Data Processing Addendum | StackAdapt

Data Processing Addendum

Last updated and effective: August 5, 2026.

This Data Processing Addendum (“DPA”)  forms part of and is incorporated into a Digital Advertising Services Agreement, a Master Services Agreement,  the StackAdapt Platform Terms of Use or any other written or electronic agreement (the “Agreement”) between StackAdapt Inc. or one of its affiliates (“StackAdapt”) and you, as the customer (“Client”, and collectively, the “Parties”) for the services made available through the StackAdapt platform (identified either as the “Services”, or the “Platform” herein, as the context requires). This DPA reflects the Parties’ agreement with regard to the Processing of Personal Data.

1. Definitions

Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement. In this DPA, the following terms shall have the meanings set out below:

2. Processing of Personal Data

  1. Roles of the Parties. The Parties acknowledge and agree that the roles of the Parties with respect to specific Processing activities shall be determined by the nature and purpose of the Processing as described Appendix 1 to this DPA.
  1. Compliance with Data Protection Laws. Each Party shall use all efforts necessary to comply with the obligations imposed on it by applicable Data Protection Laws with regard to Personal Data Processed in connection with Services.  Each Party shall inform the other Party promptly if, in its opinion, any development or change of the Processing of such Personal Data breaches the Data Protection Laws. In the event of a material change to Data Protection Laws, such as any change that results in a different classification of a Party in relation to the Services, data localization, or if a transfer mechanism is deemed invalid, the Parties will negotiate a suitable resolution in good faith.
  2. Notice and Choice. Client warrants that for the purposes of the Agreement and use of the Services: (i) it has notified Data Subjects through appropriate means reasonably designed to satisfy its obligations under Data Protection Laws about the Processing of Personal Data by Client and StackAdapt, including the use of Online Tracking Technologies; (ii) it is lawfully permitted to share Personal Data with StackAdapt in connection with its use of the Services; (iii) where required by Data Protection Laws it has implemented a mechanism to obtain consent or facilitate opt-outs from Data Subjects, including from any digital properties on which Client deploys Online Tracking Technologies to collect Personal Data and (iv) it will not disclose or make available to StackAdapt any Personal Data relating to Data Subjects that have not consented, or have opted-out of, or otherwise exercised other rights that bar the Processing performed in connection with the Services provided under the Agreement (as applicable) unless this is for the purpose of suppressing such Data Subjects from marketing. Where requested by StackAdapt, as may be required pursuant to Data Protection Laws, or by order, request or other instruction by a Regulatory Authority, Client agrees to promptly provide documentation evidencing that such consent has in fact been obtained from Data Subjects.
  3. Prohibited Data. Client shall not provide Prohibited Data to StackAdapt.
  4. California Personal Data Processing. To the extent the Parties Process Personal Data subject to the CCPA, the following terms shall also apply:
  1. Data Partners. If Client directs StackAdapt to either: (i) disclose Personal Data to a Data Partner or (ii) Process Personal Data received from a Data Partner, Client represents and warrants that it has an executed agreement that contemplates such Personal Data disclosure, sharing and Processing (as may be applicable).

3. Rights of Data Subjects

  1. Parties as Joint or Independent Controllers. To the extent the Parties are joint or independent Controllers, each Party will process its own requests for Data Subjects to exercise their rights. With respect to requests from, or on behalf of Data Subjects with regard to the Processing of their Personal Data that is shared between the Parties, including requests to opt-out from the Sale/Share of Personal Data pursuant to CCPA, the parties will collaborate to honor such objections or opt-out requests.
  2. StackAdapt as Processor.  When StackAdapt is a Processor, if a Data Subject makes a lawful request directly to StackAdapt seeking to exercise any right available to it under Data Protection Laws that references Client, StackAdapt shall not respond to such communication directly without Client’s prior authorization, unless required by applicable law. To the extent Client does not have direct access to Client Personal Data through its use of the Services, and therefore does not have the ability to address such Data Subject request itself, StackAdapt shall, upon Client’s request, provide commercially reasonable cooperation to assist Client to address such request, to the extent required under Data Protection Law.

4. Processor Requirements

The following provisions shall apply when and to the extent that StackAdapt acts as a Processor with respect to Client Personal Data:

5. Security

  1. Controls for the Protection of Personal Data.  In connection with the Processing of Personal Data, the Parties shall maintain appropriate technical and organizational measures designed to protect against a Security Incident.  Client shall monitor compliance with these measures in accordance with its internal information security program. StackAdapt shall monitor compliance with these measures in accordance with Appendix 2 of this DPA.
  2. Security Incident Management and Notification. Each Party shall maintain security incident management policies and procedures designed to identify the Security Breach.  The Parties agree to apply the following procedures in the event of a Security Incident involving Personal Data shared between the Parties:
  1. Nothing in this DPA shall be construed to require either Party to violate or delay compliance with any legal or contractual obligations it may have with respect to a Security Incident.

