This Data Processing Addendum (“DPA”) forms part of the agreement between the client identified in an Order (“Client”) and Amplify Digital Holdings LLC (“Amplify”) when Amplify processes Personal Data on Client’s behalf. Capitalized terms not defined here have the meanings in the applicable agreement.
Execution: This web version states Amplify’s standard terms. An execution copy identifying the parties, processing details, and approved subprocessors can be requested at privacy@amplifydigitalholdings.com.
1. Roles and scope
Client is the controller or business and Amplify is the processor or service provider for Client Personal Data, except where applicable law assigns different terms. Each party will comply with applicable Data Protection Law. This DPA applies only to processing described in Schedule 1 or an Order.
2. Documented instructions
Amplify will process Client Personal Data only on Client’s documented instructions, including the agreement, Order, and configured use of the services, unless law requires otherwise. Amplify will notify Client if it believes an instruction violates applicable Data Protection Law, unless prohibited by law.
3. U.S. service-provider commitments
Where U.S. state privacy law applies, Amplify will not sell or share Client Personal Data; retain, use, or disclose it outside the direct business relationship or for a commercial purpose other than the specified business purposes; or combine it with personal information received from another source except as permitted by law. Client may take reasonable and appropriate steps to confirm processing is consistent with these commitments and may require reasonable remediation.
4. Confidentiality and personnel
Amplify will ensure personnel authorized to process Client Personal Data are subject to confidentiality obligations and receive appropriate privacy and security awareness.
5. Security
Amplify will maintain reasonable administrative, technical, and organizational safeguards appropriate to the risk, which may include access controls, least-privilege practices, multifactor authentication where available, encryption in transit, secure configuration, logging, vulnerability management, backup practices, incident procedures, and provider diligence. Specific controls may be described in an Order or security schedule.
6. Subprocessors
Client grants general authorization for Amplify to use subprocessors necessary to provide the services. Amplify will impose data-protection obligations materially consistent with this DPA and remains responsible for its subprocessors’ performance to the extent required by law. The execution copy or applicable Order will identify approved subprocessors or the mechanism for accessing a current list. Amplify will provide reasonable advance notice of a new subprocessor where required, and the parties will work in good faith to address a documented data-protection objection.
7. Data-subject requests
Taking into account the nature of processing, Amplify will provide reasonable assistance for Client to respond to requests to exercise privacy rights. If Amplify receives a request relating to Client Personal Data, it will direct the requester to Client where legally permitted and will not respond on Client’s behalf unless instructed or required by law.
8. Security incidents
Amplify will notify Client without undue delay after becoming aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data (“Security Incident”). Notification will include available information reasonably necessary for Client’s response. Notification is not an admission of fault. Unsuccessful attempts that do not compromise Client Personal Data are not Security Incidents.
9. Assessments and audits
Amplify will provide information reasonably necessary to demonstrate compliance with this DPA. No more than once annually, unless required by a regulator or following a Security Incident, Client may request a reasonable remote audit during business hours on advance notice. Audits must protect other customers’ information, avoid unreasonable disruption, and be subject to confidentiality. Client bears its audit costs unless material noncompliance is found.
10. Deletion and return
At the end of services, Amplify will delete or return Client Personal Data as directed, unless law requires retention. Data in secure backups may remain until overwritten under normal retention cycles and will remain protected and unavailable for other use.
11. International transfers
If Client Personal Data protected by European, UK, or Swiss transfer restrictions is transferred to a country without an adequacy decision, the parties will use the applicable Standard Contractual Clauses or other lawful mechanism. The parties will complete the appropriate module and annexes in the execution copy. Where the UK GDPR applies, the approved UK addendum or other lawful mechanism will supplement those clauses.
12. Assistance
Taking into account the nature of processing and information available, Amplify will reasonably assist Client with security obligations, breach notifications, data-protection impact assessments, and regulator consultations required by applicable Data Protection Law. Material out-of-scope assistance may be charged at agreed rates.
13. Liability and precedence
The agreement’s liability limits apply to this DPA to the maximum extent permitted by law. If this DPA conflicts with the agreement on personal-data processing, this DPA controls. Mandatory transfer terms control over conflicting provisions.
Schedule 1: Processing details
| Subject matter | Digital advertising, analytics, funnel design, conversion optimization, reporting, and related services specified in an Order. |
|---|---|
| Duration | The term of the services plus the limited retention period described above. |
| Nature and purpose | Access, organization, analysis, measurement, segmentation, campaign operation, troubleshooting, and other processing needed to perform the services. |
| Data subjects | Client prospects, leads, customers, users, personnel, partners, and other individuals whose data Client makes available. |
| Data categories | Identifiers and contact information; online and device data; campaign, event, and interaction data; lead and conversion information; audience attributes; and other data identified in an Order. |
| Sensitive data | Not intended unless expressly identified, legally permitted, and covered by written instructions and additional safeguards. |
| Controller instructions | The agreement, Order, platform configurations, written requests, and Client’s lawful use of deliverables and services. |
Schedule 2: Baseline safeguards
- Access limited to authorized personnel with a business need.
- Strong authentication and multifactor authentication where supported.
- Encrypted transport using current protocols.
- Endpoint, patch, credential, and provider-management practices appropriate to risk.
- Security-event review and incident-response procedures.
- Confidentiality obligations and privacy/security awareness.
- Deletion or return procedures at the end of services.