How we handle the personal data in your brands.

1.1 The Provider is Ovnit LTD, company number 17495977, registered office 128 City Road, London, EC1V 2NX, England. It operates Adcquire. In this agreement it is called "we" or "us".

1.2 The Customer is the business that owns a Brand in Adcquire. It is called "you". The person who creates a Brand accepts the Terms, including this agreement, for that business. If you are invited into a Brand owned by another business, that business is the Customer for that Brand's data. You use the Brand on its behalf.

1.3 How it is made. This agreement is part of the Terms. You accept it when you accept the Terms at sign-up, by ticking the box that says you accept the terms of service for your business. We record which version of the Terms you accepted, and when. The version of this agreement that applies is the one published at /dpa on that date, changed only as clause 17 allows. The agreement is in writing in electronic form (UK GDPR Article 28(9)).

1.4 Signed copies. If you want a signed copy for your records, email us and we will sign this same text and send it back. A signed copy has the same content and effect as the version you accepted online. We do not negotiate individual versions.

1.5 Which document wins. On anything to do with personal data, the order is:

1. any transfer safeguard under clause 12, for the transfer it covers;
2. this agreement;
3. the rest of the Terms.

The privacy notice and the Security page describe what we do. They are not part of this contract, except where this agreement points to them.

Words such as controller, processor, personal data, processing, data subject and personal data breach mean what they mean in the UK GDPR (Article 4, including Article 4(7) for controller and 4(8) for processor).

• Account Data: the details of each person with an Adcquire login. That means their name, email address, password hash, sign-in and two-step verification records, recovery codes, consents, privacy notice and terms versions, and trial and plan dates. It also includes invitation emails (the address an owner enters and the invitation sent to it), records of contact-form messages and launch-alert sign-ups, and the account record kept after an account is deleted.
• Brand: a workspace in Adcquire, with its members, roles and data.
• Customer Data: all data held in or about one of your Brands, other than Account Data and Security Records. That includes the reports you upload, the data Amazon sends when you connect it, the listing text you paste, products, rules, automations, alerts, decisions, assignments, the change log, saved views, the Brand's members and their roles, each member's settings for the Brand, and the record of which member did what in it.
• Customer Personal Data: the personal data within Customer Data.
• Data Protection Law: the UK GDPR and the Data Protection Act 2018, both as amended (including by the Data (Use and Access) Act 2025), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 where they apply.
• Owner: a member of a Brand with the owner role.
• Regulator: the Information Commissioner, or the Information Commission that replaces it under Part 6 of the Data (Use and Access) Act 2025.
• Security Records: our log of who did what, when (the "security log"), sign-in attempt fingerprints, and error records, as described in the privacy notice.
• Service: Adcquire as described in the Terms.
• Sub-processor: another processor we engage to process Customer Personal Data.
• Terms: the Adcquire Terms of Service.
• Working day: a weekday that is not a public holiday in England.

3.1 Customer Data. For Customer Personal Data, you are the controller and we are your processor.

3.2 Account Data and Security Records. For these we are a controller in our own right. We use them to run each person's account, keep the Service secure, and send the emails the Service needs, as the privacy notice explains. This agreement does not govern that processing, except where clauses 3.3 and 13.6 say otherwise.

3.3 What the security log may hold. When a member does something in a Brand, our security log records it. The record includes the member's account number and the action. For some actions it also includes a short piece of Brand text, for example the wording of a prompt that was paused, a question that was moved, or the name given to a rule, automation or saved view. We keep the security log as a controller, for security and accountability only, for 2 years, and then delete it. You agree that we may keep these records for that purpose. We will not use them for anything else.

3.4 Not joint controllers. Neither of us decides the purposes of the other's processing. We are not joint controllers under Article 26.

3.5 No use for our own purposes. We do not use Customer Data for any purpose of our own. In particular, we do not use it for advertising, we do not sell it or show it to other customers, and we do not use it to train AI models. The only exception is the security log under clause 3.3. If we ever processed Customer Personal Data outside your instructions, the law would treat us as a controller for that processing (Article 28(10)).

3.6 Amazon. Amazon (Amazon Ads) is not our sub-processor. It is your own advertising platform, under your own agreement with Amazon. We exchange data with it only when an Owner connects your Amazon Ads account, and only on your instructions.

4.1 You are responsible for having a lawful basis for the Customer Personal Data you put into Adcquire, and for telling the people it concerns, including your team members, what you do with it.

