Skip to content
nowyourlink Docs

Data Processing Agreement (DPA)

nowyourlink processes advertiser-controlled personal data (campaign reports include click-through identifiers; the conversion pixel reflects advertiser-side state) and therefore acts as a processor under Art. 28 DSGVO for that subset. Advertisers who require a written Auftragsverarbeitungsvertrag (AV / DPA) before going live can request one as described below.

For first-party platform processing (account, KYC, billing) nowyourlink is the controller; the legal basis and recipient list is documented in the Datenschutz at nowyourlink.com/legal/datenschutz.

How to request a DPA

Section titled “How to request a DPA”
  1. Email legal@nowyourlink.com from the address registered on your advertiser account.
  2. Include: company name, USt-IdNr., signatory name + role.
  3. We reply within 5 business days with a pre-signed PDF (template lives in packages/legal/templates/{en,de}/dpa.md).
  4. Counter-sign and return — or notify of redlines. Redlines route to legal review; expect 10 business days.

Scope

Section titled “Scope”

The DPA covers the data categories listed in Sub-processors and the retention timelines pinned in spec 12 §4 — both summarised here for orientation; the binding values stay in the spec and the template.

The DPA does not cover:

  • The advertiser’s own controller-side obligations (cookie banner on the advertiser’s landing page, etc.).
  • Anything outside the platform’s direct processing (e.g. data the advertiser submits to a downstream marketing tool).

See also

Section titled “See also”