Terms of Service

1Definitions

Affiliate — an entity that controls, is controlled by, or is under common control with a party.

Aggregated Insights — statistics, benchmarks, indices, models, analyses and reports derived from Customer Data that have been aggregated across multiple customers and irreversibly de-identified, such that they do not identify and cannot reasonably be used to identify the Customer, any of the Customer's apps, any of the Customer's campaigns, or any individual.

Authorised User — an employee, contractor, agent or adviser of the Customer whom the Customer permits to access the Service under the Customer's account.

Automated Action — a change to a Connected Account executed by the Service without contemporaneous human confirmation, pursuant to a Rule configured by the Customer.

Connected Account — an account with a third-party platform (including Apple Ads, mobile measurement partners and subscription analytics providers) that the Customer connects to the Service.

Customer Data — all data that the Customer uploads to the Service, and all data the Service retrieves from Connected Accounts on the Customer's authorisation, including campaign structures, performance metrics, attribution records, event records and revenue data.

Merchant of Record or MoR — Paddle.com Market Ltd and its relevant affiliate, which sells OneAds subscriptions to you as principal.

Order — a subscription purchase completed through Paddle checkout, or a written order form signed by both parties.

Plan — the tier of the Service purchased, as described on the pricing page at https://oneads.pro/pricing or in an Order.

Rule — an automation configured within the Service that evaluates conditions against data and, when satisfied, executes an Automated Action.

Service — the OneAds software-as-a-service platform accessible at https://oneads.pro, together with its modules, APIs, documentation and support.

Subscription Term — the Initial Term together with all subsequent Renewal Periods.

In these Terms: headings do not affect interpretation; the singular includes the plural and vice versa; "including" means "including without limitation"; and references to legislation include amendments and re-enactments.

2The Service

3Accounts and Authorised Users

4Connected Accounts and third-party platforms

5Acceptable use

You must not, and must not permit any person to:

1. copy, modify, adapt, translate, create derivative works from, frame, mirror, republish or distribute any part of the Service;
2. decompile, disassemble, reverse engineer or otherwise attempt to derive the source code, algorithms, models or underlying structure of the Service, except to the extent this restriction is prohibited by applicable law;
3. access the Service in order to build, or to assist a third party in building, a competing product or service, or to conduct competitive benchmarking for publication;
4. resell, rent, lease, sublicense, or use the Service to provide services to third parties, except that an agency Customer may use the Service to manage advertising for its own clients under its own account, provided the agency remains responsible for compliance with these Terms;
5. circumvent or attempt to circumvent any technical limitation, quota, rate limit, security control or access restriction;
6. access the Service other than through the interfaces we provide, or use automated means to scrape or extract data from the Service beyond the export functionality we offer;
7. upload or transmit any malicious code, or any material that is unlawful, infringing, defamatory, obscene, harassing, or that violates the rights of any third party;
8. use the Service to violate any applicable law, or the terms of any third-party platform;
9. share account credentials, or permit access by anyone who is not an Authorised User;
10. misrepresent your identity, your authority over a Connected Account, or your affiliation with any person.

If you become aware of any actual or threatened breach of this Section, you must take immediate steps to stop it and notify us.

We may suspend access, in whole or in part and without liability, if we reasonably believe that you have breached this Section, that continued access presents a security or legal risk, or that we are required to suspend access by a court order, regulator or law enforcement request. We will restore access promptly once the cause is resolved. Where the circumstances allow, we will notify you before suspending and give you an opportunity to remedy.

6Automated Actions and advertising spend

This Section allocates a real and material risk. Read it.

7Fees, billing and Paddle as Merchant of Record

8Customer Data: ownership, our licence, and Aggregated Insights

9Confidentiality

Confidential Information means information disclosed by one party to the other that is designated as confidential or that a reasonable business person would regard as confidential, including: the terms of any Order; each party's business, financial, technical and product information; our security practices and architecture; and, on your side, all Customer Data and all campaign, keyword, bid, budget, spend and performance information associated with your identifiable accounts.

Each party will keep the other's Confidential Information confidential, use it only for the purpose of exercising rights and performing obligations under these Terms, and disclose it only to those of its personnel and advisers who need to know it and who are bound by confidentiality obligations at least as protective as these.

