Data Processing Agreement

This Data Processing Agreement (“DPA”) sets out how Klik Til Kunder processes personal data on behalf of customers who use Agentrix, in line with Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

01How this agreement applies

This DPA forms part of the Terms of Service between you and Klik Til Kunder, CVR 37876674, Ole Jørgensens Gade 7, st. th., 2200 København, Denmark (“we”, “us”, “our”). It applies automatically when you accept the Terms, and it applies for as long as we process personal data on your behalf.

It covers personal data that we process as your processor when you use Agentrix. It does not cover personal data we process as a controller in our own right, such as your account details, billing records, support correspondence, and visits to agentrix.one. Those are described in our Privacy Policy.

If your organisation needs a countersigned copy for its records, write to hello@agentrix.one and we will send one on the terms published here.

02Definitions

Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the GDPR. In addition:

• Customer Personal Data means personal data that we process on your behalf as described in Annex 1.
• Data Protection Law means the GDPR, the Danish Data Protection Act (databeskyttelsesloven), and any other data protection law of the EU or an EU member state that applies to the processing.
• Sub-processor means another processor we engage to process Customer Personal Data.
• Organisation means a business or agency organisation in Agentrix, including client organisations managed by an agency.
• Agents means the automated agents in Agentrix, including the brain, specialist agents, and any agents you configure.

03Roles of the parties

You are the controller of Customer Personal Data. You decide what goes into Agentrix, which advertising accounts to connect, who in your organisation has access, what the agents are allowed to do, and what you tell visitors of the sites you publish. We are your processor.

Agencies. If you are an agency working in a client organisation, your client may be the controller and you its processor. In that case we act as your sub-processor for that client’s data. You confirm that you have the client’s authorisation to use Agentrix, and to engage us and the sub-processors in Annex 3, on the terms of this DPA. You remain responsible toward your client for passing on any instructions and information it needs.

Google and Meta. When you connect Google Ads or Meta, we send and receive data through those platforms’ APIs on your instruction. Google and Meta process that data under their own terms with you, not as our sub-processors. See Annex 3.

04Processing on your instructions

We process Customer Personal Data only on your documented instructions, unless EU or member state law requires us to do otherwise. If the law requires it, we will tell you before processing, unless the law prohibits that on important grounds of public interest.

Your documented instructions are:

• these Terms and this DPA
• your use and configuration of Agentrix, including the actions you take in the product, the settings you choose, and the permissions, instructions, triggers and approval settings you give agents
• requests from your organisation’s API keys and the MCP connections you authorise
• any further written instructions you send us that are consistent with the Terms

When an agent publishes a page or changes a live campaign because you configured it to, that is processing on your instructions.

We will tell you promptly if, in our opinion, an instruction infringes Data Protection Law. We are not required to carry out an instruction we reasonably believe is unlawful.

We will not sell Customer Personal Data, use it to advertise Agentrix or anything else, or use it to train our own models.

05Your obligations as controller

You are responsible for:

• having a lawful basis for the personal data you put into Agentrix and for the processing you instruct
• giving data subjects the information required by Articles 13 and 14 GDPR, including visitors to sites you publish
• collecting consent where it is required, including before you enable persistent or cross-visit measurement on a published site, and for any tags or forms you add to your pages
• deciding which information agents may see, knowing that it may be sent to the model providers in Annex 3 to produce a result
• not putting special categories of personal data (Article 9) or data about criminal convictions (Article 10) into Agentrix unless you have a lawful basis and have assessed that the measures in Annex 2 are adequate for it
• managing access within your organisation, including memberships, invites, API keys and MCP connections

06Confidentiality of personnel

We make sure that everyone we authorise to process Customer Personal Data is bound by confidentiality, by contract or by law. Access is limited to people who need it to operate, secure or support the service, or to handle a request from you.

07Security

We implement appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. The measures in place are described in Annex 2.

We may update those measures as the service develops, provided the overall level of protection is not reduced.

08Sub-processors

You give us general written authorisation to engage the sub-processors listed in Annex 3, and to engage new sub-processors on the terms of this section.

Before a new sub-processor starts processing Customer Personal Data, we will update Annex 3 and give at least 14 days’ notice by email to organisation owners or in the product. You may object on reasonable data protection grounds within that period by writing to hello@agentrix.one. We will then work with you in good faith on an alternative. If we cannot find one, you may end the affected part of the service, and we will refund prepaid fees for the unused part of the then-current period.

