Data Processing Agreement

In brief

This Data Processing Agreement (DPA) explains how Bhblasted SRL SB ("Wevion", "we", "us") handles the personal data you ("Customer", "you") process through the Service. In short: you decide why and how that data is used — you are the controller (GDPR) / business (CCPA/CPRA). We only process it on your written instructions to run the Service — we are your processor / service provider. We do not sell it, we do not share it for cross-context advertising, we protect it with technical and organisational measures, we tell you quickly if something goes wrong, and we give it back or delete it when you leave. This DPA applies automatically to B2B customers and is incorporated into the Terms of Service. The full detail is below.

Definitions

Capitalised terms have the meaning given by the applicable regulation. If two regulations conflict, GDPR terms govern for EEA/UK data subjects and CCPA/CPRA terms govern for California residents.

• GDPR (EU Regulation 2016/679) and UK GDPR: "personal data", "processing", "data subject", "controller", "processor", "sub-processor", "personal data breach".
• CCPA/CPRA (California Civil Code section 1798.100 et seq.): "personal information", "business", "service provider", "contractor", "sale", "share".
• LGPD (Brazil Law 13.709/2018): "dados pessoais", "controlador", "operador".

Roles and scope

2.1 Controller / Business: Customer determines the purposes and means of processing personal data through Wevion. 2.2 Processor / Service Provider: Bhblasted SRL SB processes personal data only on Customer's documented instructions and only as needed to provide the Service under the Terms of Service. 2.3 Bhblasted SRL SB does not:

• Sell personal information (CCPA/CPRA).
• Share personal information for cross-context behavioural advertising.
• Retain, use, or disclose personal information outside the direct business relationship with Customer.
• Combine Customer's personal information with data from other sources for purposes outside the Service.

2.4 Account data of platform users that Bhblasted SRL SB processes for its own purposes, such as account management, billing, security, product analytics and the measurement of its own advertising, is processed by Bhblasted SRL SB as an independent controller under the Privacy Policy and is not covered by this DPA.

Processing instructions

3.1 Customer instructs Bhblasted SRL SB to process personal data to deliver Service features; these Terms and the DPA are Customer's complete documented instructions unless updated in writing, including with regard to transfers of personal data to a third country. 3.2 We process personal data only on those instructions, unless a law we are subject to requires otherwise — in which case we inform Customer first, unless the law prohibits it. 3.3 If we receive a government or legal data request (subpoena, court order, agency request), we challenge overly broad requests and notify Customer unless legally barred. 3.4 Any processing outside the Service scope requires a separate written agreement. 3.5 We inform Customer immediately if, in our opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions.

Duration

This DPA stays in effect for as long as Customer has an active Wevion account and throughout the retention period afterwards described in the Privacy Policy. Its subject-matter is the provision of the Service; its nature and purpose are the processing operations needed to deliver Service features to Customer.

Categories of data subjects and data

Data subjects: where Customer chooses to process it through the Service, Customer's own end users (e.g. leads and audience members) and the personal data of Customer's team members contained in Customer content.

Categories of personal data:

Bhblasted SRL SB does not intentionally process:

• Special categories of data (GDPR Art. 9) or CCPA/CPRA "sensitive personal information", unless Customer explicitly instructs it and has a valid legal basis.
• Children's data (under 16 in the EU, under 13 under US COPPA).

Confidentiality

Any Bhblasted SRL SB personnel authorised to process Customer personal data are bound by written confidentiality obligations (or an appropriate statutory duty of confidentiality) and access personal data only on a need-to-know basis to provide the Service (GDPR Art. 28(3)(b)).

Sub-processors

7.1 Customer gives general authorisation for Bhblasted SRL SB to engage the sub-processors listed at /sub-processors. 7.2 We give at least 30 days' advance notice of adding or replacing a sub-processor, by email and in-app notice. 7.3 Customer may object on reasonable data-protection grounds within 30 days; if we cannot resolve the objection, Customer may terminate the affected part of the Service for the remaining subscription period, with a pro-rata refund of fees paid for the unused period. 7.4 We put a written contract in place with each sub-processor imposing data-protection obligations equivalent to this DPA, and we remain responsible for their performance.

Security measures

Bhblasted SRL SB implements technical and organisational measures appropriate to the risk (GDPR Art. 32), including those below. Customer may request current security documentation in writing at security@wevion.ai.

• Encryption in transit (TLS) for connections between Customer's users and the Service.
• Encryption at rest of the main database (Amazon Aurora, with AWS KMS keys) and application-level encryption of the access tokens of connected ad accounts.
• Role-based access control for production access, limited to authorised staff.
• Automated checks on every change, including secret scanning, before it reaches production.
• Audit logs of administrative actions.
• Database backups with point-in-time recovery.

Personal data breach notification

9.1 We notify Customer without undue delay and no later than 72 hours after becoming aware of a personal data breach affecting Customer's data. 9.2 The notice describes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. 9.3 We reasonably assist Customer with its own notification duties under GDPR Art. 33-34, CCPA, and US state breach-notification laws.