These obligations do not apply to information that is or becomes public other than through a breach; was already known to the receiving party without a duty of confidentiality; is received from a third party without breach of a duty of confidentiality; or is independently developed without use of the other party's Confidential Information.

A party may disclose Confidential Information where required by law, court order or a competent authority, provided it gives the other party prompt notice where lawful and limits the disclosure to what is required.

Confidentiality obligations survive termination for 5 years, and indefinitely in respect of trade secrets.

10Data protection

Each party will comply with applicable data protection law. In respect of personal data contained in Customer Data, the Customer acts as controller and OneAds acts as processor. The Data Processing Addendum at Annex A to these Terms governs that processing, including sub-processing, international transfers, security, assistance with data subject requests, breach notification, and deletion and return of data.

Our processing of personal data in our own right — your account, billing, support and marketing data — is described in our Privacy Policy at https://oneads.pro/legal/privacy.

11Intellectual property

The Service, the software, the models, the algorithms, the databases we build, the documentation, the interfaces, the OneAds name and logo, and all improvements to any of them, are and remain our exclusive property or that of our licensors, and are protected by copyright, trade secret and other laws. Nothing in these Terms transfers any intellectual property right to you other than the limited licence in Section 2.2.

We reserve all rights not expressly granted.

You may not remove, obscure or alter any proprietary notice in the Service.

Publicity. We will not use your name, logo or trademarks publicly without your prior written consent. You may give that consent by email, and you may withdraw it at any time, in which case we will remove the reference within a reasonable period.

12Warranties

Each party warrants that it has the power and authority to enter into these Terms and to perform its obligations.

We warrant that we will provide the Service with reasonable skill and care, and substantially in accordance with the description of your Plan. If we breach this warranty, we will use reasonable efforts to correct the non-conformity, or, if we cannot do so within a reasonable period, you may terminate the affected subscription and, where you have prepaid for an unused period, receive a pro-rata refund under Section 7.9.1(a). This is your exclusive remedy for breach of this warranty.

This warranty does not apply to non-conformity caused by: use of the Service contrary to these Terms or our documentation; modification of the Service by anyone other than us; a Connected Account, a third-party platform or a third-party API; Rules you configured; or data you provided.

13Disclaimer

Except as expressly stated in Section 12, the Service is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all other warranties, conditions and representations, whether express, implied, statutory or otherwise, including any implied warranty of merchantability, satisfactory quality, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted or error-free operation.

Without limiting Section 6.3: we do not warrant that data displayed in the Service is complete, current or free from restatement by upstream sources; we do not warrant that predictions, estimates, scores or benchmarks are accurate; and we do not warrant that use of the Service will achieve any commercial result.

Nothing in these Terms excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited.

14Indemnities

15Limitation of liability

15.1 Subject to Section 15.3, neither party is liable to the other for any loss of profit, loss of revenue, loss of business, loss of anticipated savings, loss of goodwill, loss or corruption of data, or any indirect, incidental, special, consequential, exemplary or punitive damages, however arising, whether in contract, tort (including negligence), breach of statutory duty or otherwise, and regardless of whether the party was advised of the possibility.

15.2 Subject to Section 15.3, each party's total aggregate liability arising out of or in connection with these Terms, whether in contract, tort or otherwise, is limited to the total amounts paid or payable for the Service in the 12 months immediately preceding the event giving rise to the claim. Where the claim arises in the first 12 months, the cap is the amount paid or payable for that period annualised.

15.3 Section 15.1 and Section 15.2 do not limit: liability for death or personal injury caused by negligence; liability for fraud or fraudulent misrepresentation; the Customer's payment obligations; the Customer's indemnity under Section 14.1; either party's breach of Section 9; or any liability that cannot lawfully be limited or excluded.

15.4 For the avoidance of doubt and consistently with Section 6.4, advertising spend incurred in your Connected Accounts is not recoverable from us except where it results from our gross negligence or wilful misconduct, and in that case remains subject to the cap in Section 15.2.

15.5 Some jurisdictions do not allow certain limitations. Where that is the case, the limitations in this Section apply only to the extent permitted, and you may have additional rights.

