Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is part of the Terms of Service between the client ("Client", controller) and CyberLab.Team OÜ, registry code 14647320, Sepapaja tn 6, Tallinn 15551, Estonia ("CyberLab.team", processor). It applies to all services where we process personal data on the Client's behalf (Art. 28 GDPR). It is accepted together with the Terms of Service; a signed copy is available on request to info@cyberlab.team. The language rules of the Terms of Service apply (for business clients the English version prevails over translations).

1. Subject, nature and purpose

1.1. We process personal data only to provide the services ordered by the Client (Terms of Service, Part II) and only on the Client's documented instructions, which are the Terms of Service, this DPA, the order, the Client's settings and approvals in the Client Cabinet and written instructions by email, unless EU or Member State law to which we are subject requires otherwise; in that case we inform the Client of that legal requirement before processing, unless that law prohibits it on important grounds of public interest. These instructions also cover transfers of personal data to third countries. If we consider an instruction unlawful, we will tell the Client immediately.

1.2. Details of the processing (categories of data subjects and data, duration) are in Annex 1.

1.3. We do not process our clients' customer lists for Google Ads audiences (Customer Match) or leads from Google Ads lead forms. This DPA will be updated before any such service is offered.

2. Our obligations

2.1. Confidentiality. Everyone who processes the Client's data on our behalf is bound by confidentiality.

2.2. Security. We apply the technical and organisational measures in Annex 2.

2.3. People with access. The Client's assigned manager processes the Client's data; for quality control, supervision and substitution of managers, a senior manager and the head of CyberLab.team also have access. Access to Client Cabinet chats is logged.

2.4. Assistance. We help the Client, taking into account the nature of the processing, to respond to data subjects' requests, to ensure security, to notify breaches and to carry out data protection impact assessments and prior consultations with supervisory authorities (Articles 32 to 36 GDPR). Requests that data subjects send to us about the Client's data are forwarded to the Client.

2.5. Personal data breaches. We notify the Client without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Client's data, with the information available to us; we do not wait for the investigation to be complete and send further information as it becomes available.

2.6. Audits. We make available all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and we allow for and contribute to audits, including inspections, by the Client or an auditor mandated by the Client. A written questionnaire may be the first step. Scope, time and confidentiality of other audits are agreed in advance so that the security of other clients' data is protected; these arrangements do not prevent or unreasonably delay an audit.

2.7. End of processing. When a service ends, we return the Client's personal data (by export in the Client Cabinet or on request at info@cyberlab.team) or delete it, at the Client's choice, and delete existing copies within the periods in the Privacy Policy (in particular within 30 days after the end of the Client's last contract or the closing of the Client Cabinet, backups within 35 days; content received from Google is not kept in backups and is never kept longer than 30 days), unless EU or Member State law requires us to keep it; data kept for that reason is used only for that purpose. Before deletion the Client can export its data in the Client Cabinet or ask for it at info@cyberlab.team.

2.8. Google data. Data received from Google is processed under the Google API Services User Data Policy, including Limited Use, and kept no longer than 30 days. Data from the Client's Google Ads account is not sold, sub-licensed or disclosed to third parties without the Client's prior written consent.

3. Subprocessors

3.1. The Client authorises the subprocessors listed at cyberlab.team/subprocessors (the current list is also in Annex 3). We impose on each subprocessor data protection obligations equivalent to this DPA and remain responsible for them.

3.2. Changes. We notify the Client by email from info@cyberlab.team and on the subprocessors page at least 30 days before adding or replacing a subprocessor, stating its identity, purpose, the data concerned, where it processes data and the transfer safeguards. The Client may object in writing within this period on reasonable data protection grounds; if we cannot resolve the objection, the Client may terminate the affected service before the new subprocessor starts processing the Client's data, without charge for later periods, and we refund any prepaid fees for the period after termination. If an urgent security incident or outage requires us to replace a subprocessor immediately, we notify the Client without undue delay and no later than on the day of the switch; the Client's right to object and terminate applies in the same way.

3.3. Independent controllers. Google (for Google Business Profile, Google Ads, Google sign-in and Google Analytics), Stripe (for payments), Cloudflare (for the signals it uses to improve its own Turnstile bot detection) and banks act as independent controllers under their own terms for their own purposes, not as our subprocessors; where one of them processes data on our behalf for a particular service, its data processing terms apply to that service. When we transmit data into Google's services on the Client's instructions, Google processes it under its terms with the Client.

4. International transfers

Personal data is hosted in the European Union. Where a subprocessor processes data outside the EEA, the transfer is protected by an adequacy decision (including the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses, as indicated in Annex 3.

5. Client's responsibilities

5.1. The Client is responsible for the lawfulness of the data it gives us and of its instructions, including informing its own customers and obtaining any consents required.

5.2. The Client is responsible for the cookie banner and consent on its own websites, including Google Consent Mode where required, also where we help to set them up.

6. Liability and precedence

Liability under this DPA follows the Terms of Service (Section 10), except where the GDPR does not allow a limitation. If this DPA and the Terms of Service conflict regarding personal data, this DPA prevails.

---

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

• Hosting in the EU; each client's data is held separately, and one client's data is never shown to another client.
• Encrypted connections (TLS); encrypted backups, overwritten within 35 days.
• Access only for staff who need it; two-factor authentication for staff; logging of access to client chats.
• We do not store clients' Google passwords and do not keep clients' Google sign-in tokens; our access to Google is through our own agency credentials held in a secret store.
• Error reports are filtered to remove texts received from Google before they leave the application.
• Documented procedures for data subject requests, deletion, legal holds and incident response.

Annex 3 — Subprocessors

The list at cyberlab.team/subprocessors, version 2026-10-16, forms this Annex.