Data Processing Agreement

Parties

Processor

BURIZA, a French single-member simplified joint-stock company (SASU), 229 rue Saint-Honoré, 75001 Paris, France, 930 929 252 RCS Paris.

Controller

The customer that holds a Get MCP Ads organisation.

Version

1.0, 12 November 2026

Contact

hello@getmcpads.com

1. Scope and roles

The customer is the controller and BURIZA is the processor of the personal data processed through Get MCP Ads on the customer's behalf: data read from the accounts the customer connects, and data the customer saves in the service. Where the customer acts for its own clients, BURIZA is a sub-processor.

This agreement forms part of the Terms of use and applies without a separate signature. A signed copy is available on request at hello@getmcpads.com.

Data BURIZA processes for its own purposes, such as account management, billing and analytics, is covered by the privacy policy. The advertising platforms and the AI assistant the customer connects are the customer's own providers.

2. Details of the processing

• Purpose: providing Get MCP Ads under the Terms of use.
• Duration: the term of the customer's use of the service.
• Data subjects: the customer's users, and people whose data appears in the customer's connected accounts or saved content.
• Data: names and email addresses of users, account identifiers, advertising and analytics reporting data, ad names, copy and creative media, and notes saved by the customer.
• Special categories: none intended.

3. Processor obligations

BURIZA:

• processes personal data only on the customer's documented instructions, which are the Terms of use, this agreement and the customer's use of the service;
• ensures that the people authorised to process the data are bound by confidentiality;
• implements the security measures in Annex II;
• assists the customer, as far as reasonably possible, with data subject requests, impact assessments and consultations with supervisory authorities;
• notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data.

4. Sub-processors

The customer authorises BURIZA to use the sub-processors listed in Annex III. BURIZA informs customers of any new sub-processor at least 30 days in advance by updating this page and by email. The customer may object on reasonable grounds and, if no solution is found, terminate the service.

BURIZA binds each sub-processor to data protection obligations equivalent to this agreement and remains responsible for them.

5. International transfers

Customer data is hosted in the United States. Transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (Commission Decision 2021/914) in place with each sub-processor.

6. Deletion

When the customer deletes its organisation, or at the end of the contract, BURIZA deletes customer personal data within 30 days, unless the law requires it to be kept.

7. Audits

BURIZA makes available the information needed to demonstrate compliance with this agreement. Where that information is not enough, the customer may audit once a year, with 30 days' notice, at its own cost and under confidentiality.

8. General

Liability under this agreement is subject to the Terms of use. In case of conflict with the Terms of use on data protection, this agreement prevails. This agreement is governed by French law.

Annex I. Details of the processing

See Section 2.

Annex II. Security measures

Encryption

• TLS on all endpoints.
• Platform access tokens encrypted with AES-256-GCM, with the key stored separately from the database.
• API keys and share links stored as hashes.

Access control

• OAuth 2.1 with PKCE for assistants, with access rechecked on every call.
• Role-based permissions, and access granted per ad account.
• Changes to ad accounts require explicit confirmation.
• Production access limited to the people who operate the service.

Data minimisation

• Assistants never receive platform tokens.
• Interactive answers are not stored as reports; logs exclude prompts and responses.
• Data isolated per organisation, with published retention periods.

Annex III. Sub-processors

Transfer mechanism for each: EU-US Data Privacy Framework and Standard Contractual Clauses.