Assistance to Customer

Taking into account the nature of the processing and the information available to us, we reasonably assist Customer with: 10.1 responding to data subject requests (access, rectification, erasure, portability, objection) — the Service provides self-service tools for most of these; 10.2 security of processing (Art. 32); 10.3 breach notification and communication (Art. 33-34); and 10.4 data protection impact assessments and prior consultation with a supervisory authority (Art. 35-36). If a data subject contacts us directly about Customer's processing, we forward the request to Customer without undue delay and do not respond on Customer's behalf unless instructed.

Meta Business Tools and joint controllership

When Customer connects Meta Business Tools (Pixel, Conversions API/CAPI, Custom Audiences) through the Service, Customer and Meta may act as joint controllers under GDPR Art. 26 for the data collected by those tools, governed by Meta's own controller/joint-controllership terms that apply directly between Customer and Meta. In this flow Bhblasted SRL SB acts only as Customer's processor: we transmit events to Meta on Customer's documented instruction. Customer is responsible for: (a) collecting valid, prior consent from its end users before any Pixel/CAPI event fires; (b) keeping evidence of that consent; and (c) providing the notices its users are due. Wevion does not collect or check end-user consent on Customer's behalf; Customer must configure its own consent mechanism so that events are sent to the Service only after consent has been captured where it is required.

AI features

AI features (creative generation, chat, recommendations) assist Customer's users; they do not make automated decisions producing legal or similarly significant effects on any data subject within the meaning of GDPR Art. 22. The user reviews and approves every AI output before it is published or acted upon. For California residents, automated decision-making technology (ADMT) opt-out requests can be sent to privacy@wevion.ai.

International data transfers

13.1 Bhblasted SRL SB is established in Italy (EEA). Where personal data is transferred from the EEA/UK to a country without an adequacy decision, the transfer relies on the mechanisms below. 13.2 Sub-processors receiving data outside the EEA/UK are listed with their applicable transfer mechanism at /sub-processors.

• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated by reference (see Annex 1).
• UK International Data Transfer Addendum, where applicable.
• Transfer Impact Assessments for specific data categories and corridors.
• EU–U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), for US recipients certified under it.

Audit rights

14.1 Once per year, Customer may request documentation demonstrating our compliance with this DPA (including security certifications and third-party audit reports where available). 14.2 On-site audits require 60 days' written notice, are at Customer's cost, and are subject to our reasonable security and confidentiality requirements; Customer may nominate a mutually acceptable independent auditor. 14.3 A current SOC 2 Type II report, when available, satisfies the standard audit right.

Return and deletion

15.1 On termination of the Service, or earlier at Customer's request, Customer may export personal data via the Service (self-service) for 30 days after termination. At Customer's choice we then delete the personal data, within 30 days of Customer's written request to privacy@wevion.ai, except where retention is required by law. 15.2 We certify deletion in writing on request.

Liability

Liability under this DPA is governed by the Wevion Terms of Service, section “Disclaimer and limitation of liability”. This DPA does not change that liability cap.

Conflicts and changes

17.1 If this DPA conflicts with the Terms of Service on data-processing matters, this DPA prevails. 17.2 We give Customer at least 30 days' advance notice of changes that materially affect Customer's rights under this DPA.

Governing law

This DPA is governed by the laws of Italy. Disputes are resolved as set out in the Terms of Service (exclusive jurisdiction of the competent Italian court). For EU/UK data subjects, the independent remedies under GDPR (including Art. 79) remain available against Bhblasted SRL SB notwithstanding this section.

Contact

Data protection inquiries: privacy@wevion.ai — Bhblasted SRL SB, Attn: Data Protection, Via Boscofangone SNC, Zona ASI, Lotto C8, 80035 Nola (NA), Italy — VAT IT08466861211.

Annex 1: Standard Contractual Clauses

For transfers to non-EEA/UK recipients, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference and form an integral part of this DPA: Module Two (controller-to-processor) applies between Customer (controller) and Bhblasted SRL SB (processor); Module Three (processor-to-processor) applies to onward transfers to sub-processors. For UK data, the UK International Data Transfer Addendum to the SCCs applies. Bhblasted SRL SB maintains executed clauses and provides copies on request at privacy@wevion.ai.

Annex 2: Sub-processors

The current list is maintained at /sub-processors, with the date of last update and, for each entity, its role, location, and applicable transfer mechanism.

Annex 3: CCPA Service Provider addendum

For California personal information processed under this DPA, Bhblasted SRL SB acts as a Service Provider under CCPA/CPRA and agrees to:

• Process personal information only to perform the Service on Customer's behalf.
• Not sell or share personal information, and not retain, use, or disclose it outside the direct business relationship with Customer.
• Comply with applicable CCPA obligations for service providers.
• Assist Customer with consumer rights requests under CCPA/CPRA.

Contact

Bhblasted SRL SB — Via Boscofangone SNC, Zona ASI, Lotto C8, 80035 Nola (NA), Italy.