AscendFlare
Sign in

Effective 11 September 2026

Data Processing Addendum

This DPA forms part of the Terms between the customer (“Controller”) and Apex Root Solutions LLC, a limited liability company organised under the laws of the State of Delaware, with its registered office in Wilmington, New Castle County, Delaware, and its principal place of business in Cedar Hill, Dallas County, Texas (“Processor”) and applies where the Controller’s use of AscendFlare involves personal data subject to the GDPR or UK GDPR.

1. Subject matter and duration

Processing of personal data contained in store listings, public reviews, social posts, advertising data and workspace membership for the purpose of providing AscendFlare, for the term of the agreement.

2. Nature and purpose

Collection from public sources and connected platforms, analysis, generation of drafts, publication to platforms on the Controller’s instruction (each approval is an instruction), reporting, and audit logging.

3. Categories of data subjects and data

Workspace members (identity, contact, session metadata); app reviewers (public review text and rating, no identifiers beyond what the store publishes); social media audiences (aggregate metrics only).

4. Processor obligations

  • Process only on documented instructions; each in-product approval is an instruction.
  • Ensure confidentiality of personnel; encrypt credentials at rest; maintain the security measures in Annex II.
  • Engage sub-processors only as listed at /legal/subprocessors, with notice of changes and a right to object.
  • Assist with data-subject requests and DPIAs; notify personal-data breaches without undue delay and within 72 hours of awareness.
  • Delete or return data at the end of the service (self-service deletion is available in-product), subject to the append-only audit log retained for legal-obligation purposes.
  • Make available information necessary to demonstrate compliance and allow audits under reasonable conditions.

5. International transfers

The Processor is established in the United States. Transfers of personal data from the EEA are made under the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914 (Module Two, controller-to-processor, and Module Three, processor-to-processor for onward transfers to sub-processors), which are incorporated by reference with the Controller as data exporter and the Processor as data importer; transfers from the United Kingdom are made under the UK International Data Transfer Addendum to those clauses; transfers from Switzerland apply the clauses as adapted by the Swiss FDPIC. Where a sub-processor is certified under the EU-US Data Privacy Framework, that certification is relied on in addition. The Processor will provide a completed copy of the clauses on request and will carry out and document transfer impact assessments where required.

6. Term and deletion

This DPA applies for as long as the Processor processes personal data for the Controller. On termination the Controller may export its data from the Account page; the Processor deletes workspace data on deletion by the Controller and in any case within 30 days of account closure (backups within a further 30 days), except the audit log, retained for 3 years under a legal-obligation basis, and billing records retained for 7 years.

7. Liability and order of precedence

The parties’ liability under this DPA is subject to the limitations in the Terms, except that nothing limits liability for a party’s breach of the Standard Contractual Clauses towards data subjects. In a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms.

Annex II — Technical and organisational measures

  • AES-256-GCM encryption of platform credentials with versioned key rotation; TLS in transit; secrets held in a secrets manager.
  • Passwordless authentication, role-based access, per-action confirmation, session revocation.
  • Append-only, hash-chained audit log with actor and IP; export on request.
  • Rate limiting, CSRF and SSRF protections, security headers, dependency vulnerability scanning in CI.
  • Continuous database replication with 30-day point-in-time recovery; retention jobs enforcing the schedule in the Privacy Policy.
  • Structured logging with secret redaction; error tracking with PII scrubbing.