands it represents.
• Opt-out. The Client may withdraw at any time in writing, with no effect on the service or the fee. Withdrawal takes effect from the next processing cycle.
• Reciprocity. While participating, the Client has access to the statistics it helps generate.

Notification to the Client within twenty-four hours of becoming aware, stating the nature of the breach, the categories and volume of data affected, the likely consequences and the measures taken. Assistance to the Client in its obligations towards the supervisory authority and data subjects.

On termination, or on request, data is returned in a structured, commonly used format and deleted from our systems within thirty days, including backup copies according to the rotation cycle. Deletion is confirmed in writing.

Deletion of personal data during the engagement. The Client may request, at any time and without having to give a reason, the deletion of data relating to identifiable people, under Article 17 of the Regulation. The request is carried out within thirty days and does not affect continuation of the service on the remaining categories of data.

On reasonable notice, and no more than once a year, the Client may request the documentation needed to verify compliance with this annex, including the logs referred to in point 3 and the current list of sub-processors.