This Data Processing Agreement ("DPA") is part of your agreement with Regents Inc dba Gushwork ("Gushwork") for Gushwork Ads, under the Gushwork Ads Terms of Service. It applies when Gushwork processes personal data for you while providing Gushwork Ads. Words defined in the Terms have the same meaning here. Where this DPA and the Terms conflict on personal data, this DPA applies.
1. Roles
For leads and other personal data in your Meta assets and in Gushwork Ads ("Client Personal Data"), you are the controller, business or data fiduciary, and Gushwork is your processor, service provider or data processor, as those terms are used in the law that applies.
2. What Gushwork processes
| Subject | Details |
|---|---|
| Purpose | Running your Meta lead ads through Gushwork Ads: creating and managing campaigns and lead forms, receiving and showing leads, and reporting results. |
| People | People who submit your lead forms, and your staff who use Gushwork Ads. |
| Data | The answers people give in your lead forms, such as name, email, phone number and company, with the time and the ad they came from; your staff's names, emails and roles. |
| Duration | The term of the Agreement, then until deletion under section 8. |
3. Gushwork's obligations
- Process Client Personal Data only on your documented instructions. The Agreement and your use of Gushwork Ads are those instructions. Gushwork tells you if it believes an instruction breaks the law.
- Not sell or share Client Personal Data, not use it for its own purposes or another client's, and not combine it with data from other clients or sources, except as the law permits a service provider to do.
- Keep each client's data separate from every other client's.
- Make sure everyone who handles it is bound by confidentiality.
- Protect it with the measures in section 9 of the Privacy Policy, and keep them at least as strong during the term.
- Tell you if it can no longer meet these obligations. You may then take reasonable steps to stop any processing that is not allowed.
4. Your obligations
- Have a lawful basis, and give any notice or obtain any consent the law requires, for Gushwork to process Client Personal Data for you. Each lead form links to a privacy notice for your business that Gushwork Ads publishes once you accept it.
- Use leads and other data Gushwork Ads gives you only as Meta's Platform Terms and Lead Ads Terms allow: do not sell or license them, combine them with other advertisers' data, use them for surveillance, or use them to decide who qualifies for credit, housing, jobs or insurance.
5. Sub-processors
You authorize Gushwork to use the sub-processors listed in section 6 of the Privacy Policy. Each is bound in writing to obligations at least as protective as this DPA, and Gushwork is responsible for them. Gushwork emails your admins before adding or replacing one. You have 15 days to object on reasonable data protection grounds. If we cannot resolve it, you may end the affected service.
6. Requests from people
If someone asks Gushwork to access, correct or delete their data, or exercise another right, Gushwork passes the request to you within 5 business days and does not answer it without your instruction, unless the law requires. Gushwork helps you respond, including by deleting data you ask it to delete.
7. Security incidents
Gushwork notifies you without undue delay, and in any event within 72 hours, after becoming aware of a breach affecting Client Personal Data. The notice says what happened, the data and people affected, and what Gushwork is doing. Gushwork updates you as it learns more and helps you meet any duty to notify authorities or people.
8. Deletion
You can download your leads at any time. You can delete a project's data yourself in Gushwork Ads, as described on the Data Deletion page. When the Agreement ends, Gushwork deletes Client Personal Data within 30 days, and backup copies within 35 days after that, unless the law requires it to keep them.
9. Information and audits
Gushwork gives you, on request, the information reasonably needed to show it meets this DPA. If that is not enough, or a regulator requires it, you may audit once a year, on 30 days' notice, during business hours and under confidentiality, at your cost.
10. Where data is stored
Gushwork Ads stores data in the United States on Amazon Web Services. Our team administers it from India and the United States. Where the law of the European Economic Area, the United Kingdom or Switzerland applies to a transfer, the Standard Contractual Clauses (controller to processor, or processor to processor, as fits) and the UK Addendum apply and are part of this DPA.
11. Contact
Email admin@gushwork.ai.