Home / Data Processing Agreement
Last updated: 2026-10-11
The terms on which WireAds processes personal data on behalf of publishers and advertisers, including international transfer mechanisms and security commitments.
This Data Processing Agreement ("DPA") forms part of the Terms of Service or other agreement between the customer and WireAds (the "Agreement") and applies where WireAds processes personal data on the customer's behalf in delivering the Services. It reflects the requirements of Article 28 GDPR for processors and incorporates the international transfer mechanisms described below. It takes precedence over the Agreement on matters of data protection.
Questions about this section: dpo@wireads.com
"GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as incorporated into United Kingdom law; "Swiss FADP" means the Swiss Federal Act on Data Protection. "Controller", "processor", "data subject", "personal data", "processing" and "special categories of personal data" have the meanings given in the GDPR, UK GDPR or Swiss FADP as applicable. "Services Data" means personal data the customer submits to or that is processed through the Services on the customer's instructions, including end-user identifiers in bid traffic. "Sub-processor" means a processor engaged by WireAds. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Services Data.
Questions about this section: dpo@wireads.com
The customer acts as controller (or as an intermediary processor acting on its own controller's instructions) and WireAds acts as processor. The subject matter is the provision of the Services; the duration is the term of the Agreement plus retention limits in the Privacy Policy; the purpose is ad monetisation through the unified auction, ad serving, measurement, fraud prevention and related reporting. Categories of data subjects: end users of customer properties and customer business contacts. Categories of Services Data: online identifiers, IP addresses, device and browser data, coarse location, page context and ad interaction data, as described in the Privacy Policy. The customer is responsible for the lawfulness of its instructions, including the validity of any consent or other basis for personalised advertising.
Questions about this section: dpo@wireads.com
WireAds processes Services Data only on documented instructions from the customer, which are: (a) the Agreement and its schedules, (b) configuration of tags, deals and account settings, and (c) further written instructions the customer provides through authorised contacts. We inform the customer if an instruction appears to infringe data protection law, without obligation to assess every instruction independently. Additional services outside the Agreement's scope require a mutually agreed amendment. WireAds is an independent controller solely for fraud prevention, security and compliance with legal obligations.
Questions about this section: dpo@wireads.com
WireAds ensures that personnel authorised to process Services Data are bound by confidentiality obligations, receive appropriate data protection training and access Services Data only as necessary to perform the Services.
Questions about this section: dpo@wireads.com
WireAds implements and maintains the technical and organisational measures set out in the Security section of this page and its annexes: encryption in transit and at rest appropriate to the data, access control with least privilege and MFA, network and application monitoring, vulnerability management and patching, segregation of duties, backup and recovery, and personnel training. The customer is responsible for the security of its own systems, credentials and tag implementations.
Questions about this section: dpo@wireads.com
The customer grants WireAds general authorisation to engage sub-processors, provided each is bound by written terms imposing data protection obligations no less protective than this DPA, in accordance with Article 28(2) and (4) GDPR. Our current sub-processor list is available on request to dpo@wireads.com. We will give at least 30 days' notice of new sub-processors that process Services Data, during which the customer may object on reasonable data protection grounds; failing resolution, the customer may suspend the affected Service or terminate the Agreement without penalty for the pre-paid portion.
Questions about this section: dpo@wireads.com
Taking into account the nature of the processing, WireAds assists the customer with requests from data subjects to access, rectify, erase, restrict or port their personal data, and with objections, by appropriate technical and organisational measures, insofar as the customer cannot fulfil the request itself. We forward end-user requests received directly to the customer where we can identify the customer, and answer at the contact given in the customer's account.
Questions about this section: dpo@wireads.com
WireAds may transfer Services Data outside the EEA, UK and Switzerland only with an appropriate safeguard: an adequacy decision, or the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) — Module Two (controller to processor) or Module Three (processor to processor) as the roles require — incorporated into this DPA, together with the UK International Data Transfer Addendum (or IDTA) and Swiss FADP adaptations. The customer (or its controller, where it is an intermediary processor) selects the module consistent with its role at signature or by notice. Completed transfer impact assessments and clause copies are available on request. The parties accept that real-time bidding involves transient transfers to buyers in multiple jurisdictions under their own safeguards.
Questions about this section: dpo@wireads.com
To the extent Services Data includes personal information subject to the CCPA or similar US state laws, the customer is a business (or service provider) and WireAds is a service provider: we process such data only to provide the Services, prohibit retention, use or disclosure outside the direct business relationship, do not sell or share it except as instructed for ad delivery within the Services, and certify that we understand and will comply with these restrictions. Either party may notify the other if it reasonably believes the other is violating applicable state privacy law, giving the recipient 30 days to cure.
Questions about this section: dpo@wireads.com
WireAds notifies the customer without undue delay after becoming aware of a Security Incident affecting Services Data, and no later than 48 hours where feasible, providing: the nature of the incident, categories and approximate volume of data and data subjects, likely consequences, measures taken or proposed, and a contact point. Where required by law, WireAds also notifies supervisory authorities as described on our GDPR page. Notification is not an admission of fault. WireAds takes immediate steps to contain the incident, mitigates its effects and records all incidents for review.
Questions about this section: dpo@wireads.com
WireAds maintains certifications, audit reports or summaries of its security programme and provides them to the customer annually on request. Where these are insufficient to demonstrate compliance, the customer may, no more than once per year (plus once following a Security Incident), conduct an on-site audit of WireAds' relevant facilities and systems on 30 days' written notice, during business hours, minimally intrusive to operations, with its own qualified personnel or an independent auditor bound to confidentiality and not a competitor. The customer bears its audit costs unless the audit reveals material non-compliance.
Questions about this section: dpo@wireads.com
On termination or expiry of the Agreement, WireAds deletes or returns Services Data at the customer's choice, and deletes existing copies within 90 days unless EU, UK, US or other law requires retention (for example tax or anti-fraud records), in which case retention continues only for that requirement under the protections of this DPA. Aggregated, anonymised statistics that cannot identify any person may be retained as described in the Terms.
Questions about this section: dpo@wireads.com
Liability under this DPA follows the limitations in the Terms of Service, save that those limitations do not restrict either party's liability towards data subjects under the GDPR where such restriction is prohibited — in particular, the indemnity in Article 82 GDPR operates between the parties according to their responsibility, and the limitations do not prejudice data subjects' rights as third-party beneficiaries under the Standard Contractual Clauses.
Questions about this section: dpo@wireads.com
This DPA takes effect with the Agreement and ends when Services Data is deleted or returned under this DPA. We may update it to reflect changes in law, transfer mechanisms or our sub-processor ecosystem; material adverse changes are notified in advance and customers may terminate affected Services if they cannot accept.
Questions about this section: dpo@wireads.com
DPA and data protection enquiries: dpo@wireads.com. Postal: WireAds, 944 N King St, Wilmington, DE 19801, US. Current annexes (security measures and sub-processor list) are maintained on this page or available on request.
Questions about this section: dpo@wireads.com