6. Audit

  1. Provision of Information. To enable each Party to demonstrate compliance with its obligations pursuant to applicable Data Protection Laws, each Party shall provide the other Party with information regarding the (i) storage, (ii) country of origin and/or (iii) destination of Personal Data exchanged in connection with Client’s use of the Services.
  2. Cooperation with Request for Audit.

7. Cross-Border Data Transfers

  1. Transfers of EEA, Swiss, or UK Personal Data. Where the Processing of Personal Data includes transfers from the European Economic Area (“EEA”), Switzerland, or the United Kingdom to countries which are deemed to provide inadequate levels of data protection (“Other Countries”), if required by Data Protection Laws, the Parties agree to: (i) execute the model clauses adopted by the relevant data protection authorities of the European Commission or the UK Secretary of State as set forth in this Section 7 (if applicable); or (ii) comply with any of the other mechanisms provided for under Data Protection Laws for transferring Personal Data to such Other Countries, including, but not limited to, the Data Privacy Framework. Additional information required by the Standard Contractual Clauses is set forth in Appendix 1 and 2 attached hereto.
  2. Data Privacy Framework. StackAdapt participates in and certifies compliance with the Data Privacy Framework. As required by the Data Privacy Framework, StackAdapt (i) provides at least the same level of privacy protection as is required by the Data Privacy Framework Principles; (ii) will notify Client if StackAdapt makes a determination it can no longer meet its obligation to provide the same level of protection as is required by the Data Privacy Framework Principles, and (iii) will, upon written notice, take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.
  3. EU SCCs Modules. The Parties agree that for transfers of Personal Data from the EEA where the Data Privacy Framework does not apply, the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as annexed to Commission Implementing Decision 2021/914 of 4 June 2021 (the “ EU SCCs”), are hereby incorporated by reference into this DPA as follows:
  1. UK Model Clauses. The Parties agree that for transfers of Personal Data from the United Kingdom where the Data Privacy Framework does not apply, the International Data Transfer Addendum to the EU SCCs, issued by the UK ICO under S119A(1) Data Protection Act 2018 and in force March 21, 2022 (the “UK Addendum”), shall apply. The start date in Table 1 of the UK Addendum shall be the date that the Parties have executed Appendix 1. The selection of modules and optional clauses shall be as described in Sections 7(a) and 7(b) above, subject to any revisions or amendments required by the UK Addendum. All other information required by Tables 1-3 is set forth in Appendix 1 and 2. For the purposes of Table 4, the parties agree that both the importer and exporter may end the UK Addendum as set out in Section 19 of the UK Addendum.
  2. Swiss Data Transfers. The Parties agree that for transfers of Personal Data from Switzerland where the Data Privacy Framework does not apply, the terms of the EU SCCs shall be amended and supplemented as specified by the relevant guidance of the Swiss Federal Data Protection and Information Commissioner, and the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commissioner.
  3. Canada Data Transfers. The Parties agree that any transfer of Personal Data outside of Canada must ensure a level of protection comparable to that required under applicable privacy laws. Such protection may be established through contractual safeguards or other legally recognized mechanisms. The Party responsible for the transfer must inform individuals, at the time of collection, that their personal information may be transferred outside of the jurisdiction, provide a designated contact for inquiries, and disclose any potential risks associated with access by foreign authorities.

8. Limitation of Liability

The “ Limitation of Liability” terms under the Agreement shall apply to all claims, demands, suits, causes of action, awards, judgments and liabilities, including reasonable attorneys’ fees and costs, arising out of or alleged to have arisen out of either Party’s breach of its obligations under this DPA.

9. Prior Agreement

Unless a prior agreement precludes the Parties from entering into this DPA, this DPA and the Agreement shall supersede all prior discussions and agreements and constitutes the entire agreement and understanding between the Parties with respect to its subject matter.

10. Modifications

If necessitated by amendments in Data Protection Laws or any other applicable laws or regulations or by developments in StackAdapt’s Services or Platform, StackAdapt may modify this DPA unilaterally to the extent it is reasonably necessary.

11. Governing Law

Without prejudice to the relevant provisions of any applicable transfer mechanisms identified in Section 7 of this DPA, including the EU SCCs and UK Addendum, the Parties to this DPA hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this DPA, including disputes regarding its existence, validity or termination or the consequences of its nullity; and this DPA is governed by the laws of the country or territory stipulated for this purpose in the Agreement.