16Term, suspension and termination

17Sanctions, export control and lawful use

You represent that you are not, and are not owned or controlled by, a person subject to sanctions administered by the United Nations, the European Union, the United Kingdom, the United States Office of Foreign Assets Control, or the Republic of Armenia; that you are not located in a country or territory subject to comprehensive sanctions; and that you will not use the Service in breach of any applicable sanctions, export control or anti-money-laundering law.

We may suspend or terminate access immediately, without liability, if we reasonably believe a breach of this Section has occurred or that continued provision would place us or our payment providers in breach of applicable law. Paddle applies its own sanctions screening to buyers as merchant of record.

18Governing law and disputes

These Terms and any dispute arising out of or in connection with them, including non-contractual disputes, are governed by the law of the Republic of Armenia, without regard to its conflict of law rules.

The parties submit to the exclusive jurisdiction of the competent courts of Yerevan, Republic of Armenia.

If you are a consumer resident in the European Union, the European Economic Area, the United Kingdom or Switzerland, this Section does not deprive you of the protection of mandatory provisions of the law of your country of residence, and does not deprive you of the right to bring proceedings in the courts of that country.

Before commencing proceedings, each party will use reasonable efforts to resolve the dispute through good-faith discussion between senior representatives for a period of 30 days.

19Force majeure

Neither party is liable for failure or delay in performing any obligation, other than a payment obligation, caused by circumstances beyond its reasonable control, including act of war, hostility, invasion, terrorism, sabotage, civil unrest, embargo, act of God, flood, fire, earthquake, explosion, epidemic or pandemic, government restriction, and failure of electrical, internet or telecommunications infrastructure not caused by that party. The affected party will notify the other and use reasonable efforts to mitigate. If the event continues for more than 30 days, either party may terminate the affected subscription on written notice.

20General

20.1 Notices. Notices to us must be sent to support@oneads.pro and, for formal notices, also by post to the registered address in the preamble. Notices to you will be sent to the email address associated with your account, or posted within the Service. A notice is deemed given 24 hours after sending, unless the sender receives a delivery failure.

20.2 Entire agreement. These Terms including Annex A, together with the Privacy Policy, the pricing page and any Order, constitute the entire agreement between the parties on their subject matter and supersede all prior understandings, representations and warranties, whether written or oral. Neither party has relied on any statement not set out in these Terms, save that nothing excludes liability for fraudulent misrepresentation. In the event of inconsistency, the order of precedence is: (a) a signed Order; (b) Annex A (Data Processing Addendum); (c) the body of these Terms; (d) the Privacy Policy; (e) any other document incorporated by reference.

20.3 Changes to these Terms. We may modify these Terms by posting the revised version and giving at least 30 days' notice by email or in-product notice where the change is material and adverse to you. Changes do not apply retroactively. If you do not accept a material change, your remedy is to cancel before it takes effect. Continued use after the effective date constitutes acceptance.

20.4 Assignment. You may not assign or transfer any right or obligation under these Terms without our prior written consent, which we will not unreasonably withhold. A change of control of the Customer is treated as an assignment. We may assign these Terms to an Affiliate or in connection with a merger, acquisition or sale of substantially all assets, on notice to you. Any purported assignment in breach of this clause is void.

20.5 Relationship. The parties are independent contractors. Nothing creates a partnership, joint venture, agency, employment or fiduciary relationship, except that we act as your agent for the limited purpose of executing changes in your Connected Accounts as authorised under Section 4.1.

20.6 No third-party beneficiaries. These Terms are for the benefit of the parties and their permitted successors and assigns. No other person has any right to enforce them, except that Paddle may enforce Section 7 to the extent it concerns Paddle.

20.7 Waiver. No failure or delay in exercising a right operates as a waiver of it. A waiver is effective only if in writing.

20.8 Severability. If any provision is held invalid, illegal or unenforceable, it is modified to the minimum extent necessary to make it enforceable, or if that is not possible, severed. The remainder continues in full force.

20.9 Language. These Terms are drawn up in English. Any translation is provided for convenience only. In the event of conflict, the English version prevails.

