We use cookies to improve your experience and for marketing. Read our cookie policy & privacy policy.
Last Updated: January 8, 2026
Need a signed copy?
Request a pre-signed DPA for your records.
This Data Processing Addendum ("DPA") is incorporated by reference into Stack Up's Terms of Service or other agreement governing the use of Stack Up's services ("Agreement") entered by and between you, the Customer (as defined in the Agreement) (collectively, "you", "your", "Customer"), and Stack Up Ltd. ("Stack Up", "us", "we", "our") to reflect the parties' agreement with regard to the Processing of Personal Data by Stack Up solely on behalf of the Customer.
"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control", for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
"Authorized Affiliate" means any of Customer's Affiliate(s) which is explicitly permitted to use the Services pursuant to the Agreement between Customer and Stack Up but has not signed its own agreement with Stack Up.
"CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et. Seq, and its implementing regulations, as may be amended from time to time.
The terms "Controller", "Member State", "Processor", "Processing" and "Supervisory Authority" shall have the same meaning as in the GDPR. The terms "Business", "Business Purpose", "Consumer" and "Service Provider" shall have the same meaning as in the CCPA.
"Data Protection Laws" means all applicable and binding privacy and data protection laws and regulations, including those of the European Union, the European Economic Area and their Member States, Switzerland, the United Kingdom, Canada, Israel and the United States of America, including the GDPR, the UK GDPR, and the CCPA.
"Data Subject" means the identified or identifiable person to whom the Personal Data relates.
"GDPR" means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
"Personal Data" or "Personal Information" means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable natural person, which is processed by Stack Up solely on behalf of Customer.
"Services" means the Stack Up cloud-based ad tech analytics services including our platforms, products, services, applications, and API.
"Sub-processor" means any third party (including any Stack Up Affiliate) engaged by Stack Up to Process Personal Data on behalf of Customer.
This DPA applies to the Processing of Personal Data by Stack Up on behalf of Customer in connection with the provision of the Services. Stack Up will only Process Personal Data in accordance with Customer's documented instructions, as set forth in this DPA and the Agreement.
Customer represents and warrants that: (a) it has complied and will continue to comply with all applicable Data Protection Laws in the collection of Personal Data; (b) it has all necessary rights to provide the Personal Data to Stack Up for Processing; and (c) it has provided adequate notices and obtained all necessary consents from Data Subjects as required by applicable Data Protection Laws.
Stack Up shall:
Customer provides general authorization to Stack Up to engage Sub-processors. Stack Up shall maintain an up-to-date list of its Sub-processors at our Subprocessors page. Stack Up shall notify Customer of any intended changes concerning the addition or replacement of Sub-processors, giving Customer the opportunity to object to such changes.
Stack Up has implemented and will maintain appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage. These measures include:
Stack Up shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data. Such notification shall include all information reasonably required by Customer to comply with its obligations under Data Protection Laws.
Stack Up may transfer Personal Data to countries outside of the European Economic Area, the United Kingdom, or Switzerland. When Stack Up transfers Personal Data to such countries, it shall ensure that appropriate safeguards are in place, including the use of Standard Contractual Clauses as approved by the European Commission.
To the extent that the CCPA applies, Stack Up shall: (a) not sell Personal Information; (b) not retain, use, or disclose Personal Information for any purpose other than providing the Services; (c) not retain, use, or disclose Personal Information outside the direct business relationship with Customer; and (d) comply with all applicable requirements of the CCPA.
Stack Up shall make available to Customer, upon reasonable request, information necessary to demonstrate compliance with this DPA. Stack Up shall allow for and contribute to audits, including inspections, conducted by Customer or a third-party auditor mandated by Customer, subject to reasonable confidentiality requirements.
Each party's liability under this DPA is subject to the limitations of liability set forth in the Agreement. Nothing in this DPA shall limit or exclude a party's liability for any liability that cannot be limited or excluded by applicable law.
This DPA shall remain in effect for so long as Stack Up Processes Personal Data on behalf of Customer under the Agreement. Upon termination of the Agreement, Stack Up shall, at Customer's election, delete or return all Personal Data, unless retention is required by applicable law.
If you have questions about this DPA or our data processing practices, please contact us at:
Stack Up Ltd.
Email: [email protected]
Data Protection Officer: [email protected]