Appendix 1

Description of Processing

1. Controller (Client) To Controller (StackAdapt)

  1. Parties:
    • Controller/Business (Data Exporter) is Client.
    • Controller/Third Party (Data Importer) is StackAdapt
  2. Categories of Data Subjects:
    • Clients or prospect of Client
    • Users and visitors to Client’s digital properties (websites, mobile applications)
    • Individuals responding to Client’s advertisements
    • Client’s employees and/or users of the Services
  3. Nature and Purpose(s) of Processing:
    • Performance of Services as described in the Agreement, including marketing, cross-context behavioral/targeted advertising and measurement.
  4. Categories of Personal Data:
    • ☒ Personal identifiers: online identifiers; IP address; cookie ID, device ID. At the request of the Client:Email address, first name, last name, phone number, postal address.
    • ☒ Internet or other electronic network activity information: e.g., referral URL; user agent; and information on a consumer’s interaction with a website, application, or advertisement.
  5. Duration of Processing:
    • As agreed between the Parties in this DPA or the Agreement. Additional permitted purposes may include legal, regulatory, backup, archival, accounting, and/or audit purposes.

2. Controller (Client) To Processor (StackAdapt)

  1. Parties:
    • Controller (Data Exporter) is Client
    • Processor (Data Importer) is StackAdapt
  2. Instructions for Processing:
    • As described in the Agreement and relevant insertion order
  3. Categories of Data Subjects:
    • Clients or prospects of Client
    • Users and visitors to Client’s digital properties (websites, mobile applications)
    •  Individuals responding to Client’s advertisements
  4. Nature and Purpose(s) of Processing:
    • Sending email campaigns on behalf, for the benefit and under instructions of the Client.
    • Onboarding Client Personal Data for identity resolution.
  5. Categories of Personal Data:
    • ☒ Personal identifiers: e.g., name; alias; postal address; online identifiers; IP address; email address; account name; or hashed identifiers.
  6. Duration of Processing:
    • As agreed between the Parties in this DPA or the Agreement. Additional permitted purposes may include legal, regulatory, backup, archival, accounting, and/or audit purposes.

3. Controller (StackAdapt) To Controller (Client)

  1. Parties:
    • Controller/Business (Data Exporter) is StackAdapt
    • Controller/Third Party (Data Importer) is Client
  2. Categories of Data Subjects:
    • Individuals responding to Client’s advertisements
  3. Nature and Purpose(s) of Processing:
    • Measurement and analytics of campaigns activated via the StackAdapt services.
  4. Categories of Personal Data:
    • ☒ Personal identifiers: online identifiers; IP address; cookie ID, device ID.
  5. Duration of Processing:
    •  As agreed between the Parties in this DPA or the Agreement. Additional permitted purposes may include legal, regulatory, backup, archival, accounting, and/or audit purposes.

Appendix 2

TECHNICAL AND ORGANIZATIONAL MEASURES TO PROTECT THE SECURITY OF THE PERSONAL DATA

Information Security Schedule

1. Purpose and Scope

2. Governance and Risk Management

  1. Information Security Program. StackAdapt maintains an information security program and control environment aligned with the principles of the ISO/IEC 27001:2022 standard and the NIST Cybersecurity Framework. The program includes written policies, plans, standards, and guidelines governing the implementation and operation of security controls across the organization. Policies are reviewed at least annually or upon a material change to infrastructure, organisational structure, or regulatory and compliance requirements.
  2. Roles and Responsibilities. StackAdapt’s Information Security Team is responsible for the development, implementation, and ongoing management of the security program and is led by the Senior Director of Information Security, who reports to the Chief Technology Officer.
  3. Security Governance. StackAdapt operates a cross-functional Security Committee that meets quarterly to oversee key security programmes, projects, and initiatives, and to ensure alignment with organisational goals and risk management priorities.
  4. Risk Management. StackAdapt maintains an enterprise-wide risk management framework designed to identify, assess, and manage risks across key organizational domains, including legal and regulatory compliance, business strategy execution, vendor management, financial management, competitive environment, people, data privacy and security, technology strategy, platform performance and innovation, and global footprint.  Formal risk assessments are conducted semi-annually by key business stakeholders to evaluate the impact, likelihood, existing and planned mitigations, and residual risk for each identified risk within these domains. At least annually, a Risk Report is presented to the Executive Leadership Team, consolidating all known risks and highlighting leadership perspectives on priority risks across the organization. The overall process is coordinated and overseen by the Internal Audit function to ensure consistency, objectivity, and accountability.

The Information Security Team maintains a formally documented Information Security Risk Management Policy that defines how information security risks are identified, evaluated, treated, and monitored. The team also maintains an Information Security Risk Register that records all identified security risks, their assessed impact and likelihood, and the status of mitigation activities, and conducts formal risk reviews at least biannually to ensure appropriate mitigation and continuous improvement of StackAdapt’s security posture.

