Skip to content

Terms of Service


Last Updated 10/2023

These Terms of Service form an integral part of the Agreement which governs the use of the Service provided by BrandBastion Ltd a Finnish limited liability company with a Finnish business identity code 2570173-5 (“BrandBastion”) to the customer defined in the Order Form (the "Customer"). By signing an Order Form or using the Service, the Customer acknowledges and agrees that the Customer is subject to these Terms of Service and that the Customer accepts these Terms of Service. You hereby warrant to have the required authority to subscribe to the Service on behalf of the Customer and committing to the applicable Service fees on behalf of the Customer.

In case the Customer and BrandBastion already have entered into a separate agreement governing the use of the Service, the terms and conditions in that separate agreement shall apply to the Customer’s use of the Service, where applicable. 


1. Definitions

As used in these Terms of Service, unless expressly otherwise stated or evident in the context, the following capitalized terms shall have the following meaning.

1.1 “Ad Account” means a predefined advertising account registered with BrandBastion and associated with the advertising account(s) on Facebook’s ecosystem, Google’s ecosystem and Twitter.

1.2 “Social media account” means a predefined social media account, such as a Facebook page or an account on Instagram, YouTube, or Twitter, Google or YouTube registered with BrandBastion.

1.3 “Affiliate” means an entity which is a subsidiary or parent of, or under common control with, the Party. For these purposes, an entity shall be treated as being controlled by another if that other entity has fifty (50) percent or more of the voting shares in such entity, or that other entity is able to direct the Party’s affairs or is able to appoint a majority of the members of the board of directors or an equivalent body.

1.4 “Advertising Spend” means all charges payable by the Customer for all advertising conducted with respect to an Ad Account and regardless of whether the Customer conducted advertising campaigns using the Service or not.

1.5 “Agreement” means these Terms of Service together with the Software Order Form and any appendices thereto which shall govern the provision of the Service by BrandBastion and the use of the Service by the Customer.

1.6 “Social media platform” means the social media site known as Facebook and all advertising platforms in Facebook’s ecosystem, including but not limited to, Facebook, Instagram, Messenger, Whatsapp, and Facebook audience network, or Google and all advertising platforms in Google’s ecosystem, including but not limited to, Google Ads, and Youtube, or Twitter and all advertising platforms in Twitter’s ecosystem.

1.7 “Software Order Form” means the agreement through which the Customer orders the Service and which, by reference, incorporates these Terms of Service. In the event of a conflict between these Terms of Service and the Software Order Form or any other appendices thereof, the Software Order Form shall prevail unless expressly stated otherwise in the Terms of Service or any other appendices thereof.

1.8 “Party” means BrandBastion or Customer separately. Customer and BrandBastion together are referred to as the “Parties”.

1.9 “Service” means the provision of BrandBastion’s Software called BrandBastion, available on a software as a service (SaaS) basis via the Internet on BrandBastion’s tool and website and/or by any other means via which the service is made available or can be used as well as any ancillary services that may be available and provided by BrandBastion in relation to the BrandBastion Software.

1.10 “BrandBastion Software” means BrandBastion’s proprietary software, including any changes, updates, upgrades, modifications, and enhancements made thereto, and any related modules, add-ons, tools, browser plugins, and applications as well as any documentation relating thereto all of the foregoing to the extent offered by BrandBastion.

1.11 “Terms of Service” means these terms and conditions applicable to the use of the Service. BrandBastion may update and modify the Terms of Service from time to time and by continuing to use the Service after having been informed of the modification by written notice of BrandBastion, the Customer accepts the modification and the revised Terms of Service shall enter into force after 30 days have elapsed from the notice of revised Terms of Service. All material changes to these Terms of Service shall be informed to the Customer via email prior to them becoming effective.


2. Service

2.1 The Service consists of SaaS social media tools and documentation provided by BrandBastion, and used by Customer via the Internet. The Service may be used by Customer to monitor comments, analyze sentiment, and understand how Customer’s campaigns are being received as well as for other capabilities that will allow Customer to get actionable insights from their comments on social media.          

2.2 The Service is designed to monitor and analyze comments as well as to measure perception of Customers advertising campaigns, but the Customer remains responsible for how the Customer uses the Service and for achieving the intended goals and results of Customer's advertising campaigns. BrandBastion’s Service operates between the Customer and the Social media platform on which the advertising campaigns are being conducted, and it is the responsibility of the Customer to ensure that the output and results of the Service meet Customer's expectations and requirements.

2.3 BrandBastion is entitled to produce the Service as it deems appropriate. The Service and Social media platforms are constantly evolving and, as a result, the features made available on the Service may change. In the event of any substantial or major change to the Service, BrandBastion will inform the Customer on its website at

2.4 The Service does not include, and BrandBastion does not offer, any telecommunication or networking services or equipment, security services or systems, or hardware or other equipment. If Customer requires any of the foregoing, Customer must obtain such systems, services and equipment at its own expense from third party vendors.