20.10 Business use. The Service is provided for use by businesses and professionals in the course of their trade, business or profession. It is not offered to consumers for personal or household use. Where mandatory consumer law nonetheless applies to a purchase, it prevails over any inconsistent provision of these Terms.

21Company details

1Definitions

Terms defined in the body of these Terms have the same meaning here. In addition:

Data Protection Law — all laws applicable to the processing of Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and the Law of the Republic of Armenia "On Protection of Personal Data" (HO-49-N).

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, and Supervisory Authority have the meanings given in the GDPR. Where the CCPA applies, OneAds is a Service Provider and the Controller is a Business.

Customer Personal Data — Personal Data contained within Customer Data and processed by OneAds on the Controller's behalf.

SCCs — the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

UK Addendum — the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

Sub-processor — a third party engaged by OneAds to process Customer Personal Data.

Aggregated Insights — as defined in Section 8 of these Terms and governed by Section 11 of this Annex A.

2Roles and scope

2.1 For Customer Personal Data, the Controller is the Controller and OneAds is the Processor. Where the Controller is itself a processor for a third party, OneAds is a sub-processor and references to the Controller's instructions include the instructions of that third party as relayed by the Controller.

2.2 OneAds processes Personal Data as an independent controller in respect of: account registration and administration; billing and tax records; support communications; security, fraud prevention and abuse detection; product analytics on the use of the Service; and marketing. That processing is governed by the OneAds Privacy Policy, not by this DPA.

2.3 Annex A-1 sets out the subject matter, duration, nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects.

3Processing instructions

3.1 OneAds processes Customer Personal Data only on the Controller's documented instructions, including with regard to international transfers, unless required to do otherwise by law to which OneAds is subject. Where such a legal requirement applies, OneAds informs the Controller before processing, unless the law prohibits that on important grounds of public interest.

3.2 The Controller's documented instructions consist of: the Terms of Service; this DPA; the configuration the Controller sets within the Service, including which accounts it connects, which modules it enables and which Rules it creates; and any further written instruction the parties agree.

3.3 OneAds notifies the Controller if, in its opinion, an instruction infringes Data Protection Law. OneAds may suspend performance of that instruction until it is amended or confirmed.

3.4 OneAds does not process Customer Personal Data for its own purposes, does not sell it, does not share it for cross-context behavioural advertising, and does not retain, use or disclose it outside the direct business relationship with the Controller — except for the creation of Aggregated Insights under Section 11, which the Controller expressly instructs and authorises. OneAds certifies that it understands and will comply with these restrictions as required by the CCPA.

3.5 The Controller is responsible for ensuring it has a lawful basis for the processing, that its own privacy notices are accurate and disclose the use of service providers and the creation of de-identified statistics, and that it has authority to connect the data sources it connects.

4Confidentiality

OneAds ensures that every person authorised to process Customer Personal Data is bound by an appropriate obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement, and receives training appropriate to their role.

5Security

5.1 OneAds implements the technical and organisational measures described in Annex A-2, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to Data Subjects.

5.2 OneAds may update those measures, provided it does not materially reduce the overall level of security.

6Sub-processors

6.1 General authorisation. The Controller gives a general authorisation for OneAds to engage Sub-processors. The Sub-processors engaged as at the effective date are listed in Annex A-3.

6.2 Notice of changes. OneAds will give at least 30 days' notice before a new Sub-processor begins processing Customer Personal Data.

Notice is given by updating Annex A-3 and republishing these Terms at https://oneads.pro/legal/terms with a revised "Last updated" date. The Controller is responsible for reviewing the published version. No separate notification is sent. An up-to-date list is also provided on request at any time.

6.3 Objection. The Controller may object to a new Sub-processor on reasonable grounds relating to data protection, by written notice within the notice period. The parties will discuss in good faith. If OneAds cannot offer a reasonable alternative within 30 days, the Controller may terminate the affected part of the Service on written notice, with a pro-rata refund of prepaid unused fees. This is the Controller's sole remedy.

6.4 Flow-down and liability. OneAds imposes on each Sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA. OneAds remains fully liable to the Controller for the performance of each Sub-processor's obligations.

