1. Purpose

This policy outlines how Fractal Communications (“the Agency”) complies with the General Data Protection Regulation (GDPR) when handling personal data on behalf of its clients. As an agency, we act solely as a data processor and process personal data only under the documented instructions of our clients, who act as data controllers.

2. Scope

This policy applies to all employees, contractors, and subcontractors of Fractal Communications who may process personal data on behalf of our clients in the course of delivering marketing, advertising, and related services.

3. Our Role as a Data Processor

We do not collect personal data for our own purposes. We process personal data only as instructed by our clients, in accordance with written contracts and Data Processing Agreements (DPAs).

We do not sell, share, or repurpose any client data for unrelated purposes.

4. Data Processing Principles

When processing personal data on behalf of a client, we ensure that:

5. Security Measures

We maintain appropriate technical and organizational measures to protect personal data, including:

6. Subprocessors

We may engage third-party subprocessors (e.g., advertising platforms, analytics providers) to deliver services. All subprocessors must be GDPR-compliant and under contract to process personal data only according to our client’s instructions.

We maintain a list of subprocessors used for each client and will inform clients of any intended changes.

7. Data Subject Rights

As a processor, we assist our clients in responding to requests from data subjects, including:

8. Data Breach Notification

In the event of a personal data breach involving client data, we will:

9. International Data Transfers

If client data is transferred outside the EU/EEA, we ensure that appropriate safeguards are in place (e.g., Standard Contractual Clauses) as instructed by the client.

10. Policy Review

This policy is reviewed annually or when significant changes occur in our services, operations, or applicable legislation.