2.5 The Customer undertakes not to use the Service for any unlawful purposes. The Customer also undertakes to comply with BrandBastion's reasonable directions and requests related to the Service.

2.6 The Customer is responsible for complying with all laws, rules and regulations applicable to Customer, including all laws, rules and regulations related to advertising and conducting advertising campaigns.


3. Registration, trial period, and analysis

3.1 Unless otherwise agreed, the Customer shall register before commencing the use of the Service, a free trial or an analysis. In connection with the registration, the Customer shall sign up to the Service and authorize BrandBastion’s access to the Customer’s Social media platforms’ ad accounts and social media accounts and to all the information therein and the Customer shall register the Ad Accounts with the Service. BrandBastion shall confirm Customer's registration and the Ad Accounts in due course after having received the registration. The Customer may add and remove Ad Accounts in the Service.

3.2 Free trials are available as agreed between the parties.

3.3 Free analyses are available as agreed between the parties


4. Rights of Use and Proprietary Rights

4.1 Subject to the Customer’s compliance with all the terms of this Agreement, BrandBastion grants to the Customer a non-exclusive, non-transferable, limited right to access and use the Service, against due payment of the agreed fees, solely in connection with the registered predefined Ad Accounts in Social media platforms.

4.2 Customer shall not i) attempt to copy, modify, duplicate, create or prepare derivative works from or based upon, frame, mirror, republish, download, display, transmit or distribute all or any portion of the Service in any form or media or by any means; ii) access all or any part of the Service in order to build a product or service or feature which competes with the Service; iii) attempt to obtain, or assist third parties in obtaining, unauthorised access to the Service; iv) license, sell, rent, lease, transfer, assign, distribute, display, disclose or otherwise make the Service available to any unauthorised third party; or v) reverse engineer, decompile, decode, decrypt, disassemble, or attempt to derive any source code from the BrandBastion Software (except and only to the extent any foregoing restriction is prohibited by applicable law). If Customer grants any subcontractor, supplier, end-customer or other third party any access to the Service, such subcontractor, supplier, end-customer and third party shall be considered equivalent to the Customer for the purposes of these Terms of Service and the Customer shall be fully responsible and liable for all acts and omissions of such subcontractor, supplier, end-customer and third party as well for ensuring their compliance with this Agreement.

4.3 The Customer agrees and acknowledges that the title and all intellectual property rights in and to the Service and any data, documentation, images, and/or BrandBastion Software related thereto are owned and remain vested in BrandBastion or a third party. No intellectual property rights of BrandBastion shall be transferred pursuant to these Terms of Service. BrandBastion agrees that, unless otherwise agreed in this Agreement, Customer-owned materials provided by the Customer to BrandBastion in connection with the Service shall remain the property of the Customer and BrandBastion agrees that the title and all intellectual property rights in and to such Customer-owned materials remain vested in the Customer.

4.4 If the Customer comments the Service or provides suggestions or ideas for improving the Service, notwithstanding anything stated to the contrary in this Agreement, the Customer agrees that all such comments, suggestions and ideas thereof will be fully assigned to BrandBastion and hence BrandBastion shall own all rights to use and incorporate them into its product offerings.

4.5 For the avoidance of doubt, if the Service includes third-party solutions for which the Customer has a direct contractual relationship with the providers of these third-party solutions (such as Facebook or other marketing platform or mobile measurement providers) regardless of anything to the contrary stated herein, their use shall be exclusively governed by their provider's terms and conditions in their standard form, or as negotiated between the Customer and such third party, applicable to such solutions. This Agreement does not modify or amend, and is not in lieu of, any terms, policies or rules of a Social media platform or any other third-party provider used by Customer.

You acknowledge that your use of such Third Party Service is governed solely by the applicable terms and conditions, acceptable use policy, privacy policy, or any other similar policy or terms of such third-party provider (including, but not limited to, the YouTube Terms of Service located at , and the Google Privacy Policy located at ), and that BrandBastion does not endorse, is not liable for and makes no representations as to the third-party provider, its content, or the manner in which such third-party provider uses, stores, or processes your data.


5. Fees

5.1 In case the Customer and BrandBastion already have entered into a separate agreement governing the use of the Service, BrandBastion’s fee and applicable payment terms are defined in that separate agreement.  

5.2 If applicable, BrandBastion’s fee is defined in the Service before the Customer makes the subscription and it will be displayed in the Software Order Form that will be sent to Customer as an email confirmation after a successful subscription. Software Order Forms are typically not provided for trial periods or analyses as no fee is charged. 