4.2 You will not put into Adcquire any special category data, any data about criminal convictions or offences, or any personal data about children. The Service does not need it. Reports and listing text are not expected to contain personal data. Put in only what the Service needs.

4.3 Your instructions must comply with Data Protection Law.

4.4 You decide who joins your Brands and in which role. You are responsible for removing people who should no longer have access.

4.5 You make sure every Brand has at least one Owner whose account email is read. We send notices under this agreement to Owners' account emails.

4.6 You are responsible for your own relationship with Amazon, including the terms under which Amazon receives data that you tell us to send it.

5.1 We process Customer Personal Data only on your documented instructions, including on transfers outside the UK. The exception is where UK law requires otherwise. In that case we will tell you about the legal requirement before we process, unless the law forbids it on important grounds of public interest.

5.2 Your documented instructions are:

1. the Terms and this agreement;
2. what members of your Brands do in the Service within their roles. For example, uploading reports, pasting listing text, setting up rules and automations, approving or sending changes, inviting and removing people, connecting or disconnecting Amazon, exporting data, and deleting an account;
3. sending the weekly email, alerts and other notices about a Brand to its members, according to each member's settings;
4. the deletion rules in clause 13, including deleting a trial account left unused for a year after its trial ended. The account is deleted after an email warning sent 30 days before, and any sign-in cancels the deletion;
5. when the last Owner of a Brand that others still use deletes their account, making its longest-standing editor the Owner. If the Brand has no editor, the longest-standing member becomes the Owner;
6. any other instruction an Owner gives us by email, if we agree that it falls within the Service.

5.3 If we think an instruction breaks Data Protection Law, we will tell you straight away and need not follow it until you confirm or change it.

6.1 Only people who need access to provide, support or secure the Service may process Customer Personal Data. Today that is only our director. Each of them is bound by a written duty of confidentiality, or by a statutory duty of confidentiality.

6.2 Our operator screen does not open customers' Brands. Our people look at Customer Data directly only for these reasons:

• to answer a request from you;
• to fix a fault;
• to deal with a security incident;
• because the law requires it.

7.1 We keep the technical and organisational measures in Annex 2. Taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing, and the risks to people, they are designed to give a level of security appropriate to the risk.

7.2 We may change the measures over time, but we will not reduce the overall level of security. We keep the public Security page in step with Annex 2.

8.1 General authorisation. You give us general written authorisation to engage sub-processors. The current list is in Annex 3 and at /subprocessors.

8.2 Notice of changes. Before we add or replace a sub-processor that we engage ourselves, we will give at least 30 days' notice by email to the Owners of every Brand, and update /subprocessors. The providers in Annex 3 use sub-processors of their own; each publishes its list and binds them as clause 8.5 requires. The notice will say:

• who the sub-processor is;
• what it will do;
• what Customer Personal Data it will receive;
• where it will process that data;
• which safeguard under clause 12 applies.

8.3 Objecting. Within those 30 days you may object by email, on reasonable grounds relating to data protection. We will discuss your objection in good faith. If we cannot resolve it, you may end the Terms for the affected Brands before the change takes effect, by deleting the Brands or asking us to. We will refund any fees you paid in advance for the period after that date. We will not charge you any fee for leaving.

8.4 Urgent replacement. If we must replace a sub-processor sooner to protect Customer Data or keep the Service running, we will tell you as soon as we can. You then have the same right to object and leave.

8.5 Same obligations. Each sub-processor is bound by a written contract that imposes the same data protection obligations as this agreement, in particular sufficient guarantees of appropriate security (Article 28(4)). We remain fully liable to you for each sub-processor's performance of those obligations.

8.6 Hosting and email providers. Our hosting and database provider and our email provider (Annex 3) are engaged when the Service launches, on these conditions:

• the Service and its database are hosted in the UK (London), and the database backups are kept in the UK or the European Economic Area;
• the email provider processes the emails it delivers in the USA, under a safeguard in clause 12;
• their terms meet Article 28;
• they encrypt stored data at rest;
• the database backups they keep for us are kept for no more than 35 days.

8.7 AI provider. Anthropic receives nothing today because the Service's AI features are switched off. We will not send any Customer Data to Anthropic, or to any other AI provider, until all of the following are done:

1. we have given notice under clause 8.2, including what would be sent;
2. the provider is bound by terms that forbid using the data to train its models and that limit how long it keeps the data;
3. the transfer has a safeguard under clause 12;
4. the notice period has ended.