7Data subject rights

7.1 Taking into account the nature of the processing, OneAds assists the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection.

7.2 The Service provides the Controller with functionality to access, export, correct and delete Customer Data directly. Where the Controller can act through that functionality, that is the intended route.

7.3 If OneAds receives a request directly from a Data Subject relating to Customer Personal Data, OneAds will not respond substantively, will promptly forward the request to the Controller where it can identify the relevant Controller, and will advise the Data Subject to contact the Controller.

7.4 Assistance beyond the Service's standard functionality, and beyond what is reasonable in scope, may be charged at OneAds' then-current professional services rates, on prior notice.

8Personal Data Breach

8.1 OneAds notifies the Controller without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data.

8.2 The notification includes, to the extent known and as it becomes known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address it and to mitigate its effects, and a contact point for further information. Where the information cannot be provided at once, it is provided in phases without further undue delay.

8.3 OneAds provides reasonable assistance to the Controller in meeting the Controller's own notification obligations to Supervisory Authorities and Data Subjects.

8.4 OneAds will not notify a Supervisory Authority or any Data Subject on the Controller's behalf, or make any public statement identifying the Controller in connection with a breach, without the Controller's prior consent, unless legally required.

9Data protection impact assessments

OneAds provides reasonable assistance to the Controller with data protection impact assessments and prior consultations with Supervisory Authorities, in each case relating to the processing under this DPA and taking into account the nature of the processing and the information available to OneAds.

10Audits

10.1 OneAds makes available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and with Article 28 GDPR.

10.2 OneAds satisfies audit obligations in the first instance by providing, on request and under confidentiality: a description of its technical and organisational measures, its sub-processor list, responses to a reasonable security questionnaire, and any third-party audit reports or certifications it holds.

10.3 Where that is insufficient to demonstrate compliance, the Controller may conduct an audit, itself or through an independent auditor who is not a competitor of OneAds and who is bound by confidentiality. Such an audit: requires at least 30 days' written notice; takes place during business hours; may occur no more than once in any 12-month period, unless required by a Supervisory Authority or following a Personal Data Breach; must not unreasonably disrupt OneAds' operations; must not access data of other customers or infrastructure shared in a way that would expose it; and is at the Controller's cost.

11Anonymisation and Aggregated Insights

This Section reflects an express instruction and authorisation given by the Controller. It is a material term.

11.1 Instruction. The Controller instructs and authorises OneAds to aggregate and irreversibly de-identify Customer Personal Data, and to use, retain, publish, license, sell and otherwise commercially exploit the resulting Aggregated Insights for any lawful purpose, including improving and training the models underlying the Service, providing benchmark features to other customers, and producing and selling market research.

11.2 Method. Before Customer Data enters an aggregation pipeline, OneAds removes all direct identifiers, including Controller and workspace identifiers, account email addresses, app names, bundle identifiers, App Store identifiers, campaign, ad group, creative and custom product page names, and all device and user identifiers. The output consists of measurements associated with neutral dimensions such as country, storefront, app category, subscription type and time period.

11.3 Aggregation thresholds. OneAds does not publish or make available any Aggregated Insight unless the underlying sample contains data from at least 10 distinct customer organisations and at least 25 distinct apps, and no single customer contributes more than 25% of the observations behind any published figure. Cells falling below these thresholds are suppressed.

11.4 No reidentification. OneAds will not attempt to reidentify the source of any Aggregated Insight, and will contractually require recipients and licensees not to do so. Where the CCPA applies, OneAds maintains Aggregated Insights as deidentified information in accordance with California Civil Code § 1798.140(m).

11.5 Legal effect. Data that has been aggregated and de-identified in accordance with this Section no longer relates to an identified or identifiable natural person and is not Personal Data within the meaning of Recital 26 GDPR. It is OneAds' data. It falls outside the scope of this DPA once produced, may be retained indefinitely, and is not subject to the deletion and return obligations in Section 13.

11.6 Enterprise opt-out. A Controller on an Enterprise Plan may withdraw the instruction and authorisation in Section 11.1 by written notice to support@oneads.pro. The withdrawal takes effect within 30 days of receipt and applies to Customer Personal Data received after its effective date. It is not retrospective, and Aggregated Insights already produced are not recalculated or deleted, consistently with Section 11.5 of this Annex. Withdrawal does not affect processing under Section 3 of this Annex.

