This Data Processing Agreement (“DPA“) forms part of the Terms of Service between Clicc AI LLC, a New Hampshire limited liability company (12 Falcon Ln, Dover, NH 03820, USA) (“CLICC“, the “Processor“) and the Customer (the “Controller“), and applies wherever CLICC processes personal data on the Customer’s behalf in providing the Service.
1. Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “supervisory authority” have the meanings given in the EU General Data Protection Regulation 2016/679 (“EU GDPR“), the UK GDPR, and, where applicable, US state privacy laws (where “personal data” includes “personal information” and CLICC acts as a “service provider”). “Customer Personal Data” means personal data contained in Customer Data processed by CLICC on the Customer’s behalf — including personal data appearing in Google Ads account data such as search terms, and in support records and usage logs.
2. Roles and scope
2.1 The Customer is the controller (or a processor acting for its own clients, in which case CLICC is a subprocessor) of Customer Personal Data; CLICC is the processor. Details of the processing (subject matter, duration, nature, purposes, data categories, data subjects) are set out in Annex A.
2.2 This DPA is intended to satisfy the written-contract requirements of Article 28(3) EU/UK GDPR and Section 7 of the Google Ads API Terms, and CLICC will process personal data originating from Google Ads consistently with the Google Ads Data Processing Terms as applicable to the Customer’s use of Google Ads.
3. Processor obligations
CLICC will:
(a) process Customer Personal Data only on the Customer’s documented instructions (the Terms, this DPA, and the Customer’s configuration and use of the Service constitute those instructions), unless required otherwise by law, in which case CLICC will inform the Customer unless legally prohibited;
(b) ensure persons authorized to process Customer Personal Data are bound by confidentiality obligations;
(c) implement the technical and organizational measures described in Annex B;
(d) engage subprocessors only as permitted by Section 5;
(e) taking into account the nature of the processing, assist the Customer with data subject requests, and with the Customer’s obligations under Articles 32–36 EU/UK GDPR (security, breach notification, impact assessments);
(f) notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data, providing information reasonably required for the Customer’s own notification obligations;
(g) at the Customer’s choice, delete or return Customer Personal Data at the end of the engagement in accordance with Section 7;
(h) make available information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as described in Section 8;
(i) not “sell” or “share” personal information (as defined by the CCPA/CPRA), nor retain, use or disclose it other than to provide the Service or as permitted by applicable law, and will notify the Customer if it can no longer meet these obligations.
4. Customer obligations
The Customer warrants that it has established a lawful basis for the processing, has provided any required notices to data subjects, and — for Google Ads accounts belonging to its own clients — has obtained each client’s written consent as required by the Terms of Service and Google’s third-party policy.
5. Subprocessors
5.1 The Customer grants general authorization for the subprocessors listed at clicc.ai/subprocessors.
5.2 CLICC will give at least 30 days’ notice (by email or in-app notice) before adding or replacing a subprocessor that processes Customer Personal Data. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected Service with a pro-rata refund of prepaid fees.
5.3 CLICC will impose data-protection obligations on subprocessors materially equivalent to this DPA and remains liable for their performance.
6. International transfers
Where Customer Personal Data of UK/EEA data subjects is transferred to CLICC in the United States or to subprocessors outside the UK/EEA, the parties incorporate by reference the European Commission Standard Contractual Clauses (2021/914, Module 2: controller-to-processor, or Module 3 where the Customer is itself a processor) and, for UK transfers, the UK International Data Transfer Addendum, completed with the details in Annex A and the measures in Annex B. If CLICC certifies under the EU-U.S. Data Privacy Framework (and UK Extension), that certification may serve as the transfer mechanism for the covered transfers.
7. Deletion and return
Upon disconnection of a Google Ads account, CLICC ceases syncing and deletes the related OAuth refresh token immediately. Upon termination of the Service, the Customer may export Customer Data for 30 days; CLICC then deletes Customer Personal Data (including semantic-search embeddings) within 90 days, except where retention is required by law and excluding backups, which expire on a rolling cycle within 90 days.
8. Audit
CLICC will make available, on reasonable request and no more than annually, documentation and security summaries sufficient to demonstrate compliance. Where these are insufficient, the Customer may conduct (at its cost, on 30 days’ notice, without disrupting operations, under confidentiality) an audit limited to CLICC’s processing of Customer Personal Data.
9. Liability and order of precedence
Liability under this DPA is subject to the limitations and exclusions of the Terms of Service. If this DPA conflicts with the Terms, this DPA prevails with respect to data protection; the Standard Contractual Clauses prevail over both where they apply.
Annex A — Processing details
- Subject matter / nature / purpose: hosting, syncing, analysis (including AI classification, scoring, recommendation generation and semantic-search embedding), display and export of Google Ads account data; provision of support and product communications.
- Duration: the term of the Customer’s subscription plus the deletion periods in Section 7.
- Categories of data subjects: the Customer’s users; individuals whose personal data appears in Google Ads account data (e.g. within search terms); the Customer’s clients’ personnel (agency use).
- Categories of personal data: account and contact details of users; Google Ads account data including search terms, keywords, campaign data, spend and performance metrics (which may incidentally contain personal data); support communications; usage logs and session replays.
- Special category data: none intended; search terms may incidentally contain such data typed by searchers, processed only as part of the Ads Data.
Annex B — Technical and organizational measures
- Encryption of data in transit (TLS) and at rest on cloud infrastructure (AWS, Google Cloud, and EU-hosted subprocessors).
- OAuth token security in line with Google’s security requirements; refresh tokens stored securely and deleted on disconnection.
- Per-organization data isolation, including semantic-search embedding indexes scoped to the customer’s organization.
- Least-privilege, role-based access for CLICC personnel; production access restricted.
- Session-replay masking of sensitive fields (e.g. billing information).
- Monitoring, logging and alerting on production systems; documented incident response including customer and (where applicable) Google notification.
- Vendor management: subprocessors bound by DPAs; public subprocessor list with change notice.
- Backup and deletion lifecycle as described in Section 7.