You have the right to object under clause 8.3. If you object and we cannot resolve it, the AI features will stay off for your Brands. Until you choose to leave, you will not be any worse off.

9.1 The Service has these tools to help you answer requests from individuals:

• every person can download their own data as a JSON file (Account → Download your data);
• every person can delete their own account (Account → Delete account);
• Owners can remove members and withdraw invitations;
• anyone in a Brand can download its prompts and questions as CSV files.

9.2 If we receive a request or complaint from an individual about Customer Personal Data, we will pass it to the Brand's Owners within 5 working days. We will not answer it ourselves, other than to say we have passed it on, unless you ask us to or the law requires it.

9.3 Where the tools are not enough, we will help further on request, as far as we reasonably can given the nature of the processing.

10.1 Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Articles 32 to 36. That covers security, notifying breaches, data protection impact assessments, and prior consultation with the Regulator. We do this mainly by giving you this agreement, Annex 2, and answers to reasonable questions.

10.2 Help that consists of information we already have is free. We will tell you in advance about any other reasonable cost, and charge it only if you agree.

10.3 We keep a written record of the processing we carry out for our customers, as Article 30(2) requires, and make it available to the Regulator on request.

11.1 If we become aware of a personal data breach affecting Customer Personal Data, we will tell the Owners of each affected Brand by email without undue delay, and in any case within 48 hours of becoming aware of it. We are "aware" when we are reasonably certain that a breach has happened.

11.2 With that first notice, or as soon as we know it, and as far as we know it within 72 hours of becoming aware, we will tell you:

• the nature of the breach;
• the categories and approximate number of people and records concerned;
• the likely consequences;
• what we have done or propose to do about it, including to limit its effects;
• who to contact for more information.

Where we cannot give everything at once, we will give it in stages without further undue delay (Article 33(4)).

11.3 We will take reasonable steps to contain the breach, find its cause, and stop it happening again. We will keep you informed until it is closed.

11.4 You decide whether to notify the Regulator or the people affected about Customer Personal Data. We will not do so for you unless you ask us or the law requires us to. This does not stop us dealing with our own Account Data as its controller.

11.5 Telling you about a breach is not an admission of fault.

12.1 We store Customer Personal Data in the UK, with database backups in the UK or the European Economic Area. The exception is the emails we send to Brand members: our email provider delivers them from the USA and keeps copies there (Annex 3).

12.2 In short: your data leaves the UK only to go to the providers in Annex 3, and only with a protection UK law recognises. In detail, we transfer Customer Personal Data outside the UK only to the sub-processors in Annex 3, or to those added under clause 8, and only in one of these two ways:

• approved destinations: the destination is approved by regulations under Article 45A. That includes regulations made before 5 February 2026 that continue in force, such as those covering the European Economic Area, and the UK–US data bridge, which covers US organisations certified under the UK Extension to the EU-US Data Privacy Framework (the Data Protection (Adequacy) (United States of America) Regulations 2023);
• appropriate safeguards (Article 46): the transfer is covered by the Regulator's International Data Transfer Agreement, or by its International Data Transfer Addendum to the EU Standard Contractual Clauses (Article 46(2)(d) and section 119A of the Data Protection Act 2018), or by another Article 46 safeguard. We use one of these only after an assessment that the data protection test in Article 46(6) is met.

Where a sub-processor relies on the UK–US data bridge, its contract also includes the International Data Transfer Addendum, which applies if the bridge or its certification ends.

You authorise these transfers.

12.3 When you tell us to send data to Amazon, the transfer is made on your instructions, to your own provider, under your own agreement with Amazon. What we send to Amazon is not expected to include personal data. It consists of sign-in codes and tokens, report requests, and the campaign changes your members approve.

13.1 Getting a copy. At any time while your Brand exists:

• anyone in it can download its prompts and questions as CSV files;
• each person can download their own data as JSON.

Before a Brand is deleted, an Owner may also ask us by email for a full copy of the Brand's Customer Data in a machine-readable form (JSON or CSV). We will provide it within 30 days.

13.2 Deleting. Data is deleted as follows:

• Deleting an account (Account → Delete account) takes effect straight away. If that person was the only member of a Brand, the Brand and all its Customer Data are deleted from our live database at once, including any Amazon connection. If others are still in the Brand, it stays with them and passes on under clause 5.2(5). The departing person's name and email are erased, so the records of what they did in it point only to an account number with no name or email attached.
• Deleting a Brand you share with others. An Owner can ask us by email to delete it. We will delete it within 30 days and confirm by email.
• Unused trial accounts are deleted under clause 5.2(4).

13.3 At the end. When we stop providing the Service for a Brand, you choose: we return the data under clause 13.1, or we delete it. If you have not asked for a copy before the Brand is deleted, deletion is your choice.

13.4 Backups. Copies in database backups are kept for no more than 35 days, then overwritten. If we ever restore a backup, then before the restored data is used for the Service we repeat every deletion of personal data recorded in our security log since that backup was taken.

13.5 Temporary copies. Background job records are deleted within 30 days, and so are error records (after the error was last seen). Uploaded report files are discarded once imported. Files of 2 MB or less are never stored as files. Our email provider keeps copies of the emails it delivers, and their delivery records, for the period stated in Annex 3.

13.6 What we keep. After deletion we keep only:

• a record that an account existed, with no name or email;
• the security log under clause 3.3, which is deleted after 2 years;
• anything UK law requires us to keep.

These are kept as a controller. They are not used for any other purpose.

14.1 We will make available to you all information necessary to demonstrate compliance with Article 28. We will answer reasonable written questions within 30 days.

14.2 We will allow for, and contribute to, audits, including inspections, by you or by an auditor you appoint. The auditor must be bound by confidentiality and must not be our competitor. The following conditions apply:

• notice and timing: you give 30 days' written notice, and audits happen no more than once a year. These limits do not apply after a personal data breach affecting your Brands, or when the Regulator requires an audit;
• written questions first: we start with written questions and documents. An inspection follows only if they are not enough;
• inspections: an inspection takes place during business hours. It covers only the systems and records used to process Customer Personal Data. It may be remote. For systems run by a sub-processor, we will provide that sub-processor's own audit reports or certifications, where they cover the point;
• costs: each of us bears its own costs. The exception is our time beyond one working day a year, which you pay at a reasonable rate agreed in advance.

15.1 Towards individuals and the Regulator. Nothing in this agreement limits either party's liability to individuals under Article 82, or affects the Regulator's powers. Each of us bears any fine the Regulator imposes on it.

15.2 Between us: the cap. Each party's total liability to the other under or in connection with this agreement or Data Protection Law is limited, for all claims arising from events in any period of 12 months, to the fees paid and payable by you under the Terms in the 12 months before the first event giving rise to a claim — in line with the cap in the Terms. (Owner decision #22 keeps a fees-based cap; see the risk recorded there.)

This applies whether the claim is in contract, in tort (including negligence), for breach of statutory duty, or otherwise. It includes a claim under Article 82(5) to recover compensation paid to an individual, to the extent the law allows.

15.3 What the cap covers. Within the cap, these are recoverable as direct losses when the other party caused them:

• compensation reasonably paid to individuals;
• the reasonable costs of investigating and notifying a personal data breach.

Neither of us is liable for loss of profit, revenue or goodwill, or for indirect loss.

15.4 Sharing responsibility. Each party's liability is reduced to the extent that the other party, or anyone acting for it, caused or contributed to the loss.

15.5 No cap. The cap does not apply to:

• liability for death or personal injury caused by negligence;
• fraud;
• our deliberate use of Customer Personal Data for our own purposes, or deliberately against your instructions;
• anything else that cannot be limited by law.

15.6 The Terms. This clause replaces the liability limit in the Terms for claims within its scope. The Terms' limit continues to apply to all other claims.

16.1 This agreement applies for as long as we process Customer Personal Data for you. It continues after the Terms end, until that data has been deleted or returned under clause 13.

16.2 Clauses 3.3, 13, 14 (for 12 months after the end), 15 and 19 survive the end of this agreement.

17.1 We may change this agreement only to:

• reflect a change in the law or the Regulator's guidance;
• add or replace sub-processors under clause 8;
• update Annex 2 under clause 7.2;
• make other changes that do not reduce your protection.

17.2 We will give at least 30 days' notice by email of any material change, as the Terms provide. The exceptions are an urgent replacement under clause 8.4, and a change the law requires to take effect sooner; for those we give as much notice as we can. Each version is dated and kept at /dpa. Earlier versions are available on request.