11.7 What is excluded. Nothing in this Section permits OneAds to disclose, publish, license, sell or make visible to any third party, in identifiable or attributable form: the Controller's campaign structures, keyword lists, bids, budgets, spend, conversion counts, revenue, attribution records, device-level data, or the identity of the Controller or its apps as a source of any figure. Those remain Confidential Information under Section 9 of these Terms, and the prohibition is absolute.

12International transfers

12.1 OneAds hosts production infrastructure within the European Union. OneAds' personnel operate from the Republic of Armenia and other jurisdictions, and certain Sub-processors are located outside the European Economic Area.

12.2 EU transfers. Where OneAds' processing involves the transfer of Personal Data subject to the GDPR to a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where the Controller is a controller;
• Module Three (processor to processor) applies where the Controller is itself a processor;
• the data exporter is the Controller; the data importer is OneAds;
• Clause 7 (docking clause) applies;
• in Clause 9, Option 2 (general written authorisation) applies, with the notice period in Section 6.2 of this DPA;
• in Clause 11, the optional independent dispute resolution language does not apply;
• in Clause 17, the governing law is the law of Ireland;
• in Clause 18(b), the forum is the courts of Ireland;
• Annex I.A and I.B of the SCCs are populated by Annex A-1; Annex I.C identifies the competent Supervisory Authority as that of the Controller's establishment or representative;
• Annex II of the SCCs is populated by Annex A-2;
• Annex III of the SCCs is populated by Annex A-3.

12.3 UK transfers. For Personal Data subject to the UK GDPR, the UK Addendum applies to the SCCs, with Tables 1 to 3 populated by the corresponding information in this DPA, and Table 4 specifying that neither party may terminate under section 19 of the UK Addendum.

12.4 Swiss transfers. For Personal Data subject to Swiss law, the SCCs apply with the amendments recognised by the Swiss Federal Data Protection and Information Commissioner, including that references to the GDPR are read as references to the Swiss Federal Act on Data Protection, that the Commissioner is the competent authority, and that the term "member state" does not prevent Data Subjects in Switzerland from bringing proceedings in Switzerland.

12.5 OneAds has conducted transfer impact assessments for the destinations it relies on, and makes them available to the Controller on request. OneAds notifies the Controller if it becomes subject to a law or practice in a third country that would prevent it from fulfilling the SCCs.

12.6 In the event of conflict between the SCCs and any other provision of this DPA or the Terms of Service, the SCCs prevail in respect of transfers to which they apply.

13Deletion and return

13.1 On termination or expiry of these Terms, and at the Controller's election, OneAds deletes or returns Customer Personal Data in accordance with Section 16.5 of these Terms: available for export or return for 30 days; deleted from active systems within a further 30 days; deleted from backups in accordance with backup rotation and in any event within 90 days.

13.2 OneAds may retain Customer Personal Data to the extent, and for as long as, required by law to which it is subject. Retained data remains subject to the confidentiality and security obligations of this DPA, and is processed only for the purpose that requires its retention.

13.3 Aggregated Insights created before termination are unaffected by this Section, as set out in Section 11.5.

13.4 OneAds certifies deletion in writing on request.

14Liability and precedence

14.1 The limitations and exclusions of liability in these Terms apply to this Annex A and to any claim arising from it, to the maximum extent permitted by Data Protection Law. Nothing limits a Data Subject's rights under the SCCs or under Data Protection Law.

14.2 In the event of conflict, the order of precedence is: (a) the SCCs; (b) this Annex A; (c) the body of these Terms.

14.3 This Annex A is governed by the law stated in Section 18 of these Terms, except where the SCCs or mandatory Data Protection Law require otherwise.

Annex A-1Details of processing

## A. Parties

Data exporter / Controller: the Customer, as identified in its OneAds account. Role: controller (or processor, where the Customer is itself acting for a third party). Activities relevant to the transfer: use of the OneAds platform to manage and analyse Apple Ads campaigns for its mobile applications. Contact details: as recorded in the Customer's account.

