Client Data Processing Terms

Overview

These terms apply where ARKTOP LLC (“ARKTOP”) processes personal information on behalf of a client in the course of delivering services. They form part of, and are incorporated by reference into, the ARKTOP Service Terms and each Order or Statement of Work.

Where a client requires a separately executed data processing agreement, these terms serve as the baseline and may be superseded by a signed agreement between the parties.

1. Roles

When delivering services, ARKTOP processes personal information belonging to the client’s customers, subscribers, and website visitors. In doing so:

• The client is the business and determines the purposes and means of processing.
• ARKTOP is a service provider under the California Consumer Privacy Act, as amended, and holds the equivalent status under other applicable state privacy laws (including those of Colorado, Connecticut, Virginia, Texas, Oregon, Utah, and Montana).

ARKTOP is prohibited from, and will not:

• Sell or share client personal information
• Retain, use, or disclose client personal information for any purpose other than performing the services specified in the applicable Order, or as otherwise permitted by applicable law
• Retain, use, or disclose client personal information outside the direct business relationship between ARKTOP and the client
• Combine client personal information with personal information received from or on behalf of any other party, except as permitted by applicable law

ARKTOP certifies that it understands and will comply with these restrictions. ARKTOP will notify the client promptly if it determines it can no longer meet its obligations under applicable privacy law.

2. Scope of processing

3. Specific processing activities

Customer list uploads to advertising platforms

ARKTOP uploads client customer lists to Meta (Custom Audiences) and Google (Customer Match) to build targeted and lookalike audiences.

Client obligations. The client represents and warrants that it has:

• Provided all notices and obtained all consents required by law and by the platform’s terms for the data to be used in this way
• Honored all opt-outs, deletion requests, and suppression requests before the list is provided to ARKTOP
• The right to disclose the data to ARKTOP and to the platform for this purpose

The client acknowledges that Meta’s Custom Audiences Terms and Google’s Customer Match policies impose obligations directly on the client as the data owner, and that ARKTOP performs the upload on the client’s instruction. ARKTOP will transmit lists using the hashing and transfer mechanisms the platforms require, and will not retain a copy beyond what Section 6 permits.

ARKTOP will not upload a list where it has actual knowledge that required consents were not obtained, and will raise the issue with the client in writing.

Analytics and tag management access

ARKTOP is granted access to client Google Analytics 4 properties and Google Tag Manager containers to configure measurement, build reports, and diagnose tracking. ARKTOP accesses these systems solely to deliver the services and will not export, retain, or use the data for any other purpose. Access is provisioned to named ARKTOP personnel and revoked on termination under Section 8.

Email marketing platforms

ARKTOP is granted access to client email platforms, including Klaviyo and Mailchimp, to build campaigns, manage segments, and report on performance. Suppression lists and unsubscribe requests are honored as configured by the client. ARKTOP does not export subscriber lists except where necessary to deliver a service the client has requested in writing.

Ecommerce data exports

ARKTOP accesses and exports client Shopify order and customer data for revenue reporting, conversion analysis, and blended performance measurement. Exports are handled under Sections 5 and 6.

4. ARKTOP’s obligations

ARKTOP will:

• Process personal information only on the client’s documented instructions, unless required otherwise by law, in which case ARKTOP will inform the client before processing unless legally prohibited
• Ensure personnel authorized to process personal information are bound by confidentiality obligations
• Implement the measures described in Section 5
• Assist the client, taking into account the nature of processing, in responding to consumer rights requests, including access, deletion, correction, and opt-out requests
• Assist the client with security obligations, breach notification, and any assessments required by applicable law
• Make available information reasonably necessary to demonstrate compliance, and contribute to audits as described in Section 9
• Notify the client without undue delay, and in any event within 48 hours of becoming aware of a breach of security affecting client personal information

5. Security measures

ARKTOP maintains the following measures to protect client personal information:

• SSL/TLS encryption (HTTPS) for data in transit
• Role-based access to client accounts, limited to personnel assigned to that account
• Multi-factor authentication on Google Workspace
• Confidentiality obligations for all staff and contractors

6. Retention and deletion

ARKTOP retains client personal information only as long as necessary to deliver the services. ARKTOP retains client personal information for as long as necessary to deliver the services, determined by the following criteria:

On termination, ARKTOP will delete or return client personal information at the client’s election, except where retention is necessary for the purposes above or required by law. The client may request deletion at any time and ARKTOP will comply unless retention is legally required.

7. Subprocessors

The client authorizes ARKTOP to engage the subprocessors listed below. ARKTOP will impose data protection obligations on each subprocessor no less protective than these terms, and remains liable for their performance.

The client may object on reasonable data protection grounds, in which case the parties will discuss in good faith; if no resolution is reached, the client may terminate the affected Order without penalty.

8. Return and deletion on termination

On expiry or termination of an Order, and at the client’s written direction, ARKTOP will:

• Transfer administrative ownership of advertising accounts, analytics properties, and tag containers created by ARKTOP for the client, subject to full payment of outstanding fees
• Deliver copies of creative files, custom code, and other Deliverables as specified in the Service Terms
• Delete or return client personal information under Section 6
• Revoke all ARKTOP personnel access to client systems

9. Audits

The client may, no more than once in any 12-month period and on at least 30 days’ written notice, request information reasonably necessary to verify ARKTOP’s compliance with these terms. ARKTOP will respond to a reasonable security questionnaire and provide available documentation.

On-site audits will be conducted only where required by law or a regulator, during business hours, in a manner that does not disrupt ARKTOP’s operations, and subject to confidentiality obligations.

10. Order of precedence

In the event of conflict, a data processing agreement separately executed between ARKTOP and the client takes precedence over these terms. These terms take precedence over the ARKTOP Service Terms and any Order with respect to the processing of personal information.

Contact