18.1 We send notices to the account email of each Owner of the Brands concerned.

18.2 You send notices to accounts@adcquire.com, or to the address shown at /company if it changes. Use "Data processing" in the subject.

This agreement, and any dispute or claim arising from it, is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

These are the measures the Service has today.

Access and separation

1. Each Brand is a separate workspace. On every request, the server checks that the signed-in person is a member of the Brand before returning or changing anything. A request for another Brand is answered as if that Brand did not exist.
2. Roles (owner, editor, viewer) are enforced on the server for every request that changes something. If no role is found, the request is treated as a viewer's. Only owners can manage the team, connect Amazon, or load or remove sample data.
3. Automated tests, run on every change, check that one Brand cannot read, change or export another Brand's data.
4. The operator's admin screen shows contact-form messages, errors, jobs and launch sign-ups. It cannot open any customer's Brand.

Sign-in and sessions

5. Passwords are stored only as one-way scrypt hashes, and must be at least 10 characters. An unknown email address takes the same time to check as a wrong password.
6. Two-step verification with an authenticator app is optional. App keys are encrypted at rest. Each code can be used once. Recovery codes are stored only as keyed hashes. Wrong codes are limited per account.
7. Sign-in, sign-up, password reset and verification emails are rate-limited by connection and by account. Failed sign-ins are capped per account, whatever address they come from.
8. Sessions:
   • end 12 hours after they were last used, in a cookie that scripts cannot read (HttpOnly, SameSite=Lax);
   • use secure-only cookies wherever the site is served over https;
   • all other sessions end when a password is reset.
9. Every request that changes something must carry a CSRF token that matches the session.
10. Email verification, password reset and invitation links are stored only as hashes and expire:
    • verification links after 48 hours;
    • password reset links after 60 minutes;
    • invitations after 7 days.

    An invitation can be accepted only by an account with the invited email address, and only while its sender is still an owner.

Encryption and secrets

11. Amazon access tokens are encrypted at rest (Fernet: AES-128-CBC with HMAC-SHA256) and never sent to the browser. They are deleted when Amazon is disconnected.
12. Background jobs that carry personal details, such as email addresses, are encrypted in the job table.
13. Email is sent over TLS with certificate checking. Production refuses to send email unless the site's address is https.
14. Production refuses to start with a missing or short secret key (under 32 characters) or without Postgres. Secrets are read from the environment and never stored in the code.

Web and network

15. The website:
    • sends a strict Content-Security-Policy that lets scripts run only with a per-request nonce, and never inline;
    • blocks framing;
    • restricts browser features;
    • sends HSTS when built for https.

    The API's responses can't run scripts, load anything, or be shown inside another site (default-src 'none').

16. The Service is built to run with only the front door facing the internet, and with the API and database on a private network. Containers run as a non-root user.
17. No advertising or analytics trackers, chat widgets or third-party fonts run on the site or in the dashboard.

Minimisation and retention

18. IP addresses and email addresses used for rate limiting are stored only as keyed hashes. These are deleted within about 2 days.
19. Error records are scrubbed of email addresses, tokens and long numbers, and deleted 30 days after the error was last seen.
20. Uploaded report files are discarded once imported. Files of 2 MB or less are never stored as files.
21. The security log records who did what and when, with a rough browser label and no IP address. It is deleted after 2 years.
22. Invitations are deleted 30 days after they are used, expire or are withdrawn. Used and expired links are purged.
23. Brand data is deleted with the Brand (clause 13). When a person leaves a shared Brand, their settings, assignments and read-marks for that Brand are deleted. When a person deletes their account, their name and email are erased, and decisions, assignments and saved views no longer name them.

Change and vulnerability management

24. Every pull request and every change to the main branch runs the full test suite on SQLite and Postgres, plus browser tests.
25. Dependencies are checked against published vulnerability databases (pip-audit and npm audit) on every pull request, on every change to the main branch, and weekly. Automated update requests are raised weekly, and straight away for security advisories.

Organisation

26. Security problems can be reported through the contact form, which gives a case reference, or by email. We aim to acknowledge each report within two working days.
27. Personal data breaches are handled under clause 11.

Not sub-processors

• Amazon (Amazon Ads). Your own advertising platform. It is reached only when an Owner connects it, which is not available yet (clause 3.6).
• Our code host and CI service. They hold source code and test data only, never Customer Data.