Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between Groweasy Online Digital Technology Private Limited, operating as Maino.ai, a company incorporated in India with its registered office at 1779, 19th Main Road, Vanganahalli, Sector 4, HSR Layout, Bengaluru, Karnataka 560102, India (“Maino”), and the customer that has agreed to the Agreement (“Customer”).

This DPA applies where Maino processes Customer Personal Data on behalf of Customer in providing the Maino platform (the “Service”). If there is a conflict between this DPA and the Agreement on the processing of personal data, this DPA prevails.

1. Definitions

In this DPA:

• “Customer Personal Data” means personal data that Maino processes on behalf of Customer in providing the Service, as described in Annex I.
• “Data Protection Laws” means all laws applicable to the processing of Customer Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the California Consumer Privacy Act as amended (“CCPA”).
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• “Subprocessor” means any third party engaged by Maino to process Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• “Controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the GDPR. “Data fiduciary” and “data processor” have the meanings given in the DPDP Act.

2. Roles of the parties

2.1 Customer is the controller of Customer Personal Data, and the data fiduciary under the DPDP Act. Maino is the processor, and the data processor under the DPDP Act.

2.2 Customer is responsible for having a lawful basis for the processing it instructs Maino to carry out, and for the accuracy of the Customer Personal Data it provides.

3. Data minimisation

3.1 Maino retrieves only campaign-level, aggregated performance data, such as spend, impressions, clicks, conversions and derived metrics, from the advertising, measurement (MMP) and CRM platforms Customer connects to the Service.

3.2 Maino does not request, retrieve, store or process user-level or individual-level data from these platforms.

3.3 Maino does not attempt to re-identify any individual from aggregated data.

4. Processing instructions

4.1 Maino processes Customer Personal Data only on Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law. In that case, Maino informs Customer of the legal requirement before processing, unless the law prohibits this.

4.2 The Agreement, this DPA and Customer’s configuration and use of the Service, including automated budget optimisation within the guardrails Customer sets, are Customer’s complete instructions.

4.3 Maino informs Customer if, in its opinion, an instruction infringes Data Protection Laws.

5. AI processing and model training

5.1 Maino uses the third-party AI providers listed on the Subprocessors page to deliver Flare and creative analysis features.

5.2 Customer Data, including creatives, is not used by Maino or its AI Subprocessors to train or fine-tune AI models.

6. Confidentiality

Maino ensures that every person it authorises to process Customer Personal Data is bound by an obligation of confidentiality.

7. Security

Maino implements and maintains the technical and organisational measures described in Annex II. Maino may update these measures, provided the overall level of security is not reduced.

8. Subprocessors

8.1 Customer gives Maino general authorisation to engage Subprocessors. The current Subprocessors are listed at maino.ai/subprocessors.

8.2 Maino gives at least 30 days’ notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessors page and emailing customers who have subscribed to updates at contact@maino.ai.

8.3 Customer may object to a new Subprocessor on reasonable data protection grounds by emailing contact@maino.ai within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.

8.4 Maino imposes data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains responsible for each Subprocessor’s performance.

9. Security Incidents

9.1 Maino notifies Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data.

9.2 The notification describes, to the extent known, the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where information is not available at first, Maino provides it as it becomes available.

9.3 Maino takes reasonable steps to contain and remediate the Security Incident. Maino’s notification is not an acknowledgement of fault or liability.

10. Assistance

10.1 Taking into account the nature of the processing, Maino assists Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights under Data Protection Laws.

10.2 If Maino receives a request directly from a data subject relating to Customer Personal Data, Maino forwards it to Customer and does not respond except on Customer’s instructions.

10.3 Maino provides reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, where required by Data Protection Laws.

11. Deletion and return

11.1 Within 30 days after the end of the Service, Maino deletes Customer Personal Data, revokes all connected platform access tokens and disconnects all integrations, unless applicable law requires Maino to retain the data.

11.2 Before the end of the Service, Customer may export its data through the Service or request a copy by emailing contact@maino.ai.

12. Audits

12.1 Maino makes available to Customer the information reasonably necessary to demonstrate compliance with this DPA. Maino responds to one security and privacy questionnaire per year and shares its compliance documentation on request, subject to confidentiality.

12.2 If that information is not sufficient to demonstrate compliance, or if a supervisory authority requires it, Customer may conduct an audit, at its own cost, on at least 30 days’ written notice, during business hours, no more than once in any 12-month period, and subject to reasonable confidentiality and security requirements.

13. International transfers

13.1 Maino processes Customer Personal Data in India and through the Subprocessors and locations listed on the Subprocessors page.

13.2 Where Customer Personal Data subject to the GDPR is transferred to Maino in a country without an adequacy decision, the SCCs apply and are incorporated into this DPA by reference, as follows:

• Module 2 (controller to processor) applies where Customer is a controller, and Module 3 (processor to processor) applies where Customer is a processor.
• Customer is the data exporter and Maino is the data importer.
• Clause 7 (docking clause) applies.
• Under Clause 9, option 2 (general written authorisation) applies, with the notice period in section 8.2 of this DPA.
• The option in Clause 11 does not apply.
• Under Clauses 17 and 18, the SCCs are governed by the laws of, and disputes are resolved by the courts of, Ireland.
• Annexes I and II of the SCCs are completed by Annexes I and II of this DPA.

13.3 For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies, with the parties’ details and Annexes taken from this DPA.

13.4 For transfers subject to Swiss data protection law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

14. Regional terms

14.1 California. Maino is a service provider under the CCPA. Maino does not sell or share Customer Personal Data, does not retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service, and does not combine it with personal information from other sources except as permitted by the CCPA.

14.2 India. For processing subject to the DPDP Act, Maino processes Customer Personal Data as a data processor on behalf of Customer as data fiduciary, under a valid contract, and only for the purposes Customer specifies.

15. Liability and term

15.1 Each party’s liability under this DPA is subject to the limitations of liability in the Agreement.

15.2 This DPA remains in force for as long as Maino processes Customer Personal Data on Customer’s behalf.

16. Contact

Questions about this DPA or the processing of Customer Personal Data:

• Email: contact@maino.ai
• Data Protection and Grievance Officer: Roushan Singh, contact@maino.ai
• Post: Groweasy Online Digital Technology Private Limited, 1779, 19th Main Road, Vanganahalli, Sector 4, HSR Layout, Bengaluru, Karnataka 560102, India

Annex I: Details of processing

A. Parties

B. Description of processing

C. Competent supervisory authority

The supervisory authority of the EU member state in which Customer is established, or as determined under Clause 13 of the SCCs.

Annex II: Technical and organisational security measures

Annex III: Subprocessors

The current list of Subprocessors, their purposes and locations is published at maino.ai/subprocessors and forms part of this DPA.