Data Processing Agreement

Definitions:

• We use any of the terms “we”, “us” and “our” to refer to Feedoptimise ®™, a trading name of 33Concept Ltd.
• We use any of the terms “User”, “you” and “your” as defined in the Terms of Use, to refer to the person or legal entity that registers for, accesses or uses the Feedoptimise Services. This DPA applies to all Users, including those using a free trial.
• We use the term “Content” as defined in the Terms of Use.
• We use the term “Content Personal Data” to refer to any Personal Data contained in Content that we process on your behalf in providing the Services.
• We use the term “Data Protection Laws” to refer to the UK GDPR, the Data Protection Act 2018, the EU General Data Protection Regulation 2016/679 (“EU GDPR”) where it applies, and any other data protection laws that apply to the processing of Content Personal Data under the Terms of Use.
• We use the terms “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing” and “Supervisory Authority” as defined in the Data Protection Laws.
• We use the term “Personal Data Breach” to refer to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Content Personal Data.
• We use the term “Sub-processor” to refer to any third party we engage to process Content Personal Data on your behalf.
• We use the term “Restricted Transfer” to refer to a transfer of Content Personal Data to a country outside the UK or the European Economic Area that is not covered by an adequacy decision or adequacy regulations under the Data Protection Laws.
• Any other capitalised terms not defined in this DPA have the meaning given in the Terms of Use.

This Data Processing Agreement (“DPA”) constitutes a legally binding agreement between Feedoptimise ®™, a trading name of 33Concept Ltd, a Private Limited Company, with a registration number 07286718, registered in United Kingdom, and the User.

This DPA forms part of the Terms of Use and governs how we process Personal Data that Users submit to the platform as part of their Content. It applies automatically to all Feedoptimise accounts, without the need for a separate signature.

This DPA does not cover Personal Data that Feedoptimise processes as a Controller in its own right, such as your login email address, optional first and last name, billing details, access logs and cookie data. That processing is described in our Privacy Policy.

1. Scope and roles

   1. Content submitted to Feedoptimise consists of product, catalogue, inventory and campaign data and is not intended to contain Personal Data. This DPA applies only to the extent that Content does contain Personal Data.
   2. In relation to Content Personal Data, you are the Controller and Feedoptimise is your Processor. The details of the processing are set out in Annex 1.
   3. You are responsible for ensuring that you have a lawful basis for submitting Content Personal Data to the Services, that you have provided any notices required by the Data Protection Laws, and that your instructions to Feedoptimise comply with those laws.
   4. You must not submit to the Services any special category data, criminal offence data, government identification numbers, payment card data, or other sensitive Personal Data, unless agreed with Feedoptimise in writing.
   5. You should include in Content only the Personal Data that is necessary for your use of the Services, for example by excluding shopper, buyer or reviewer details from product feeds.

2. Processing instructions

   1. Feedoptimise will process Content Personal Data only on your documented instructions. Your instructions consist of the Terms of Use, this DPA, the configuration of your account (including your sources, feeds, rules, integrations and any AI features you enable), and any other written instructions you give us that are consistent with the Terms of Use.
   2. Feedoptimise may also process Content Personal Data where required to do so by UK law or the law of the European Union or a member state to which it is subject. In that case, we will inform you of that legal requirement before processing, unless the law prohibits this.
   3. We will tell you promptly if, in our opinion, an instruction infringes the Data Protection Laws.
   4. We will not use Content Personal Data for our own purposes, sell it, or use it to train, fine-tune or otherwise improve AI models, whether our own or those of third parties.

3. Confidentiality of personnel

   Feedoptimise will ensure that everyone authorised to process Content Personal Data is bound by an appropriate duty of confidentiality, whether contractual or statutory. Access is limited to personnel who need it to provide, support or secure the Services.

4. Security

   Feedoptimise will implement and maintain appropriate technical and organisational measures to protect Content Personal Data, as required by Article 32 of the UK GDPR and EU GDPR. The current measures are described in Annex 2. We may update these measures over time, provided the overall level of protection is not reduced.

5. Sub-processors

   1. You give Feedoptimise general authorisation to engage the Sub-processors listed in Annex 3, and further Sub-processors in line with this section.
   2. We will give you at least thirty (30) days notice before engaging a new Sub-processor, by updating Annex 3 and notifying account owners by email or within the platform.
   3. You may object to a new Sub-processor on reasonable data protection grounds by writing to privacy@feedoptimise.com within that notice period. We will discuss your concerns in good faith. If we cannot resolve them, you may stop using the Services at any time, without penalty, under clause 8.1 of the Terms of Use.
   4. Feedoptimise will impose data protection obligations on each Sub-processor by written contract that are no less protective than those in this DPA. We remain responsible to you for the performance of our Sub-processors.
   5. The following are not Sub-processors, because you choose them and the data is sent to them on your instructions:
      • destination channels and partner platforms you connect, such as Google Merchant Center, Meta or affiliate networks;
      • AI providers you use with your own API key for AI modifiers, where your own agreement with that provider applies;
      • AI assistants you connect through our MCP server.

