1. Parties and roles
The customer who accepts the Refract terms (the workspace owner, for the business it represents) is the "Controller". Refract, operated from Barcelona, Spain ("Refract") is the "Processor".
This DPA covers personal data that the Controller, its team or its clients add to Refract or connect to it, and that Refract processes to provide the service ("Customer Personal Data"). Refract's own use of account, billing and usage data to run its business is covered by the privacy policy, where Refract is the controller.
Words such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR").
2. What is processed and why
Annex 1 describes the subject matter, nature and purpose of the processing, the types of personal data and the categories of people concerned. Processing lasts for as long as Refract provides the service to the Controller, plus the deletion period in section 11.
3. Processing only on instructions
Refract processes Customer Personal Data only on the Controller's documented instructions. The terms and conditions, this DPA and the Controller's use and settings of the service (for example creating clients, inviting people, importing results or connecting an Ads Manager account) are the Controller's complete instructions. Further instructions must be in writing and consistent with the service.
If Refract believes an instruction infringes data protection law, it will tell the Controller. If the law requires Refract to process Customer Personal Data in another way, Refract will tell the Controller first, unless the law forbids that.
The Controller is responsible for having a lawful basis for the personal data it adds, for giving the people concerned the information the law requires, and for the accuracy of that data. The Controller won't add special categories of personal data (such as health data) or data about children, which the service doesn't need.
4. Confidentiality
Refract ensures that anyone it authorises to process Customer Personal Data is bound by confidentiality and only accesses it as needed to provide, support or secure the service.
5. Security
Refract maintains the technical and organisational measures in Annex 2, appropriate to the risk. Refract may improve or replace measures over time, as long as the overall level of protection is not reduced.
6. Sub-processors
The Controller gives Refract general authorisation to engage sub-processors. The current list is published at /subprocessors and forms Annex 3.
Refract will tell workspace owners by email, and update that page, at least 14 days before adding or replacing a sub-processor. If one of Refract's providers changes its own sub-processors at shorter notice, Refract will pass that on as soon as it is told. The Controller may object on reasonable data protection grounds within that period; the parties will then discuss it in good faith, and if they can't resolve it, the Controller may stop using the affected part of the service or close its account without penalty.
Refract puts data protection obligations in place with each sub-processor that offer at least the same protection as this DPA, and remains responsible to the Controller for its sub-processors' performance of those obligations.
7. International transfers
Refract is based in the European Union. Its hosting provider stores Customer Personal Data in the United States. Where Customer Personal Data is transferred outside the European Economic Area, the United Kingdom or Switzerland, Refract makes sure a valid transfer mechanism is in place, such as an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses, with the UK Addendum or Swiss amendments where they apply.
8. Helping with data subject requests
The service lets the Controller access, correct, export and delete Customer Personal Data itself: editing or deleting clients, campaigns, results and people, and exporting everything stored for a client from the Trust centre. If Refract receives a request directly from a data subject about Customer Personal Data, it will pass it to the Controller without undue delay and won't respond itself unless the Controller asks or the law requires it. Refract will provide reasonable further help where the Controller can't handle a request with the tools provided.
9. Other assistance
Taking into account the nature of the processing and the information available to it, Refract will reasonably help the Controller meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority.
10. Personal data breaches
Refract will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as Refract then knows, what happened, the categories and approximate numbers of people and records concerned, the likely consequences, and the measures taken or proposed. Refract will add information as it becomes available and take reasonable steps to contain the breach. Notifying a breach is not an admission of fault.
11. Deleting or returning data
The Controller can export a client's data at any time. When the Controller deletes data, or its account is closed, Refract deletes the Customer Personal Data within 30 days, unless the law requires Refract to keep it. Deleted data may remain in encrypted backups until they are overwritten in the normal backup cycle, and is not restored or used in the meantime.
12. Information and audits
Refract will make available the information reasonably needed to show compliance with this DPA, including summaries of its hosting provider's security certifications (SOC 2 Type II and ISO 27001), which may be shared under confidentiality. If that information isn't enough to meet a legal requirement, the Controller may carry out an audit, or have an independent auditor bound by confidentiality do so, no more than once in any 12 months, with at least 30 days' written notice, during normal business hours, at the Controller's cost and without access to other customers' data. Audits of sub-processors take place through the reports and certifications they make available.
13. Liability
Each party's liability under this DPA is subject to the limitations in the terms and conditions, except where the law doesn't allow them to be limited.
14. Term, precedence and law
This DPA lasts as long as Refract processes Customer Personal Data for the Controller. If it conflicts with the terms and conditions, this DPA prevails for the processing of Customer Personal Data. It is governed by Spanish law and the courts of Barcelona have jurisdiction, as in the terms and conditions. Refract may update this DPA to reflect changes in law or in the service; it will tell workspace owners at least 30 days before a material change takes effect, and no change will reduce the overall protection for Customer Personal Data.
Annex 1. Details of the processing
| Subject matter | Providing the Refract service: planning and building ChatGPT Ads campaigns, exporting them, and analysing the results the Controller imports or syncs. |
|---|---|
| Nature of processing | Storing, organising, displaying, analysing, exporting and deleting data; sending sign-in and invitation emails; sending campaign content to an AI service for the builder steps described below. |
| Purpose | To provide, support and secure the service for the Controller, as described in the terms and conditions. |
| People concerned | The Controller's team members using Refract; people from the Controller's clients whom it invites as client viewers or client admins; and any individuals named in content the Controller adds (for example a contact name in a client description). |
| Types of personal data | Names, business email addresses and roles of invited people; sign-in and access records; personal data that may appear in client profiles, briefs, claims, existing-ad exports, ad copy and images the Controller adds; Ads Manager account names. Imported results are totals by campaign, ad group, ad and country and contain no data about the people who saw the ads. |
| Special categories | None. The service doesn't need them and the Controller agrees not to add them. |
| AI processing | For builder steps (page summary, claims list, personas, conversation map, context hints, ad copy, landing page matching, quality check and market estimates), the campaign brief, the text of public pages the Controller asks Refract to read, the claims list, existing-ad text and the builder content for that step are sent to the AI service listed in Annex 3. Imported results, Ads Manager API keys and invited people's email addresses are never sent to an AI service. |
| Duration | For the term of the service, then deletion as set out in section 11. |
Annex 2. Security measures
- Access control in the database: every record carries the workspace and client it belongs to, and the database checks on every read that the signed-in person belongs to that workspace or client. Client viewers and client admins see only their own client.
- Server-side checks on every change: all edits to campaigns, clients and people go through backend functions that check the person's role, keep only allowed fields, strip markup and apply plan limits.
- Encryption: all connections use TLS. Ads Manager API keys are encrypted at rest with AES-GCM using a key held as a server secret, and are never sent back to a browser.
- Sign-in: email verification with one-time codes, managed by the hosting provider. Each seat belongs to one named person.
- Rate limits on sensitive actions such as invitations, imports, exports, validation and AI steps, to prevent abuse.
- Least privilege: only backend functions can change access lists, billing status and validation results.
- Outbound requests to customer-supplied web addresses are restricted to public addresses, to prevent server-side request forgery.
- Hosting provider certified to SOC 2 Type II and ISO 27001, with regular backups kept for a limited period.
- Logging of errors and key actions to detect and investigate problems.
- Data minimisation: no advertising trackers or third-party analytics; ChatGPT conversations are never collected; imported results contain totals only.
- Incident response: suspected breaches are investigated, contained and notified as set out in section 10.
Annex 3. Sub-processors
The current sub-processors, with what each does and where, are listed at /subprocessors.