VGS HubBack to site

Data Processing Agreement

Last updated: 13 August 2026

Vargas Digital SRL · Sat Vălișoara, Județul Cluj, Romania · CUI 41265668 · Reg. Com. J2019002466127 · EUID ROONRC.J2019002466127

1. Roles & scope

For personal data contained in Connected Accounts and collected via the Tracking module, the Controller determines the purposes and means of processing and the Processor processes such data only to provide the Service and on the Controller's documented instructions (including via the App's configuration). For the Processor's own account, billing and security data, the Processor acts as an independent controller under its Privacy Policy.

2. Processor obligations

• Process personal data only on the Controller's documented instructions, including for international transfers, unless required by EU/Member‑State law (in which case it will inform the Controller unless legally prohibited);
• Ensure persons authorized to process the data are bound by confidentiality;
• Implement the technical and organizational measures set out in Annex II (Article 32);
• Respect the conditions for engaging sub‑processors in Section 4;
• Assist the Controller, insofar as possible, in responding to data‑subject requests;
• Assist the Controller with security, breach notification, data‑protection impact assessments and prior consultation (Articles 32-36);
• At the Controller's choice, delete or return the personal data at the end of the services and delete existing copies unless storage is required by law;
• Make available information necessary to demonstrate compliance and allow for and contribute to audits as set out in Section 6.

3. Data‑subject requests & breach

The Processor will promptly notify the Controller of any request received directly from a data subject relating to the Controller's data and will not respond except on the Controller's instruction or as legally required. The Processor will notify the Controller without undue delay after becoming aware of a personal‑data breach affecting the Controller's data, with the information reasonably available to assist the Controller's own notification obligations.

4. Sub‑processors

The Controller provides general authorization for the Processor to engage sub‑processors. The Processor imposes data‑protection obligations on each sub‑processor equivalent to those in this DPA and remains liable for their performance. Current sub‑processors (Annex III):

We will give the Controller advance notice of changes to sub‑processors (via the App or email) and an opportunity to object on reasonable data‑protection grounds.

5. International transfers

Where processing involves transfer of personal data outside the EEA, the parties rely on an adequacy decision, the European Commission's Standard Contractual Clauses (which are incorporated by reference and completed by the details in the Annexes), and/or the EU‑US Data Privacy Framework, with supplementary measures where appropriate.

6. Audits

The Processor will make available information reasonably necessary to demonstrate compliance with Article 28 and allow for audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice, confidentiality, and no more than once per year unless required by a supervisory authority or following a breach.

7. Term & liability

This DPA remains in effect while the Processor processes the Controller's personal data. Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by Romanian law.

8. California Consumer Privacy Act terms

This Section applies where the Controller is a "business" and the Processor is a "service provider" as those terms are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its implementing regulations (together, the "CCPA"). Terms used in this Section have the meanings given to them in the CCPA. This Section is intended to satisfy Cal. Civ. Code §1798.100(d) and 11 CCR §7051.

• The Controller discloses personal information to the Processor only for the limited and specified business purposes described in Annex I, namely the provision of the Service.
• The Processor is prohibited from, and will not, sell or share that personal information.
• The Processor is prohibited from, and will not, retain, use or disclose that personal information for any purpose other than performing the services specified in this DPA and the Terms of Service - including for any commercial purpose other than those business purposes - or outside the direct business relationship between the parties, except where the CCPA expressly permits it.
• The Processor will not combine that personal information with personal information it receives from, or on behalf of, any other person, or that it collects from its own interaction with the consumer, except where the CCPA permits a service provider to do so. Aggregate consumer information and deidentified data, which the CCPA excludes from the definition of personal information, are outside this restriction; the Processor maintains such data only in aggregated or pseudonymized form, as described in the Privacy Policy.
• The Processor certifies that it understands the restrictions in this Section and will comply with them.
• The Processor will notify the Controller promptly, and in any event within five business days, if it determines that it can no longer meet its obligations under the CCPA.
• The Controller may take reasonable and appropriate steps to stop and remediate any unauthorized use of personal information, and, on reasonable notice, to ensure that the Processor uses the personal information in a manner consistent with the Controller's obligations under the CCPA.
• The Processor will assist the Controller in responding to verifiable consumer requests to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information, and will direct each sub‑processor it engages to take the same action.
• Each sub‑processor engaged under Section 4 is bound by a written contract containing terms substantially the same as those in this Section.

Nothing in this Section is an admission that either party is subject to the CCPA; it applies only to the extent the CCPA does.

Annex I - Details of processing

Subject matter & duration: provision of the VGS Hub Service for the term of the Controller's subscription.
Nature & purpose: collection, storage, organization, analysis, and transmission of advertising, analytics and conversion data to provide reporting, measurement, alerting and campaign‑management features; receipt and delivery of the Controller's lead‑form submissions to the destinations the Controller configures; and, where the Controller explicitly enables it, reading and updating the Controller's Merchant Center product listings.
Categories of data subjects: the Controller's personnel; the Controller's customers, leads and website visitors.
Categories of personal data: online identifiers; contact identifiers (email address and phone number), stored encrypted at rest and transmitted to advertising platforms only as SHA‑256 hashes; name and address data (first name, last name or full name, city, state / region, postal code and country), stored encrypted at rest; advertising click IDs; device/IP and event data; conversion and commercial values; lead‑form submissions, comprising the contact details and the full set of answers the data subject provided to the Controller's form; and account, campaign and product‑listing metadata. The parties do not intend for special‑category data to be processed.

Annex II - Technical & organizational measures

• Encryption in transit (TLS) and encryption at rest for credentials and sensitive identifiers;
• Application secrets stored outside the web root with restricted file permissions and excluded from source control;
• A fail‑closed per‑tenant isolation fence applied to every read and write;
• Role‑based access control and least‑privilege internal access; multi‑tenant separation;
• Curated error handling;
• Logging, monitoring, backups, and a documented breach‑response process;
• Pseudonymization / anonymization for long‑term aggregate storage.

Annex III - Sub‑processors

As listed in Section 4 above, maintained current as the Service evolves.