Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Adly Terms of Service between you, the business using Adly (the "Customer"), and Adly Technologies Ltd ("Adly"). It applies when Adly handles personal data about your customers and contacts on your behalf. It follows Article 28 of the UK GDPR and the EU GDPR, and it also covers similar laws in other countries, such as the data protection laws of Saudi Arabia, the UAE, Jordan and Egypt. You accept it when you accept the Terms; no signature is needed. If your business needs a signed copy, ask us in the chat on any Adly page.

1. Who Does What

For the personal data described in section 2 ("Customer Personal Data"), you are the controller and Adly is your processor: you decide why and how it is used, and Adly handles it only to provide the Service to you. For the data about you as our customer (your account, billing and use of Adly), Adly is the controller, as described in our Privacy Policy.

2. What This Agreement Covers

• Leads and form entries collected through landing pages, lead forms and catalogs you publish with Adly.
• Messages and contacts from people who contact your business through your connected WhatsApp, Instagram and Facebook accounts, including comments that trigger automations, conversation history in the inbox, and opt-out records.
• Bookings and customer details handled by your WhatsApp bot.
• Personal data in content you upload, such as photos of people, customer reviews or contact details you put in designs.

People concerned: your customers, prospects, website visitors and people who appear in your content. Types of data: names, phone numbers, email addresses, messages, images, booking details and account identifiers provided by Meta. Duration: for as long as you use the Service, then deleted as described in section 8. The Adly apps for Shopify and Lightfunnels read your products only and do not access your store's customer data.

3. Your Instructions

Adly processes Customer Personal Data only on your documented instructions, which are these Terms, this DPA, your settings and the actions you take in the Service, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it). If we believe an instruction breaks data protection law, we will tell you.

4. Confidentiality and Security

Everyone at Adly or working for Adly who can access Customer Personal Data is bound by confidentiality. We keep appropriate technical and organisational security measures, including encryption, access controls, monitoring and backups, and we review them regularly.

5. Subprocessors

You authorise Adly to use other companies to help provide the Service ("subprocessors"): our hosting and infrastructure providers (including Cloudflare), Meta (to send and receive WhatsApp, Instagram and Facebook messages), the AI providers listed in our Privacy Policy (to write replies and process content you ask us to create), and our email provider (to send you notifications). The current list is in our Privacy Policy. We bind each subprocessor to data protection terms that protect the data at least as well as this DPA, and we stay responsible to you for their work. Before adding a new kind of subprocessor we update that list; you can object in the chat within 30 days, and if we cannot address your concern you may stop using the affected feature or end your plan.

6. Helping You Meet Your Duties

• Requests from people: you can see, download and delete leads in the Service, and ask us in the chat for a copy or deletion of conversations. If someone contacts Adly about data we hold for you, we will pass the request to you, and we will help you answer requests where you cannot do it yourself.
• Security incidents: if we become aware of a breach affecting Customer Personal Data, we will tell you without undue delay, with the information we have, so you can meet any duty to inform a regulator or the people affected.
• Assessments: we will give reasonable help with data protection impact assessments and with questions from a regulator.

7. Showing Compliance

We will give you the information reasonably needed to show that we meet this DPA, and answer a reasonable security or privacy questionnaire once a year. An on-site audit is possible only where a regulator requires it, with reasonable notice, during business hours, under confidentiality and at your cost.

8. When the Service Ends

You can download your leads at any time and ask us in the chat for a copy of your conversations. When you delete data, a brand or your account, we delete the related Customer Personal Data as described in our Privacy Policy (a deleted account is erased 30 days after deletion), except where the law requires us to keep it.

9. Your Responsibilities

• You have a lawful basis to collect the data and to have Adly process it, including any consent needed to message people (for example under WhatsApp and Meta messaging rules or marketing laws) and to show people's images or words in your content.
• Your own privacy notice tells your customers that you use service providers such as Adly.
• You do not upload sensitive data (for example health, religious or financial account data) or data about children unless you have a lawful basis and it is needed.

10. International Transfers

Customer Personal Data may be processed in the United Kingdom, the European Economic Area, the United States and other countries where our subprocessors operate. Data sent from the EEA to Adly in the United Kingdom relies on the EU adequacy decision for the UK. Where Adly or a subprocessor sends data to a country without an adequacy decision, we use the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another valid safeguard.

11. General

The limits of liability in the Terms of Service apply to this DPA. If this DPA and the Terms disagree about personal data, this DPA prevails. This DPA is governed by the same law as the Terms. We may update it when the law or our Service changes; the effective date at the top shows the current version.