Data Processing Agreement

1. Definitions

• "Controller" means the natural or legal person that determines the purposes and means of processing personal data. In the context of this DPA, you (the Ampifex customer) are the Controller.
• "Processor" means the entity that processes personal data on behalf of the Controller. In the context of this DPA, Ampifex (Smartunex OÜ) is the Processor.
• "Personal Data" has the meaning given under GDPR Article 4(1): any information relating to an identified or identifiable natural person.
• "Processing" has the meaning given under GDPR Article 4(2).
• "Sub-processor" means any third party engaged by Ampifex to process Personal Data on behalf of the Controller.
• "Data Protection Law" means GDPR, UK GDPR, and any other applicable data protection legislation.
• "SCCs" means Standard Contractual Clauses as approved by the European Commission for international data transfers.

2. Scope and Nature of Processing

Where you use Ampifex to generate, store, and publish content, and where that content or any associated data (such as Brand Kit data) includes Personal Data relating to your end customers or third parties, Ampifex acts as a Processor processing Personal Data on your behalf.

Subject matter: AI-assisted content generation, content storage, content delivery via Cloudflare, and related service operations.

Duration: The term of your subscription, plus any applicable retention period set out in the Privacy Policy.

Nature: Automated processing of text-based content data to generate draft articles, store approved content, and publish content to your website.

Purpose: Providing the Ampifex content generation and publication service as described in the Terms of Service.

Categories of data subjects: Potentially your website visitors, customers, employees, or other individuals whose Personal Data may be included in content you provide to or create via the Service.

Categories of Personal Data: Names, contact details, and other Personal Data you include in your Brand Kit, content drafts, or published articles.

Note: Ampifex's core service is generating blog content about your business — services you offer, how-to guides, and local information. Such content typically does not involve Personal Data. This DPA applies to the extent that Personal Data is incidentally included in content you create or approve. If you believe your use case involves significant Personal Data processing, contact us to discuss.

3. Ampifex Obligations as Processor

Ampifex agrees to:

• Process Personal Data only on your documented instructions (including as set out in the Terms of Service and this DPA), unless required to do so by applicable law.
• Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organisational security measures in accordance with GDPR Article 32.
• Obtain your prior written consent before engaging new Sub-processors, subject to the process in Section 5 of this DPA.
• Assist you in responding to requests from data subjects exercising their rights under Data Protection Law, to the extent this is reasonably possible and relates to Personal Data in the Service.
• Assist you in meeting your obligations under GDPR Articles 32–36 (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of processing and the information available to Ampifex.
• At your choice, delete or return all Personal Data to you at the end of the contract, and delete existing copies unless applicable law requires retention.
• Make available all information necessary to demonstrate compliance with GDPR Article 28 and allow and contribute to audits and inspections, subject to reasonable notice and confidentiality.
• Notify you without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach affecting Personal Data processed under this DPA.

4. Your Obligations as Controller

You agree to:

• Comply with all applicable Data Protection Law as Controller, including ensuring you have a lawful basis for processing any Personal Data you submit to the Service.
• Provide complete and accurate instructions to Ampifex regarding the processing of Personal Data.
• Ensure that any Personal Data submitted to the Service is accurate, lawfully obtained, and may be processed in accordance with this DPA and Data Protection Law.
• Inform Ampifex promptly if any data subject exercises rights that may require action by Ampifex as Processor.

5. Sub-processors

You grant Ampifex general authorisation to engage Sub-processors, subject to the following conditions:

• Ampifex will maintain an up-to-date list of Sub-processors, which is set out in Section 5.1 below.
• Ampifex will notify you of any intended changes (additions or replacements) to Sub-processors with at least 14 days' advance notice by email or via a notice within the Service, giving you the opportunity to object before the change takes effect.
• Ampifex will impose data protection obligations on Sub-processors that are no less protective than those in this DPA.
• Ampifex remains liable to you for the acts and omissions of its Sub-processors to the same extent as if Ampifex had performed the processing directly.

5.1 Current Sub-processors

6. International Data Transfers

Where Ampifex transfers Personal Data outside the EEA to Sub-processors, it does so using appropriate safeguards as described in the Privacy Policy. The SCCs (2021 EU Standard Contractual Clauses) for controller-to-processor and processor-to-processor transfers are incorporated into this DPA by reference where applicable.

7. Security Measures

Ampifex implements and maintains the following technical and organisational security measures appropriate to the risk:

• Encryption of Personal Data in transit (TLS/HTTPS) and at rest.
• Access controls and authentication measures to restrict access to Personal Data to authorised personnel only.
• Regular security reviews and vulnerability assessments.
• Procedures for testing, assessing, and evaluating the effectiveness of security measures on an ongoing basis.
• Incident response and breach notification procedures meeting GDPR requirements.

8. Data Subject Rights

Ampifex will assist you in meeting your obligations to respond to data subject rights requests within the required timeframes. Where a data subject contacts Ampifex directly in relation to Personal Data that you, as Controller, are responsible for, Ampifex will redirect that request to you within a reasonable time.

9. Data Breach Notification

In the event of a confirmed Personal Data breach affecting data processed under this DPA, Ampifex will notify you without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include, to the extent available:

• A description of the nature of the breach.
• The categories and approximate number of data subjects affected.
• The categories and approximate number of Personal Data records concerned.
• The likely consequences of the breach.
• Measures taken or proposed to address the breach and to mitigate its possible adverse effects.

10. Termination and Data Deletion

Upon termination or expiry of your subscription, Ampifex will, at your choice and within 30 days:

• Delete or return all Personal Data processed under this DPA and delete all existing copies, unless applicable law requires Ampifex to retain it.

You should export your content from the Service before cancellation. See the cancellation section of the Terms of Service for details.

11. Governing Law

This DPA is governed by the laws of the Republic of Estonia and is subject to the exclusive jurisdiction of the courts of Tallinn, Estonia, except where mandatory data protection law in your jurisdiction requires otherwise.

12. Contact and Signed DPA Requests

For questions about this DPA, data protection enquiries, or to request a signed copy of this agreement for enterprise compliance purposes, please contact: