Data Processing Agreement

ADSTIC INTERACTIVE LTD (АДСТИК ИНТЕРАКТИВ ЕООД) Company ID (EIK) 206749752, VAT No. BG206749752, registered office and address of management: 13 Yuri Venelin St., fl. 4, apt. 7, Odesos district, Varna 9000, Bulgaria Email: contact@adsticorb.com Last updated: 25 September 2026

This agreement forms part of the Terms of Service. It applies when you, as a trader, use Adstic Orb to collect and process personal data of your own customers, for example when they book an appointment, place an order, subscribe to a newsletter or fill in a form on your site.

1. Roles

For your customers' data, you are the controller and ADSTIC INTERACTIVE LTD is the processor. We process that data only on your behalf and on your instructions, given through your settings and your actions in the platform.

2. What data and for what purpose

— Categories of data subjects: your customers, subscribers, visitors to your site and people who write to you. — Categories of data: name, email, phone, delivery address, orders, booked appointments, messages, and anything else you choose to collect in your forms. — Purpose: to run your website, store, appointment booking, emails and CRM. — Duration: for as long as you use the platform or until you delete the data.

Do not use the platform to collect special categories of data (for example health data) unless you have a legal basis and have taken the necessary measures.

3. Our obligations

— We process the data only on your instructions and do not use it for our own purposes. — The people who have access to it are bound by confidentiality. — We apply appropriate technical and organisational security measures: an encrypted connection, restricted access and isolation of each account's data. — We help you respond to requests from the people whose data you process, to the extent possible through the platform's features. — We notify you without undue delay after becoming aware of a security breach affecting your data. — On termination we delete the data, unless the law requires us to keep it. — We provide you with the information needed to demonstrate that you comply with the GDPR.

4. Sub-processors

We use the sub-processors listed in the Privacy Policy. With each of them we have a contract with data protection terms no less strict than those here. You give us general authorisation to use them. If we add or replace a sub-processor, we will update the list and notify you; you can object by ending your use of the platform.

5. Your obligations

You are responsible for having a legal basis for the data you collect, for informing your customers through your own privacy policy, and for asking for consent where it is required, for example for marketing emails.

6. Transfers outside the EU

Where a sub-processor transfers data outside the EU, this is done on the basis of a European Commission adequacy decision or standard contractual clauses.