5.3 If the Agreement is terminated as described hereinafter in Section 9, at least a monthly minimum fee is charged if the Agreement had terminated before end of the calendar month. BrandBastion makes no refunds for any fees already charged. 

5.4 BrandBastion may change the fees from time to time up on 30 days prior notice. The change shall not affect the fees for invoicing periods commenced before the effective date of the change. In case of a price change the Customer shall be entitled to terminate this Agreement to end on the effective date of the price change by notifying BrandBastion thereof in writing prior to the effective date of the price change.

5.5 The fees for the Service are invoiced monthly (or as agreed upon separately) in advance via credit card.          

5.6 BrandBastion uses the following third-party payment service provider for facilitating credit card payments: Stripe provided by Stripe Payments UK, Ltd. For more information about this payment method and the terms governing its use please visit the Stripe website and Stripe terms and conditions.

5.7 Payments of the Service fees shall be conducted with a valid credit card by submitting the relevant credit card information, as required by the payment method, in connection with the subscription. If a payment cannot be charged successfully, due to e.g. expiration of the registered credit card or insufficient funds and the Customer does not provide valid credit card information, BrandBastion has the right to suspend the Customer’s access to the Service and to terminate the agreement pursuant to section 9.4 of this Agreement.

5.8 The fees are exclusive of VAT and any other governmental taxes and levies. The Customer shall be solely responsible for VAT and other taxes and levies imposed on the Customer by applicable laws and authorities in relation to the fees.


6. Validations

6.1 BrandBastion endeavours to make commercially reasonable efforts to ensure that the Service will be available for use on a 24/7 basis excluding temporary maintenance, updating and repairs. BrandBastion does not assume any liability for usage interruptions or breaks, but it endeavours to inform the Customer of Service issues whenever reasonably possible. BrandBastion does not warrant that the Service will be uninterrupted or error-free. However, BrandBastion agrees to use commercially reasonable efforts to be at Customer's disposal in order to support the Customer and to correct any material error or deficiency in the Service.

6.2 The warranty does not cover errors or deficiencies attributable to (a) changes to the Service made by the Customer which have not been approved by BrandBastion in writing; (b) use of the Service contrary to these Terms of Service, or the written instructions given by BrandBastion; (c) use of the Service contrary to any Social Media platform’s terms and policies; (d) disturbances or interruptions in the Service due to data network; or (e) a service or product not supplied by BrandBastion or other similar reason outside of the Service.

6.3 The Customer acknowledges that the use of the Service is dependent on Social media platforms in which Customer's advertising campaigns are carried out and that the actions of the Customer and third-party data providers may also affect the use of the Service. BrandBastion does not accept any liability for the operation and function of any Customer or third-party products, services, actions or omissions, including, but not limited to, those of third-party data providers, Social media platforms or any third party that operates in or with Social media platforms.



7. IPR Indemnification and Limitation of Liability

7.1 Provided that the Customer remains in compliance with this Agreement, BrandBastion will defend or settle any claim made against the Customer for any intellectual property rights violation relating to the Service arising solely from the actions for which BrandBastion is legally responsible. Customer agrees i) to promptly notify BrandBastion in writing of any such claim, ii) to allow BrandBastion to have sole control over the defence, litigation and/or settlement of any such claim and iii) to cooperate with BrandBastion in the investigation, defence and settlement thereof. BrandBastion shall indemnify Customer for such claim by paying the costs and reasonable attorneys’ fees Customer incurs as a results of such claim, including damages awarded to such third party in a judgment finally awarded against Customer or settlement approved by BrandBastion. If such claim is made or, in BrandBastion's opinion, is likely to be made, then BrandBastion may, at its sole discretion, (i) modify the Service or if it’s not commercially reasonable for BrandBastion to modify the Service, (ii) terminate the Service and/or the Agreement with immediate effect. In no event shall the termination of the Service or the Agreement due to infringement relieve BrandBastion from its obligation to defend and indemnify Customer as set forth herein. BrandBastion shall not settle any claim on behalf of Customer without Customer’s prior written consent if the settlement requires any admission of fault by Customer.

7.2 The Customer shall defend or settle any claim made against BrandBastion, and if applicable, its licensors, and each such Party’s parent organizations, subsidiaries, Affiliates, officers, directors, and employees, if such claim arises out of or in connection with: (a) Customer disrupting the Service in violation of applicable legislation or in violation of Section 4.2 of these Terms of Service; or (b) Customer’s infringement or alleged infringement of any third party’s intellectual property right or (c) the Content. BrandBastion agrees i) to promptly notify the Customer in writing of any such claim, ii) to allow the Customer to have sole control over the defence, litigation and/or settlement of any such claim and iii) to reasonably cooperate with the Customer in the investigation, defence and settlement thereof. The Customer shall indemnify BrandBastion and if applicable, its licensors, and each such Party’s parent organizations, subsidiaries, Affiliates, officers, directors, and employees for such claim by paying the costs and reasonable attorneys’ fees incurred by the foregoing persons or parties as a result of such claim, including damages awarded to such third party in a judgment finally awarded against BrandBastion or settlement approved by the Customer. Customer shall not settle any claim on behalf of BrandBastion without BrandBastion’s prior written consent if the settlement requires any admission of fault by BrandBastion.

