Data Processing Agreement

Purpose and scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between your business ("Customer") and Go-Top Marketing and Media Ltd, company number 51-XXXXXXX ("Taseli"). It applies whenever Taseli processes personal data on the Customer's behalf while providing the service, and it is designed to meet the requirements of the Israeli Protection of Privacy Law (including Amendment 13) and its Data Security Regulations, and, where applicable, Article 28 of the GDPR.

Accepting the Terms means accepting this DPA. Customers who need a signed copy can request one at legal@taseli.co.il.

Roles

Where the Customer is itself a processor (for example, an agency acting for its clients), Taseli acts as its subprocessor, and the Customer is responsible for having the authority to engage Taseli.

Processing details

• Subject matter: providing the Taseli service: analysis, proposals, approved or policy-authorized changes, monitoring, restoration, alerts and reports.
• Duration: for the term of the subscription, plus the deletion period below.
• Categories of data subjects: people whose data appears in the Customer's advertising accounts, such as people who submitted lead forms or whose search queries appear in search-term reports; the Customer's staff and clients.
• Categories of data: advertising and performance data; data in lead forms or order records the Customer connects (such as name, email, phone); online identifiers. Taseli does not seek special-category data.

Taseli's obligations

Taseli will:

1. Process personal data only on the Customer's documented instructions, which are these Terms, the DPA and the Customer's use and configuration of the service, unless the law requires otherwise (in which case Taseli informs the Customer, unless the law prohibits it).
2. Ensure that everyone authorized to process the data is bound by confidentiality.
3. Not sell the data, not use it for advertising, and not use it to train AI models.
4. Not allow any person at Taseli to view account data without the Customer's explicit, time-limited consent for support access, except where necessary for security or required by law. Every access is logged.
5. Assist the Customer, taking into account the nature of the processing, in responding to data subjects' requests, and with security, breach notification and data protection impact assessments.
6. Make available the information needed to demonstrate compliance with this DPA.

Security measures

Taseli maintains technical and organizational measures appropriate to the risk, including:

• encryption in transit (TLS) and at rest;
• OAuth tokens stored with envelope encryption in a dedicated vault, never in logs, AI prompts or queues;
• separation between the services that read advertising data and the service that can make changes, with every change passing through a single controlled change service;
• role-based, least-privilege access, multi-factor authentication, and a quarterly access review;
• audit logs of access and of every change;
• a web application firewall, rate limiting, dependency and secret scanning;
• encrypted backups, and a tested restore procedure that re-applies deletions;
• a written data security procedure, a penetration test before launch and at least once a year;
• a documented incident response runbook.

Subprocessors

The Customer gives general authorization for Taseli to engage the subprocessors listed on the Subprocessors page. Taseli:

• binds each subprocessor by written agreement to data protection obligations no less protective than this DPA;
• remains responsible for its subprocessors' performance;
• gives at least 30 days' notice of a new or replaced subprocessor, by updating the page and notifying subscribers. The Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a prorated refund of prepaid fees.

International transfers

Where personal data is transferred outside Israel or the European Economic Area, Taseli ensures an adequate level of protection or appropriate safeguards, such as the Standard Contractual Clauses or the EU-US Data Privacy Framework, and compliance with the Israeli regulations on transfers of data abroad.

Personal data breaches

Taseli will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of records and people affected, the likely consequences, and the measures taken or proposed. Taseli will report to the Privacy Protection Authority where the law requires it, and will cooperate with the Customer's own notifications.

Deletion and return

• The Customer can export its data at any time from the app.
• On termination, or when the Customer deletes a workspace, Taseli stops processing immediately, revokes platform access, and deletes Customer data, including at subprocessors, within 90 days, unless the law requires retention of specific records.
• Backups are deleted on their regular cycle, and deletions are re-applied before any restore.
• On request, Taseli confirms the deletion in writing.

Audits

Taseli will make available reasonable information to demonstrate compliance, such as summaries of its security procedure and of its latest penetration test. Where that information is not sufficient, the Customer may, at its expense and not more than once a year, conduct an audit, or have it conducted by an independent auditor bound by confidentiality, on 30 days' notice, during business hours, and in a way that does not compromise other customers' data or the service's security. Audits required by a supervisory authority are not limited to once a year.

Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not permit such limitation. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

Contact

Data protection questions: privacy@taseli.co.il. Requests for a signed DPA: legal@taseli.co.il.