This document is not signed or currently effective. ISEQO LTD must confirm the vendor entities, processing locations, transfer safeguards and final contractual terms before offering it as an executed DPA.
Campaign Medic · operated by ISEQO LTD
Data Processing Addendum
Draft updated 27 October 2026
1. Status and scope
This draft Data Processing Addendum (DPA) is between the customer identified in its Campaign Medic account (Controller) and ISEQO LTD, the operator of Campaign Medic (Processor). It applies only where the Processor handles personal data on the Controller's behalf through the service. It does not apply to processing for which the Processor acts as an independent controller, such as its own account administration, security, billing, and legal compliance.
This document is a draft for review. It is not a signed agreement and does not become effective until the parties execute it or expressly incorporate it into a signed order form or other binding agreement.
2. Processing details
Subject matter and duration: providing the Campaign Medic service for the term of the customer's subscription or account, and handling retained service records for the periods described in the Campaign Medic Privacy Policy.
Nature and purpose: receiving and storing connected advertising account data; displaying account and campaign information; generating audit recommendations with the AI provider selected for the workspace; recording customer-approved changes and measuring their results; authenticating workspace users; and providing support requested by the customer.
Data subjects may include the customer's workspace members and authorized advertising account users, and individuals whose information is present in data returned by a connected advertising platform. Personal data may include names, email addresses, account identifiers, authorization metadata, chat content, and advertising or campaign data that identifies or can be linked to a person. The customer must not connect special-category or other sensitive personal data unless the service and a separate written agreement expressly permit it.
3. Customer instructions and confidentiality
The Processor will process personal data only on the Controller's documented instructions, including instructions made through the customer's configuration and use of the service, unless applicable law requires otherwise. If legally permitted, the Processor will notify the Controller of that legal requirement before processing.
The Processor will ensure that people authorized to process the personal data are bound by confidentiality obligations and access it only as needed to provide, secure, and support the service.
4. Security
The Processor will maintain appropriate technical and organisational measures for the risk of the processing. Current measures include encrypted storage for connected-provider and AI API credentials, hashed passwords, workspace-scoped access checks, role-based permissions, session revocation, optional authenticator-based two-step verification, and change audit records. The Processor will not represent that the service has a certification or independent security audit unless separately documented.
5. Sub-processors
The Controller gives general written authorisation to use the sub-processors listed in the Campaign Medic Sub-processors Register, available at https://campaignmedic.com/subprocessors. The Processor will impose written data-protection obligations on each sub-processor that protect the personal data to a standard required by applicable data-protection law, and remains responsible for its sub-processors' performance of those obligations.
The Processor will publish material additions or replacements to the register and provide a reasonable opportunity to object on documented data-protection grounds. If the parties cannot resolve an objection, either party may use the termination rights in the applicable service agreement for the affected service.
6. Assistance and data subject requests
Taking account of the nature of the processing and information available to it, the Processor will reasonably assist the Controller with requests to exercise data-subject rights and with the Controller's security, breach-notification, data-protection impact assessment, and regulator-consultation duties. The Processor will promptly direct to the Controller any rights request it receives about the Controller's data and will not respond on the Controller's behalf unless instructed or legally required.
7. Personal data incidents
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's personal data, provide information reasonably available to help the Controller meet its legal duties, and cooperate with reasonable follow-up requests. Notice of an incident is not an admission of fault or liability.
8. International transfers
The Processor will not make a restricted transfer of personal data unless the transfer is permitted under applicable data-protection law and the required safeguards are in place. The location and transfer mechanism for a sub-processor may depend on the service, customer configuration, and provider contract; the current register identifies the service providers and links to their privacy or data-protection information where available.
9. Return, deletion, and retention
During the service term, the Controller can export available records and request account deletion using the service controls or by contacting privacy@campaignmedic.com. At the end of the service, the Processor will delete or return personal data as requested where technically available, subject to legal retention duties and the service's published retention periods. Residual encrypted copies in routine backups are removed through the normal backup-rotation cycle and are not restored except for recovery or security purposes.
10. Compliance information and audits
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will reasonably cooperate with a proportionate audit or inspection by the Controller or its appointed auditor. Audits require reasonable advance notice, must protect other customers' confidential information, and should use existing compliance materials where those materials adequately answer the request. These limits do not remove rights that applicable law gives the Controller.
11. Controller responsibilities
The Controller is responsible for its legal basis, notices, permissions, and instructions; ensuring that connected advertising accounts may lawfully be accessed; configuring the service and selected AI provider appropriately; and avoiding personal data that is unnecessary for the requested service. The Controller remains responsible for reviewing recommendations and explicitly approving any advertising-account change.
12. Order of precedence and contact
If this DPA is executed and conflicts with the Campaign Medic service terms, this DPA controls only for the parties' data-protection obligations. Other service terms, including fees, liability limits, and termination, remain as agreed in the service contract unless the signed agreement expressly says otherwise.
ISEQO LTD is registered in England and Wales under company number 17341372, with registered office at 124-128 City Road, London, England, EC1V 2NX. Privacy and DPA contact: privacy@campaignmedic.com.