3. Asset and Configuration Management

StackAdapt has also implemented a formal Data Handling Guidelines policy that specifies how information must be managed throughout its lifecycle, based on its classification. These guidelines outline requirements for data access, storage, transmission, sharing, and destruction, ensuring that handling practices are consistent with the assigned classification level and comply with StackAdapt’s internal security and privacy requirements and applicable law.

4. Human Resource Security

As part of the offer process, prospective employees are required to sign an employment agreement that includes provisions related to intellectual property ownership and confidential information protection. This agreement must be executed prior to onboarding or system access.

5. Access Control

  1. 1. Client Accounts. Client account administrators can grant or modify user access within their organisation.
    1. 2. Internal Users. StackAdapt managers assign or modify employee access based on job requirements. Employee access is restricted according to the principle of least privilege, ensuring that users only have access necessary to perform their duties.

6. Cryptography and Data Protection

7. Operations and Network Security

StackAdapt serves clients globally by leveraging AWS data centre regions across multiple geographic locations and primarily utilises the following AWS regions for data processing:

For security reasons, AWS does not disclose the precise physical location of its data centers.

StackAdapt employs real-time risk-based monitoring that evaluates access requests based on signals such as user behaviour and login anomalies to detect and mitigate potential malicious activity. Within AWS, network and security configurations follow the AWS CIS Foundation Benchmarks and the security networking controls of StackAdapt’s cloud security monitoring platform, including:

Patch management processes are reviewed periodically to ensure continued alignment with organizational risk tolerance and industry best practices.

8. Application Security

StackAdapt uses modern, secure open-source frameworks with built-in controls intended to mitigate exposure to common application-security risks identified in the OWASP Top 10, such as SQL Injection (SQLi), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).

As part of the SDLC, StackAdapt performs Static Application Security Testing (SAST) using Brakeman and Software Composition Analysis (SCA) using Dependabot and Renovate. Application deployments are continuously scanned at build time and in production environments to detect dependency vulnerabilities, monitor network activity, and identify anomalous user behaviour or potential malicious activity.

StackAdapt employs Infrastructure-as-Code (IaC) practices so that infrastructure changes are tested against StackAdapt’s security standards, peer-reviewed, and validated before deployment, reducing the risk of insecure configurations, inadvertent exposure of secrets, and unencrypted data storage.

9. Physical Security

StackAdapt relies on AWS’s independently assessed physical security controls and related certifications as part of its overall security posture.

10. Incident Response and Monitoring

StackAdapt shall provide timely updates as additional information becomes available and shall cooperate in good faith with the Client to support the Client’s own incident response, assessment, mitigation, and any legally required notifications to regulators or affected individuals.

11. Business Continuity and Disaster Recovery

12. Vendor Security Management

As part of vendor onboarding, StackAdapt shall conduct risk assessments to determine the level of due diligence required, taking into account factors such as the sensitivity of data processed and the criticality of the services provided. Vendors may be asked to complete an information security questionnaire and provide supporting evidence, which StackAdapr evaluates and documents, including any identified risks and associated remediation or risk-acceptance decisions. For higher-risk or critical vendors, StackAdapt may require additional validation of security controls, including, where applicable, evidence of independent assurance such as current SOC 1, SOC 2, or ISO27001 certifications.

Based on the vendor’s risk level and service scope, StackAdapt’s Information Security Team defines applicable security requirements for project teams to implement during system configuration and integration, covering control areas such as access management, data protection, auditing, change management, backup, and service management.  StackAdapt periodically reviews the security posture of key vendors to verify continued compliance with applicable security requirements.

13. Compliance and Continuous Improvement

14. Audit and Verification Rights (“Right to Audit”)

Annex 1

StackAdapt maintains the following list of information security policies, standards, plans, and guidelines (which StackAdapt may update from time to time to reflect organizational, technical, or regulatory changes):

Policies and Plans

Standards

Guidelines

Maximize your advertising & marketing strategy with StackAdapt

Your personalized demo isn’t just a walkthrough, it’s a planning session tailored to your goals.

Please disable any ad blockers to successfully submit this form.

Request a demo

First Name*

Last Name*

Business Email*

Phone Number*

🇺🇸

Company Name*

Job Title*

Company Country*

Annual Programmatic Budget*

How are you looking to work with us?*

I agree to receiving communications about StackAdapt products and services. I understand that the information I provided will be used in accordance with the Website Privacy Policy, and that I may opt out at any time.*

reCAPTCHA

Recaptcha requires verification.

protected by reCAPTCHA

Submit

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply

If the form doesn’t load, please click the form link to open it.

Please disable any ad blockers to successfully submit this form.

reCAPTCHA

Select all images with a fire hydrant Click verify once there are none left.

Please try again.

Please select all matching images.

Please also check the new images.

Please select around the object, or reload if there are none.

Verify