Where a sub-processor must be replaced urgently for security or availability reasons, we may do so at once and give notice as soon as we can. Your right to object applies in the same way.

We impose data protection obligations on each sub-processor by written contract that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. We remain responsible to you for our sub-processors’ performance of those obligations.

09Transfers outside the EEA

Customer Personal Data is primarily stored in the European Union. Some sub-processors in Annex 3 process data in the United States or other third countries. We transfer Customer Personal Data outside the EEA only where Chapter V of the GDPR is satisfied, using:

• an adequacy decision, including the recipient’s certification under the EU–US Data Privacy Framework where they are certified, or
• the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), in the module that fits the relationship, together with any supplementary measures required

You authorise these transfers by accepting this DPA. On request we will tell you which safeguard applies to a given sub-processor.

10Data subject requests

Taking into account the nature of the processing, we will assist you with appropriate technical and organisational measures to respond to requests from data subjects exercising their rights under Chapter III GDPR.

Much of this is available directly in the product: you can find, edit and delete pages, assets, knowledge documents, threads and measurement data. Where you cannot fulfil a request yourself, write to us and we will help.

If a data subject contacts us directly about Customer Personal Data, we will pass the request to you without undue delay and will not answer it ourselves, unless you tell us to or the law requires us to.

11Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We will send the notice to the owners of the affected organisation by email.

The notice will include, as far as the information is available to us: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and limit its effects. Where we cannot give all of this at once, we will provide it in stages without undue further delay.

We will take reasonable steps to contain and investigate the breach and will cooperate with you so that you can meet your own obligations under Articles 33 and 34 GDPR. Notifying you is not an admission of fault or liability.

12Impact assessments and consultation

Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with data protection impact assessments and prior consultation with a supervisory authority under Articles 35 and 36 GDPR, where they relate to your use of Agentrix.

13Information and audits

We will make available to you the information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. We will usually do this by answering your written questions and by providing relevant documentation.

If that information is not enough to demonstrate compliance, or a supervisory authority requires it, you may carry out an audit, or have an independent auditor bound by confidentiality do so, on these terms:

• you give at least 30 days’ written notice and a proposed scope
• audits take place no more than once in any 12-month period, unless a supervisory authority requires otherwise or following a personal data breach
• the audit is conducted during business hours, does not unreasonably disrupt our operations, and does not give access to other customers’ data
• each party bears its own costs, unless the audit reveals a material breach of this DPA by us

Audits of our sub-processors are carried out through the reports, certifications and audit rights those sub-processors make available.

14Return and deletion

You can export and delete your content in the product at any time while your organisation is active.

When an organisation is archived or the agreement ends, the organisation is kept for 90 days so that it can be restored or exported. After that period we permanently delete Customer Personal Data held for that organisation, including sites, pages, assets, knowledge files, domains, integrations and tokens, agent configuration and runs, and measurement data for its sites. You may ask us to delete sooner.

Deleted data may remain in backups for a limited period until those backups expire in the normal cycle. It is not restored from backup except to recover the service after an incident.

We may keep Customer Personal Data after the end of the agreement only where EU or member state law requires it, and only for as long as required.

15Liability

Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions in Section 13 of the Terms of Service. Nothing in this DPA limits either party’s liability toward data subjects under Article 82 GDPR, or any liability that cannot be limited under Danish law.

16Term, precedence and changes

This DPA applies for as long as we process Customer Personal Data on your behalf, and its obligations continue until that data has been deleted or returned.

If this DPA conflicts with the Terms of Service or the Privacy Policy on the processing of Customer Personal Data, this DPA prevails. Where the Standard Contractual Clauses apply to a transfer, they prevail over this DPA for that transfer.

We may update this DPA to reflect changes in the service, in our sub-processors, or in the law. For a change that is material, we will give at least 14 days’ notice by email or in the product. No change will reduce the protection this DPA gives Customer Personal Data unless the law requires it.

17Law and contact

This DPA is governed by Danish law. The courts of Copenhagen have jurisdiction. The English text is the governing text.

