Data Processing Agreement (DPA)

Campaigns, documents and processing roles

Where the Customer determines the purposes and means of processing campaign participants’ personal data, the Customer acts as controller and the Provider as processor under this DPA. Publishing campaign content through public settings is an instruction to make that content and attached documents accessible to unauthenticated visitors; the Customer is responsible for the lawful basis and required notices. Processing includes storing and delivering campaign PDFs through private Vercel Blob storage and the application. This DPA does not turn the Provider’s processing for its own account administration, billing or legal obligations into processing on behalf of the Customer, nor does it determine the role for campaigns organized by the Provider itself.

1. Parties

Controller

The Customer using the clipledger service.

Processor

The Provider processes personal data on behalf of the Customer in order to provide the clipledger service.

2. Subject Matter of Processing

The processing activities covered by this DPA include providing the clipledger platform for:

• managing creator campaigns
• storing campaign configuration data
• processing submitted video links
• calculating creator payouts based on public video statistics.
• retrieving account data and media insights from third-party platforms such as YouTube, TikTok, and Meta (Facebook and Instagram), including access to the authenticated user's own video data (such as video identifiers and view counts)
• storing user profile data, including user-uploaded profile images

3. Categories of Personal Data

Depending on how the Customer uses the Service, the following data may be processed:

• email addresses
• user display names
• authentication identifiers
• creator channel URLs or usernames
• video URLs submitted to campaigns
• technical metadata such as IP addresses.
• social media account identifiers (e.g., Instagram or TikTok account IDs)
• public profile information (such as display name and profile picture, including user-uploaded profile images)
• media performance metrics (such as video views and engagement statistics, video identifiers and public video metadata (including view counts) of videos belonging to the authenticated user)

clipledger does not intentionally process special categories of personal data.

4. Categories of Data Subjects

Personal data processed through the Service may relate to:

• campaign owners
• creators participating in campaigns
• users of the clipledger platform.

5. Purpose of Processing

The Provider processes personal data only for the purpose of:

• operating the clipledger platform
• enabling campaign management features
• retrieving video data, account information, and media performance metrics (including view counts) from third-party platforms (including YouTube, TikTok, and Meta services such as Facebook and Instagram) in order to verify submitted videos and calculate campaign performance
• calculating campaign payouts
• maintaining system security and abuse prevention.

6. Processor Obligations

The Provider shall:

• process personal data only according to the documented instructions of the Customer
• ensure that persons authorized to process data are subject to confidentiality obligations
• implement appropriate technical and organizational security measures
• assist the Customer in responding to data subject requests where applicable
• notify the Customer without undue delay in the event of a personal data breach affecting the Service.

7. Subprocessors

The Customer authorizes the Provider to engage subprocessors necessary to operate the Service.

The following subprocessors are currently used:

The Provider may update this list of subprocessors as necessary to operate the Service.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), the Provider ensures that appropriate safeguards are in place, including the use of Standard Contractual Clauses or other mechanisms permitted under GDPR.

9. Security Measures

The Provider implements reasonable technical and organizational measures to protect personal data, including:

• encrypted connections (HTTPS)
• access control to infrastructure systems
• secure cloud infrastructure providers
• monitoring and abuse prevention mechanisms.

10. Data Retention

Personal data is retained only for as long as necessary to provide the Service or as required by applicable law.

Customers may request deletion of their account and associated personal data by contacting hello@akkush.tech.

11. Term and Termination

This DPA remains in effect for as long as the Customer uses the clipledger service.

Upon termination of the Service, personal data will be deleted or returned in accordance with applicable law and the Provider's data retention policies.

12. Governing Law

This DPA shall be governed by the laws of the Czech Republic.