Data Processing Agreement | DoohDeal

1. Parties

Controller: the Organization that has accepted the Platform Terms ("Customer").
Processor: DoohDeal (operator details to be completed by the founders) ("DoohDeal").

2. Subject and duration

2.1 DoohDeal processes personal data for the Customer in order to provide the Platform. Annex 1 sets out the subject, nature, purpose, types of data and categories of people (Art. 28(3) GDPR).

2.2 This Agreement runs as long as DoohDeal processes personal data for the Customer under the Platform Terms.

3. Roles

3.1 This Agreement covers only the data in Annex 1, Part A, where the Customer decides why the data is processed.

3.2 DoohDeal is an independent controller for the data in Annex 1, Part B. There its privacy policy applies, not this Agreement.

3.3 When two Organizations talk in a Deal Room, each is a separate controller of what it receives from the other.

4. Instructions (Art. 28(3)(a))

4.1 DoohDeal processes the data only on the Customer's documented instructions, including on transfers to third countries, unless the law requires otherwise. The Platform Terms, this Agreement and the Customer's use of Platform features are the instructions.

4.2 If the law requires other processing, DoohDeal tells the Customer first, unless the law forbids it.

4.3 DoohDeal tells the Customer if it believes an instruction breaks data protection law.

5. Confidentiality (Art. 28(3)(b))

Everyone at DoohDeal who can access the data is bound to confidentiality.

6. Security (Art. 28(3)(c), Art. 32)

DoohDeal applies the measures in Annex 2 and may improve them, as long as the level of protection does not fall.

7. Sub-processors (Art. 28(2), (3)(d), (4))

7.1 The Customer gives general authorisation for the sub-processors in Annex 3.

7.2 DoohDeal tells the Customer before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds. If the parties cannot resolve it, the Customer may end the affected service.

7.3 DoohDeal binds each sub-processor to the same data protection duties and remains liable for it.

8. Rights of data subjects (Art. 28(3)(e))

8.1 DoohDeal helps the Customer answer requests from data subjects, as far as reasonably possible, using suitable measures.

8.2 The Platform has a self-service data export and account deletion. An account deletion removes the person's personal data as described in Annex 1, Part C.

8.3 DoohDeal forwards requests it receives directly and does not answer them itself, unless told to.

9. Help with security, breaches and assessments (Art. 28(3)(f), Art. 32–36)

9.1 DoohDeal tells the Customer without undue delay after becoming aware of a personal data breach (Art. 33(2)). The notice gives what is known at that time. The rest follows as it becomes known.

9.2 DoohDeal helps with data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to it.

10. Deletion or return (Art. 28(3)(g))

When the service ends, the Customer can ask DoohDeal to delete the personal data, unless the law requires it to be kept.

11. Audit (Art. 28(3)(h))

11.1 DoohDeal gives the Customer the information needed to show compliance with Art. 28.

11.2 It allows and contributes to audits, on reasonable notice, during business hours, and without access to other customers' data. DoohDeal may first offer suitable reports. It holds no third-party security certification or completed external penetration test.

Some sub-processors in Annex 3 are based outside the EEA, for example OpenAI in the United States.

13. Liability and precedence

13.1 Liability follows Art. 82 GDPR and the Platform Terms.

13.2 On personal data, this Agreement prevails over the Platform Terms.

Acceptance

An owner or admin of the Customer accepts this Agreement by click. The acceptance is recorded with the User, the Organization, the version and the time.

Annex 1. Processing details

Purpose: providing the Platform to the Customer, namely planning campaigns, negotiating, running and reporting on Deals, and support.

Nature: collection, storage, display to the counterparty chosen by the Customer, transmission, analysis by AI features the User has consented to, and deletion.

Part A. DoohDeal as processor

Data	Categories of people	Where it comes from
Names, email and phone of the Customer's contacts added to rooms or client plans	Customer's staff, its clients' staff	Customer's Users
Deal Room messages and attachments	Customer's staff, counterparty staff	Customer's Users
Campaign briefs, uploaded documents (brief, media plan, email)	Anyone named in them	Customer's Users
Client names and client plan recipients	Clients' staff	Customer's Users
Ad files (creatives, artwork)	Anyone shown in them	Customer's Users
AI inputs and stored AI memory for the User or Organization	Customer's Users	Customer's Users, after AI consent

The Customer must not upload special categories of personal data (Art. 9).

Part B. DoohDeal as independent controller (not covered by this Agreement)

Data	Why
Account and login data, roles, security logs, IP addresses	Running and securing the service
Billing contacts, VAT numbers, invoices, payout and bank details	Contract and legal duties
Records of acceptance of terms and AI consent	Proof
Support conversations	Support
Product analytics, cookies	See cookie policy

Part C. Deletion on the Platform today

Data	Treatment
Rooms a deleted User created	Deleted, including their flights, terms and versions
The User's participant rows	Deleted across all rooms
The User's messages in other parties' rooms	Author link removed, text kept
Finance contact on a billing profile	Name, email and phone cleared
Audit logs	Deleted after 90 days
Error logs	Deleted after 30 days (resolved) or 90 days (unresolved)
Resolved or closed support chats	Deleted after 30 days
Money audit trail, invoices, ledgers	Kept

Screens and audiences

The Media Player and the play records hold screen, creative and time data. We found no data about people in front of a screen in the play records. DoohDeal does not take in camera or passer-by data. Audience per Play is a number supplied by the Publisher.

Annex 2. Technical and organizational measures

Access: row-level security on the database per organization, roles per organization, service keys held server-side only, and commercial data locked against client writes.
Audit: money changes are written to a dedicated audit trail.
Transport: HTTPS with managed certificates.
Error tracking: EU region, with personal data scrubbed before sending and default collection of personal data turned off.
Commits: secret scanning before each commit, restricted commit identities.
Scheduled jobs: signed calls.
AI: all model calls go through one controlled path with guardrails and cost tracking.

Annex 3. Sub-processors

Service	Purpose	Personal data
Hetzner Online	Application hosting	All Platform data in transit and logs
Supabase	Database, sign-in, file storage	All Platform data
Resend	Transactional email	Names, email addresses, email content
Amazon Web Services	Email fallback, company mailboxes, DNS	Names, email addresses, email content
Sentry	Error tracking	Scrubbed technical data
OpenAI	AI features	AI inputs, including brief content
Stripe	Payments, invoices, Connect payouts	Billing contacts, payment data
Mapbox	Maps	IP address, usage events
Cloudflare	Bot check at login or sign-up	IP address, browser signals
Google	Optional sign-in	Name, email, if the User chooses it
Browser push services	Push notifications	Device token, notification content
EU VIES	VAT number check	Company VAT number