Data Processing Addendum

1. Parties and Scope

This Data Processing Addendum (“DPA”) forms part of the agreement (“Service Agreement”) between:

• Processor: Media Track Limited, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, company number 16249153, ICO registration ZB963026 (“Mediatrack”).
• Client: The entity identified in the Service Agreement that has engaged Mediatrack to provide services (“Client”).

This DPA applies to all personal data processed by Mediatrack on the Client’s behalf in connection with the mediatrack.ai platform.

This DPA applies regardless of whether the Client is the data controller (the advertiser), or is itself a processor acting on behalf of a data controller (for example, an agency acting for an advertiser, or a publisher acting for an agency). In all cases, Mediatrack processes personal data on the Client’s documented instructions.

2. Client Warranty of Authority

The Client warrants and represents that:

• 2.1It has all necessary authority, consents, and agreements in place to instruct Mediatrack to process personal data on its behalf.
• 2.2Where the Client acts as a processor on behalf of a third-party data controller (such as an advertiser or brand), the Client has a written data processing agreement with that controller which authorises the Client to engage sub-processors including Mediatrack.
• 2.3Where the Client acts as a sub-processor (for example, a publisher acting on behalf of an agency), the Client has confirmed through the contractual chain that the data controller has authorised the use of sub-processors including Mediatrack.
• 2.4The data controller in the chain has a valid lawful basis for the collection and processing of personal data through landing pages hosted on the Mediatrack platform.
• 2.5The Client has provided (or will provide at campaign setup) accurate data controller details including the controller’s name and privacy contact, so that Mediatrack can populate the landing page privacy notice correctly.

The Client indemnifies Mediatrack against any claim, loss, or liability arising from the Client’s breach of these warranties.

3. Roles

Mediatrack is the data processor. The Client instructs Mediatrack to process personal data for the purpose of delivering the platform services.

If the Client is itself a processor (e.g. an agency or publisher), Mediatrack is a sub-processor. The obligations in this DPA apply equally.

Mediatrack does not determine the purposes or means of processing. Mediatrack does not use Client data for its own marketing, analytics, or any purpose other than delivering the agreed services.

4. Processing Details

Subject matter

Hosting, operating, and optimising landing pages, lead generation campaigns, ad creative, call tracking, and reporting on behalf of the Client.

Nature and purpose

Collection, storage, routing, analysis, optimisation, reporting, and deletion of personal data submitted through landing pages and call tracking, to deliver the platform services.

Types of personal data

Names, email addresses, telephone numbers, postal codes, form responses, consent records, IP addresses, URL parameters and referral data, call metadata and recordings (if enabled), and website interaction data.

Categories of data subjects

Website visitors, lead form respondents, callers, and any individuals whose data is submitted through landing pages or call tracking hosted on the platform.

Duration

For the term of the Service Agreement plus the post-termination retention period (default 90 days, or as agreed).

5. Mediatrack’s Obligations

Mediatrack shall:

• 5.1Instructions: Process personal data only on the Client’s documented instructions. Mediatrack shall immediately inform the Client if, in its opinion, an instruction infringes UK GDPR.
• 5.2Confidentiality: Ensure that all persons authorised to process personal data are bound by appropriate confidentiality obligations.
• 5.3Security: Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in Schedule 1.
• 5.4Sub-processors: Not engage additional sub-processors without providing the Client with 30 days prior notice. The Client provides general authorisation for the sub-processors listed in Schedule 2. The Client may object to a new sub-processor on reasonable data protection grounds. If the objection cannot be resolved, the Client may terminate the Service Agreement.
• 5.5Data subject rights: Assist the Client in responding to data subject requests within 48 hours of receipt. Mediatrack shall not respond directly to a data subject without the Client’s instruction, unless required by law.
• 5.6Breach notification: Notify the Client without undue delay and in any event within 24 hours of becoming aware of any actual or suspected personal data breach. The notification shall include: the nature of the breach, categories and approximate numbers of data subjects affected, likely consequences, and measures taken or proposed.
• 5.7ICO notification: The decision whether to notify the ICO and/or affected data subjects rests with the data controller (the Client, or the Client’s upstream controller). Mediatrack will provide sufficient information to enable this decision.
• 5.8DPIA assistance: Assist the Client in carrying out data protection impact assessments and prior consultations with the ICO where required.
• 5.9Deletion: On termination of the Service Agreement, delete all personal data within 90 days (or such other period as agreed). Provide written confirmation of deletion on request.
• 5.10Audit: Make available to the Client all information necessary to demonstrate compliance with this DPA. Allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client.
• 5.11No selling or sharing: Not sell, rent, share, or disclose personal data to any third party for any purpose other than delivering the agreed services.
• 5.12Landing page privacy notice: Auto-generate and display a privacy notice on each landing page identifying the data controller (using details provided by the Client at campaign setup), Mediatrack as processor, data collected, purposes, recipients, retention, rights, and ICO complaint right.
• 5.13Cookie consent: Auto-generate and inject cookie consent banners on landing pages. Non-essential cookies (including client tracking pixels) shall not be set until the visitor has given consent, in compliance with PECR.

