Version 1.0 · 17 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service and of any service agreement between the customer (“Controller“) and IOANNIS PASSALIDIS, sole trader trading as JAMP Web Solutions, NIF Z5585289C, Calle Monte de Piedad 5, 18010 Granada, Spain (“Processor“). It applies whenever the Processor processes personal data on behalf of the Controller, in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). By using the services concerned, the Controller accepts this DPA.
1. Subject, duration, nature and purpose
| Services | (a) “Connect” and API relay services used by our plugins (Google Ads, Google Data Manager, Meta, TikTok); (b) support; (c) where agreed, hosting, maintenance and development of the Controller’s websites; (d) where agreed, management of advertising accounts |
| Duration | For as long as the services are provided, plus the deletion period in section 9 |
| Nature | Transmission, relay, storage (hosting only), consultation (support only) |
| Purpose | Only to provide the services to the Controller |
| Data subjects | Customers and website visitors of the Controller; users of the Controller |
| Categories of data | Identification and contact data (names, emails, phone numbers; for relay services only in hashed form), order and conversion data (values, timestamps, identifiers), online identifiers (click IDs, IP addresses where sent by the Controller) |
| Special categories | None. The Controller must not send special categories of data |
2. Processor obligations
The Processor: 1. processes personal data only on documented instructions of the Controller, including these terms and the settings chosen in the plugin, unless EU or Spanish law requires otherwise (in which case it informs the Controller unless prohibited); 2. ensures that anyone authorised to process the data is bound by confidentiality; 3. implements the security measures in Annex 1; 4. respects the conditions for sub-processors in section 4; 5. assists the Controller, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations under Articles 32–36 GDPR; 6. at the end of the services deletes or returns the data, as set out in section 9; 7. makes available the information necessary to demonstrate compliance and allows for reasonable audits, as set out in section 8.
3. Relay services: no storage
For the API relay services (a), the Processor does not store the content of requests or responses and does not log their content. Logs contain only time, endpoint, status, duration and a hash of the licence key, and are kept for 30 days. Personal identifiers (email, phone) are hashed with SHA-256 on the Controller’s website before transmission.
4. Sub-processors
The Controller gives general authorisation for the sub-processors listed at jamp.gr/subprocessors. The Processor will inform the Controller of any intended addition or replacement at least 30 days in advance by email or by updating that page with notice to active customers. The Controller may object on reasonable data protection grounds; if no solution is found, the Controller may terminate the affected service. The Processor imposes on each sub-processor the same data protection obligations as in this DPA.
5. International transfers
Transfers outside the EEA take place only under an adequacy decision (including the EU–US Data Privacy Framework) or the Standard Contractual Clauses of the European Commission.
6. Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Controller’s data, with the information available at the time.
7. Controller obligations
The Controller confirms that it has a legal basis for the processing, that it has informed data subjects (including about the use of advertising platforms), that it collects any required consent (for example for advertising cookies or Customer Match), and that its instructions comply with the law.
8. Audits
The Processor answers written questions about its compliance within 30 days. On-site audits are possible once per year, with 30 days’ notice, at the Controller’s cost, and without access to other customers’ data.
9. Deletion at the end of the services
Within 30 days of the end of the services, the Processor deletes the Controller’s personal data (or returns it, for hosting, if requested before the end), except where law requires retention. Backups are overwritten within the normal backup cycle (maximum 12 months).
10. Liability and precedence
Liability is governed by the Terms of Service or the service agreement. In case of conflict about data protection, this DPA prevails.
Annex 1: Technical and organisational measures
- Encryption in transit (TLS 1.2+) for all services; HSTS on platform domains.
- Server access only with SSH keys; administrator accounts with two-factor authentication.
- Separation: platform services run under a dedicated system user, separate from other websites; databases accessible only locally.
- Secrets (API keys, client secrets) stored outside web roots with restricted permissions, and in a password manager.
- Encrypted, off-site backups with periodic restore tests.
- Security updates applied regularly; firewall with only necessary ports open; brute-force protection.
- Data minimisation: no storage of relay content; hashed identifiers; limited log retention (30 days).
- Access to Controller data only by the owner of JAMP Web Solutions, and only when needed for the service or support.