Questions, instructions, objections and requests under this DPA go to:

Klik Til Kunder
CVR 37876674
Ole Jørgensens Gade 7, st. th., 2200 København, Denmark
hello@agentrix.one

Supervisory authority: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk

Annexes

A1Description of processing

1.1Subject matter and duration

The provision of Agentrix to you under the Terms of Service, for the term of the agreement and the 90-day archive period that follows it, plus any period of retention required by law.

1.2Nature and purpose

Hosting, storing, structuring, displaying, transmitting, analysing and deleting data so that you can build and publish websites and landing pages, research keywords, create and manage Google Ads and Meta campaigns, run agents against those surfaces, measure visitors to published sites, and give access to people and systems you authorise.

1.3Categories of data subjects

• members of your organisation, and of client organisations you manage
• visitors to sites and pages you publish through Agentrix
• your customers, staff, and other people whose details appear in pages, knowledge documents, assets or agent threads you provide
• people who submit forms on your pages, where you configure the page to send form contents to Agentrix
• contacts represented in advertising data you connect, to the extent it contains personal data (for example lead-form submissions)

1.4Categories of personal data

• Content: any personal data in pages, HTML, scripts, images, knowledge documents, and agent instructions and threads
• Advertising data: OAuth tokens, account identifiers, campaign, ad, keyword, search-term, audience configuration, lead-form and performance data from Google Ads and Meta
• Visitor measurement: page views, events, referrer, UTM parameters, device type, operating system, browser, screen size, and a short-lived visit identifier derived from IP address and user agent with a daily-rotating salt. The raw IP address is not stored
• Persistent measurement, only if you enable it: a device identifier stored on the visitor’s device
• Access and activity: which user, agent, trigger, API key or MCP connection made each change, and when

1.5Special categories

None intended. Section 5 applies if you choose to include them.

1.6Retention

Visitor measurement data is kept for 365 days, or less if you delete it or the organisation is deleted. All other Customer Personal Data is kept while the organisation is active and deleted as described in Section 14. You can delete individual objects earlier in the product.

A2Security measures

These are the technical and organisational measures we apply to Customer Personal Data.

2.1Encryption

• TLS for data in transit between browsers, the application, published sites, and our providers
• HTTPS with automatically provisioned certificates for published sites, including custom domains
• encryption at rest at the infrastructure layer (Google Cloud and Firebase)

2.2Access control

• authentication required for the application, through Firebase Authentication, with passwords stored only as hashes
• organisation scoping on every read and write, so one organisation cannot reach another’s data
• roles within an organisation (owner, admin, member) and invite links that expire
• agency access to a client organisation only through an explicit agency relationship
• staff access limited to people who need it to operate, secure or support the service

2.3Credentials and integrations

• Google and Meta OAuth tokens stored server-side and never returned to the browser
• tokens revoked when you disconnect an integration
• API keys and MCP connections scoped to an organisation and revocable by you
• only the Google Ads and Meta permissions needed for the features you use

2.4Control over automated agents

• per-agent approval settings, so consequential changes can wait for a person
• spend ceilings, bid caps and protected campaigns enforced by the platform, independent of what an agent decides
• one acting run per domain per client, so two writers cannot change the same page or campaign at once
• a change log recording who made each change: a user, an agent, a trigger, an API key or an MCP connection

2.5Data minimisation

• cookie-free visitor measurement by default, with no raw IP addresses stored
• visit identifiers that expire after about 30 minutes of inactivity and are not linkable across days
• no storage of the people inside your Meta custom audiences, only the audience objects and settings
• only the relevant excerpts of your content sent to model providers for a given task

2.6Availability and deletion

• managed infrastructure with provider-level redundancy
• a scheduled purge of archived organisations after 90 days, rather than leaving deleted tenants in the database

2.7Organisational measures

• confidentiality obligations for everyone with access to Customer Personal Data
• written data protection terms with every sub-processor
• a breach response process covering containment, investigation and notification

A3Sub-processors

These providers process Customer Personal Data on our behalf.

3.1Recipients you direct us to

When you connect an advertising account, data is exchanged with the platform on your instruction. These platforms process it under their own terms with you, and are not our sub-processors.

3.2Not in scope

Stripe, and the Google Tag Manager and Google Analytics tags on agentrix.one, process data for which we are the controller (billing and visits to our own website). They are listed in the Privacy Policy, not here.