6. International transfers

   1. The Feedoptimise platform is hosted on Google Cloud Platform in the United States, and some Sub-processors process data outside the UK and the European Economic Area. Content Personal Data may therefore be subject to a Restricted Transfer.
   2. Where a Restricted Transfer takes place, Feedoptimise will ensure it is covered by an appropriate safeguard under the Data Protection Laws, such as the recipient's certification under the EU-U.S. Data Privacy Framework and its UK Extension, the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Agreement or UK Addendum.
   3. Content processed by our self-hosted AI models is processed on hardware we operate in the United Kingdom and is not transferred to any third-party AI provider.

7. Data subject requests

   1. If Feedoptimise receives a request from a Data Subject relating to Content Personal Data, we will pass it to you without undue delay and will not respond to it ourselves, other than to direct the Data Subject to you.
   2. You can access, correct and delete Content directly within the platform. Where you need further help to respond to a request, we will provide reasonable assistance, taking into account the nature of the processing and the information available to us.

8. Personal data breaches

   1. Feedoptimise will notify you without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Content Personal Data. Notice will be sent to the account owner and any Incident Contacts nominated under the Service Level Agreement.
   2. The notice will include, as far as the information is available, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Where not all information is available at once, we will provide it in phases.
   3. We will take reasonable steps to contain and remedy the breach, and give you the help you reasonably need to meet your own notification obligations. Notifying you of a breach is not an admission of fault or liability.

9. Impact assessments and consultation

   Feedoptimise will give you reasonable assistance with any data protection impact assessment, and any prior consultation with a Supervisory Authority, that you are required to carry out in relation to the Services. This assistance is limited to the processing of Content Personal Data and the information available to us.

10. Deletion and return

    1. You can export and delete your Content at any time while your account is active.
    2. After your account is closed, you can review and export your configuration data for thirty (30) days, as described in clause 8.5 of the Terms of Use. After that period, and subject to section 10.5, Feedoptimise will delete or anonymise Content Personal Data from its active systems.
    3. Copies held in backups will be deleted within fourteen (14) days in the normal backup cycle. Until then, they remain protected under this DPA and are not used for any other purpose.
    4. This section does not apply to data we must keep under applicable law, which remains protected under this DPA for as long as we hold it.
    5. Mapping settings and change history records, including any Content Personal Data they contain, are retained for twelve (12) months after your account is closed, and in any event no change history entry is kept for longer than two years from the date of the change. You instruct us to retain them for this period so that, if you return, your configuration can be restored automatically when you reconnect your sources, so that changes made within your account can be audited, and so that either Party can establish, exercise or defend legal claims relating to the Services. During that period they remain protected under this DPA and are not used for any other purpose. You can still view them through your login, as described in clause 8.5 of the Terms of Use, and our own access to them is restricted to authorised personnel. At the end of the period they are deleted or anonymised.

11. Information and audits

    1. Feedoptimise will make available to you the information reasonably necessary to demonstrate compliance with this DPA, including written answers to reasonable security and data protection questionnaires.
    2. Where that information is not enough to demonstrate compliance, or where a Supervisory Authority requires it, you may carry out an audit, either yourself or through an independent auditor bound by confidentiality. Audits are limited to once in any twelve (12) month period, unless following a Personal Data Breach or required by a Supervisory Authority.
    3. You must give at least thirty (30) days written notice of an audit. Audits take place during UK business hours, are limited to the systems and records relevant to Content Personal Data, must not unreasonably disrupt the Services or put other Users' data at risk, and are carried out at your cost.

12. General

    1. Liability. Each Party's liability under this DPA is subject to the limitation of liability in the Terms of Use.
    2. Duration. This DPA applies for as long as Feedoptimise processes Content Personal Data on your behalf, including after the Terms of Use end.
    3. Order of precedence. If there is any conflict between this DPA and the Terms of Use in relation to the processing of Content Personal Data, this DPA prevails. If there is any conflict between this DPA and any Standard Contractual Clauses or UK transfer terms that apply under section 6, those clauses prevail.
    4. Changes. We may update this DPA to reflect changes in the Data Protection Laws, guidance from a Supervisory Authority, or our Services. We will give at least thirty (30) days notice of any change that reduces your protection, and if you do not accept it you may stop using the Services under clause 8.1 of the Terms of Use.
    5. Governing law. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Data Protection Laws or transfer clauses under section 6 require otherwise.
    6. Contact. Questions about this DPA can be sent to privacy@feedoptimise.com.

Annex 1: Details of processing

Annex 2: Technical and organisational security measures

Annex 3: Sub-processors

Payment processors are not listed because they handle billing data, for which Feedoptimise is the Controller under the Privacy Policy, not Content Personal Data.