6. Client’s Obligations

The Client shall:

• Provide accurate data controller details at campaign setup (controller name, contact email/URL) so that landing page privacy notices can be correctly populated.
• Ensure that the data controller has a valid lawful basis for the collection and processing of personal data.
• Where the Client is an agency or publisher, maintain a written data processing agreement with the upstream data controller that authorises the engagement of sub-processors.
• Respond to data subject requests forwarded by Mediatrack within a reasonable time.
• Notify Mediatrack of any relevant instructions, restrictions, or regulatory requirements that affect the processing.
• Comply with all applicable data protection legislation.

7. International Transfers

Primary data storage is in the United Kingdom (Supabase eu-west-2, Vercel lhr1). Some sub-processors process limited data outside the UK. Where personal data is transferred outside the UK, appropriate safeguards are in place including Standard Contractual Clauses and/or the UK-US Data Privacy Framework. Details are set out in Schedule 2.

No special category data or sensitive financial data (bank details, credit data, NI numbers) is collected or stored by Mediatrack through the platform.

8. Term and Termination

This DPA remains in force for the duration of the Service Agreement. On termination, clause 5.9 (deletion) applies. Clauses 5.2 (confidentiality), 5.10 (audit), and 5.11 (no selling/sharing) survive termination.

9. Liability

Mediatrack’s liability under this DPA is subject to the limitations set out in the Service Agreement. The Client’s indemnity under clause 2 is not subject to the liability cap.

10. Changes to This DPA

Mediatrack may update this DPA with 30 days prior written notice. The current version is published at mediatrack.ai/legal/dpa. Continued use of the platform after the notice period constitutes acceptance.

11. General

• This DPA is governed by the laws of England and Wales.
• This DPA is incorporated into and forms part of the Service Agreement.
• If any provision is found to be invalid, the remaining provisions continue in force.
• By using the Mediatrack platform, the Client accepts this DPA.

Schedule 1: Security Measures

Mediatrack implements the following technical and organisational measures:

• TLS 1.2+ encryption of all data in transit.
• AES-256 encryption of data at rest in Supabase.
• Multi-factor authentication on all staff access to systems containing personal data.
• Role-based access controls with least-privilege principles.
• Comprehensive audit logging of all data access.
• Strong password policy (minimum 12 characters, mixed case, numbers, symbols).
• Device security requirements: up-to-date OS, endpoint protection, disk encryption, screen lock.
• No personal data stored on staff endpoint devices.
• Vendor due diligence for all third-party sub-processors.
• Automated data retention and anonymisation (nightly process, configurable per client).
• Cookie consent enforcement: non-essential cookies blocked until visitor consent.
• HMAC-signed webhook delivery for lead routing with automatic retry and dead-letter queue.

Schedule 2: Sub-Processors

The Client provides general authorisation for the following sub-processors. Mediatrack will notify the Client at least 30 days before adding or replacing a sub-processor.

Current list also published at mediatrack.ai/legal/sub-processors.

Schedule 3: Landing Page Privacy Notice Template

The following template is auto-generated on each landing page. Fields in [brackets] are populated from the Client’s campaign setup.