Data importer / Processor: "ONEADS" LLC, 2 Nar-Dos Street, Kentron, Yerevan 0018, Republic of Armenia. Role: processor. Contact: support@oneads.pro. Activities relevant to the transfer: provision of the OneAds software-as-a-service platform.

## B. Description of the transfer

Categories of Data Subjects

• Authorised Users of the Controller: employees, contractors and agents of the Controller who access the Service.
• End users of the Controller's mobile applications, insofar as their data is contained in attribution and revenue records imported from the Controller's mobile measurement partner and subscription analytics provider.

Categories of Personal Data

Relating to Authorised Users: name (where provided), business email address, hashed password, role and permissions, workspace membership, IP address, device and browser information, timestamps, and records of actions taken in the Service.

Relating to end users of the Controller's applications: mobile advertising identifiers (for example IDFA) and measurement-partner device identifiers; install and event timestamps; event names; purchase, subscription, trial, renewal and refund events; revenue amounts and currency; country and storefront; application version; and attributed campaign, ad group, keyword and creative identifiers.

Sensitive data: none. The Controller must not upload or connect special categories of Personal Data within the meaning of Article 9 GDPR, or data relating to criminal convictions and offences, and the Service is not designed to process them.

Frequency of transfer: continuous, through scheduled synchronisation jobs and on-demand requests initiated by the Controller.

Nature and purpose of processing: hosting, storage, structuring, retrieval, computation, analysis, aggregation and display, for the purpose of enabling the Controller to plan, execute, automate, measure and optimise Apple Ads advertising campaigns for its applications; and the creation of Aggregated Insights under Section 11.

Duration of processing: for the term of the Terms of Service, plus the deletion periods in Section 13. Device-level event records are retained on a rolling window of 24 months.

Sub-processors: see Annex A-3. Duration of sub-processing corresponds to the duration of the main processing.

## C. Competent Supervisory Authority

The Supervisory Authority competent for the Controller under Clause 13 of the SCCs, determined by the Controller's place of establishment in the EEA or by its Article 27 representative.

Annex A-2Technical and organisational measures

Encryption. All data in transit is encrypted using TLS 1.2 or higher. Databases, backups and stored third-party API credentials are encrypted at rest. Passwords are stored only as salted bcrypt hashes.

Access control. Role-based access control within each Controller workspace, with distinct owner, administrator, writer, analyst and viewer privilege levels. Token-based authentication using short-lived access tokens and revocable refresh tokens. Administrative access by OneAds personnel is granted individually on a least-privilege basis, is logged, and is reviewed periodically. Access is revoked promptly on change of role or termination of engagement.

Segregation. Logical separation of Controller data at the application layer, enforced on every read and write by a centralised access-control service. Production and non-production environments are separated; production data is not used in development or testing.

Logging and traceability. An activity log records every material change made through the Service, identifying the actor and whether the change was made manually or by an automated rule. A separate execution log records every evaluation performed by an automated rule, including its inputs, decision path and before-and-after values. Logs are retained and are exportable by the Controller.

Availability and resilience. Automated backups with defined retention and periodic restoration testing. Continuous availability, error and performance monitoring, with alerting. Documented incident response procedure.

Physical security. Production infrastructure is operated in ISO 27001-certified data centres within the European Union, with the physical security controls applied by the hosting provider.

Personnel. Confidentiality undertakings binding on all personnel and contractors, surviving the end of engagement. Data protection and security awareness training appropriate to role.

Vendor management. Assessment of Sub-processors before engagement, written data protection terms with each, and periodic review.

Data minimisation. Only the data categories necessary for the functions the Controller has enabled are retrieved from connected sources. Device-level records are retained on a defined rolling window and then reduced to aggregates.

Deletion. Documented deletion procedures covering active systems and backups, with certification on request.

Annex A-3Sub-processors

Mobile measurement partners and subscription analytics providers engaged by the Controller under its own contracts — such as Adjust, Adapty and AppsFlyer — are not Sub-processors of OneAds. Data flows from them to OneAds on the Controller's authorisation; OneAds does not transmit Customer Personal Data to them.