Data Processing Agreement

This Data Processing Agreement (“DPA”) applies between Safli Technologies Ltd (“Processor”, “Measura”) and the customer entity that has accepted the Measura Terms of Service (“Controller”, “you”).

It governs the processing of personal data that Measura carries out on your behalf when you use the Service, and forms part of the Terms of Service. Where this DPA conflicts with the Terms of Service on a data protection matter, this DPA prevails.

It is written to satisfy Article 28 of the GDPR and the corresponding obligations under Nigeria Data Protection Act 2023 (NDPA).

Personal data, processing, controller, processor, data subject and supervisory authority carry the meanings given in the GDPR and Nigeria Data Protection Act 2023 (NDPA).

Customer Personal Data means personal data contained in data submitted to the Service by you or collected by the Measura SDK embedded in your applications.

Sub-processor means a third party engaged by Measura to process Customer Personal Data.

For Customer Personal Data, you are the controller and Measura is the processor. You determine the purposes and means of processing, and you are responsible for the lawfulness of the collection you instruct.

Measura acts as a controller in two limited respects: for account, billing and support data relating to your personnel, and for platform level security and fraud prevention signals evaluated across our customer base. Processing in the controller capacity is described in our Privacy Policy and falls outside this DPA.

Measura processes Customer Personal Data only on your documented instructions. Your instructions comprise this DPA, the Terms of Service, and the configuration choices you make in the Service, including which events you send, which attribution windows you set, and which advertising network postbacks you enable.

Measura will inform you if, in its opinion, an instruction infringes applicable data protection law, and may suspend performance of that instruction until it is amended or confirmed.

Measura will not process Customer Personal Data for its own purposes, will not sell it, and will not use it to build advertising profiles across customers.

Measura ensures that personnel authorised to process Customer Personal Data are bound by confidentiality obligations, and that access is limited to those who require it to deliver or support the Service. Administrative access to customer records is recorded in an append only audit log capturing the actor, the action and the values changed.

Measura implements the technical and organisational measures set out below. These are the measures actually in place, not aspirations.

You give general authorisation for Measura to engage the sub-processors listed below. Each is bound by data protection terms no less protective than this DPA.

Changes to the list

Measura will give at least thirty days’ notice before adding or replacing a sub-processor. If you have a reasonable objection on data protection grounds, raise it within that period and we will work in good faith to find an alternative. If none is available you may terminate the affected part of the Service without penalty.

Advertising networks are not sub-processors

Where you enable a postback, the receiving advertising network acts as an independent controller of what it receives, not as our sub-processor. That transfer is made on your instruction and you are responsible for having a lawful basis for it.

Customer Personal Data is stored in a managed database in the us-west-2 region (Oregon, United States), and may be transferred to and processed in other countries where our sub-processors operate.

Where a transfer involves personal data subject to the GDPR or UK GDPR and the destination is not covered by an adequacy decision, Measura will enter into an approved transfer mechanism with the customer before such data is processed. This means the European Commission’s standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another mechanism approved under the applicable regime, executed as part of this agreement.

Taking into account the nature of the processing, Measura will assist you in responding to requests from data subjects exercising their rights of access, rectification, erasure, restriction, portability and objection.

If a data subject contacts Measura directly about Customer Personal Data, we will refer them to you and will not respond substantively except on your instruction or where legally required.

The developer dashboard provides a form for logging requests. A request must identify the data subject by advertising identifier or device identifier.

Measura will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

Where information is not available at the time of the initial notification, it will be provided in phases as it becomes available.

Notifying a supervisory authority or affected data subjects, where required, remains your responsibility as controller. Measura will provide reasonable assistance.

Report a suspected breach or security issue to privacy@measura.dev.

Measura will make available the information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits conducted by you or an auditor you appoint.

Audits must be requested with at least thirty days’ notice, occur no more than once per year unless required by a supervisory authority or following a breach, take place during business hours, and not unreasonably disrupt the Service. The auditor must be bound by confidentiality and must not be a competitor of Measura.

As we hold no third party certification to offer in place of an audit, we will respond to reasonable written security questionnaires instead where that meets your requirement.

The Service applies the following automated retention windows.

On termination of the Service, Measura will delete Customer Personal Data within a reasonable period, except where retention is required by law. If you require the return of data in a usable format, request it before terminating, since we do not currently provide a self service bulk export and deletion is not reversible.

The limitations and exclusions of liability in the Terms of Service apply to this DPA, except that nothing limits either party’s liability to a data subject or a supervisory authority under applicable data protection law.

Subject matter

Provision of mobile attribution measurement, deep linking, fraud signalling and analytics.

Duration

For the term of the Terms of Service, plus the retention periods set out above.

Nature and purpose

Collection, recording, structuring, storage, matching, scoring, aggregation, transmission to configured advertising networks, and erasure, for the purpose of attributing app installs and events to marketing activity and detecting fraudulent activity.

Categories of data subjects

• End users of applications operated by the Controller.
• Personnel of the Controller who hold dashboard accounts.

Categories of personal data

Special category data. None is requested and none should be sent. Developer supplied event properties are free form and are not inspected by Measura, so the Controller is responsible for ensuring no special category data, financial account numbers, government identifiers or health data is placed in them.

To execute this DPA as a signed agreement, or to raise a question about it, contact privacy@measura.dev.