Data Processing Agreement (DPA)

NxtWave Ad Network
(Effective Date: 09-11-2025)

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Advertiser Terms & Conditions and applies whenever NxtWave Ad Network (“NxtWave”, “we”, “our”, “us”) processes personal or advertising data on behalf of the Advertiser (“you”, “your”, “Client”).

This DPA ensures both parties comply with applicable data protection laws, including:

  • The Data Protection Act of Bangladesh (if enacted or replaced by future regulations)
  • The General Data Protection Regulation (EU) 2016/679 (GDPR)
  • Other applicable privacy laws and industry standards.

2. Purpose and Scope

This Agreement governs how NxtWave processes, stores, or transmits personal and campaign-related data provided or generated by the Advertiser in connection with advertising campaigns across NxtWave-owned platforms, including:

  • Mobile Apps (banner, interstitial, reward, and packages)
  • Websites
  • Facebook Media Channels
  • NxtWave Titles and Digital Products

NxtWave acts as the Data Processor, while the Advertiser is the Data Controller (as defined under GDPR and similar laws).

3. Definitions

  • “Data Controller” — The party that determines the purpose and means of processing personal data (the Advertiser).
  • “Data Processor” — The party that processes data on behalf of the Controller (NxtWave Ad Network).
  • “Personal Data” — Any information that identifies or can reasonably identify an individual (e.g., name, email, device ID, IP address).
  • “Processing” — Any operation performed on data (e.g., collection, storage, analysis, transfer, deletion).
  • “Sub-Processor” — Any third-party service used by NxtWave to process data (e.g., analytics or hosting providers).
  • “Applicable Law” — Data protection laws in the relevant jurisdiction, including GDPR, PDPA, and any local regulations.

4. Roles and Responsibilities

4.1 Advertiser (Data Controller)

The Advertiser is responsible for:

  • Ensuring all data shared with NxtWave is lawfully obtained.
  • Providing clear and valid consent from end-users (if applicable).
  • Defining the lawful purpose of data collection.
  • Informing users about how their data may be used for advertising purposes.

4.2 NxtWave (Data Processor)

NxtWave agrees to:

  • Process data only as instructed by the Advertiser.
  • Maintain appropriate technical and organizational security measures.
  • Not sell, disclose, or use data for any purpose other than delivering ad services.
  • Ensure all employees handling data are bound by confidentiality obligations.

5. Nature and Purpose of Processing

The processing activities performed by NxtWave include:

  1. Storing advertiser details (contact, payment, campaign metadata).
  2. Delivering ads and tracking performance metrics (impressions, clicks, conversions).
  3. Generating analytics and reports for advertisers.
  4. Preventing fraudulent activities or policy violations.
  5. Managing billing, invoicing, and communications.
  6. Using anonymized or aggregated data for platform optimization.

All processing is limited to the scope required to perform the services agreed upon in the advertising contract.

6. Categories of Data Processed

  • Business contact data (name, email, phone number)
  • Billing and company details
  • Campaign data (ad creatives, schedules, metrics)
  • Device or network identifiers (IP address, ad ID, app-set ID, etc.)
  • Location data (approximate, non-precise region or city)
  • Usage data from NxtWave platforms (clicks, impressions, interactions)

7. Data Retention

NxtWave retains personal and campaign data:

  • For as long as the campaign is active.
  • Up to 12 months after completion for reporting and billing.
  • As required by law or regulation for accounting or dispute resolution.

After this period, data will be securely deleted or anonymized.

8. Sub-Processing

NxtWave may engage trusted Sub-Processors to assist in service delivery.
These may include:

  • Google LLC (Analytics, Ad Measurement, Firebase)
  • Meta Platforms, Inc. (Ad delivery, tracking)
  • Hosting Providers (for cloud data storage)

All Sub-Processors:

  • Are bound by equivalent data protection obligations.
  • Process data only under NxtWave’s written instructions.
  • Are periodically reviewed for compliance and security.

A full list of active Sub-Processors can be provided upon written request.

9. Security Measures

NxtWave implements industry-standard measures to protect data, including:

  • Encrypted data storage and transmission (HTTPS, SSL/TLS)
  • Access control and authentication for staff
  • Regular security audits and system monitoring
  • Backup and disaster recovery systems
  • Anonymization or pseudonymization where possible

10. Data Breach Notification

In the event of a personal data breach, NxtWave will:

  1. Notify the Advertiser without undue delay (within 72 hours if feasible).
  2. Provide relevant details, including:
    • Nature and scope of the breach
    • Categories and volume of data affected
    • Corrective measures taken
  3. Cooperate fully with the Advertiser and relevant authorities in investigation and remediation.

11. International Data Transfers

  • Data may be stored or processed in other countries where NxtWave or its Sub-Processors operate.
  • NxtWave ensures all transfers comply with applicable laws through:
    • Standard Contractual Clauses (SCCs), or
    • Adequate protection mechanisms approved by regulators.

No transfer will occur without ensuring equal or stronger protection than the originating country.

12. Data Subject Rights

NxtWave will assist the Advertiser in responding to data subject requests, including:

  • Access to personal data
  • Correction or deletion
  • Data portability
  • Objection or restriction of processing

Requests must come directly from the Advertiser or with clear proof of authorization.

13. Confidentiality

Both parties agree to:

  • Keep all shared data confidential.
  • Not disclose it to unauthorized persons or third parties.
  • Ensure employees with access are trained and legally bound to maintain confidentiality.

This obligation remains valid even after the termination of the contract.

14. Audit and Compliance Rights

  • The Advertiser may request written proof of NxtWave’s data protection compliance.
  • On justified grounds, limited audits may be arranged under mutual agreement and confidentiality.
  • NxtWave may provide third-party certifications or audit summaries in place of physical audits.

15. Term and Termination

This DPA remains in effect as long as NxtWave processes data on behalf of the Advertiser.
Upon termination of services:

  • All personal data shall be deleted or returned (at Advertiser’s request).
  • NxtWave will confirm completion of deletion in writing.

16. Liability

Each party is responsible for ensuring compliance with applicable data protection laws.
NxtWave’s liability is limited to direct damages caused by proven data mishandling under this DPA and shall not exceed the total amount paid by the Advertiser during the 12 months preceding the incident.

17. Governing Law and Jurisdiction

This DPA is governed by and construed in accordance with the laws of the People’s Republic of Bangladesh.
Any dispute shall be resolved under the exclusive jurisdiction of the courts in Dhaka, Bangladesh.

18. Contact Information

For all privacy, data protection, or compliance-related matters:

NxtWave Ad Network
Email: privacy@nxtwave.studio
Website: https://nxtwave.studio
Address: Pirganj 5470, Rangpur, Bangladesh

End of Data Processing Agreement (DPA)