7.3 BrandBastion shall have no obligations under this Section 7 to the extent any infringement claim arises from: a) the Customer’s combination of the Service with other software or services or Customer’s modification to any part of the Service or Customer’s violation of Section 4.2 if such claim would not have been made but for Customer’s combination or modification or Customer’s violation of Section 4.2; or b) information or materials provided by the Customer and used by BrandBastion for the performance of the Service in accordance with this Agreement or c) the Content.

7.4 The foregoing remedies constitute Customer’s sole and exclusive remedies and BrandBastion’s entire liability with respect to third party infringement claims.





8. Confidentiality

8.1 Each Party shall keep in confidence all material and information received from the other Party and marked as confidential or which should be understood to be confidential (irrespective of whether so marked or not), and may not use such material or information of the other Party for any purpose other than for the proper fulfilment of the Agreement. The confidentiality and non-use obligations shall not, however, be applied to material and information: (a) which is generally available or otherwise public; or (b) which the receiving Party has received from a third party without any obligation of confidentiality; or (c) which was in the possession of the receiving Party prior to receipt of the same from the other Party without any obligation of confidentiality related thereto or breach of confidentiality obligations.

8.2 Notwithstanding the confidentiality provisions, BrandBastion may collect and analyse the Customer’s Advertising Spend data and trends as well as engagement related data but may only disclose this Customer data if the data is de-identified or if it is not attributable to any individual or company. In addition, BrandBastion may collect, analyze, and use aggregated, de-identified technical data and related information (such as product or feature usage, device metrics/metadata etc.) to facilitate market research and analysis, quality control, product development/improvement and to provide support and maintenance services. BrandBastion may use, store, or disclose such information or material derived from such information, as long as it is in a form that does not identify or is not attributable to any individual or company.

8.3 Each Party shall promptly upon termination of the Agreement (or when the Party no longer needs the material or information in question for the purposes of the Service) cease using confidential material and information received from the other Party and, unless the Parties separately agree on destruction of such material, return the material in question (including all copies thereof). Each Party shall, however, be entitled to retain the copies required by law or regulations and BrandBastion may use information in the connection with Section 8.2.

8.4 The confidentiality and non-use obligations set out herein will remain in force for five (5) years from the disclosure of each respective confidential material and/or information except that the foregoing time limit shall not apply to trade secrets.


9. Term and termination

9.1 In case the Customer and BrandBastion already have entered into a separate agreement governing the use of the Service, the terms and conditions in that separate agreement will apply as regards the term and termination of the subscription of the Service.

9.2 If applicable, the provisions of this section will apply to the term and termination of the      Agreement. 

9.3 Customer may terminate the Agreement and the use of the Service with immediate effect at any time by terminating the subscription in the Service, in which case BrandBastion shall send the Customer a written confirmation regarding termination without undue delay.

9.4 BrandBastion may terminate the Agreement and the use of the Service for convenience upon 30 days prior written notice by email and in the Service.

9.5 Either Party may terminate this Agreement with immediate effect if the other Party is in material breach of its obligations hereunder and fails to remedy such breach within 14 days written notice given by the non-breaching Party.

9.6 Upon expiration or termination of this Agreement, the Customer is obliged to cease the use of the Service and shall return or, upon BrandBastion’s request, destroy BrandBastion’s material in its possession and upon BrandBastion's request confirm in writing that it has complied with the aforesaid.

9.7 Upon termination for whatever reason, no paid fees will be returned by BrandBastion, and the Customer is obliged to pay the fees past due at the effective date of such termination. In the event that fees are not fully paid when due or the obligations set out in this Agreement are not otherwise followed by the Customer, BrandBastion reserves the right to terminate the Customer’s right to use the Service with immediate effect. 


10. Processing of data

10.1 The Customer expressly acknowledges and agrees that it is Customer's obligation to observe and to comply with any and all privacy and data protection laws (including but not limited to EU General Data Protection Regulation, 2016/679, GDPR), regulations and terms applicable to information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context (“Personal Data”) contained in the materials provided by the Customer for the purposes of the Service regardless of the country/state in which the Customer is based. The above mentioned includes, but is not limited to, complying with terms and restrictions related to Customer's use of customer/contact databases and complying with any applicable privacy policies and cookie opting policies.

10.2 In the event that (i) BrandBastion in connection with the Service processes Personal Data as a processor on behalf of the Customer and (ii) the applicable legislation (such as the GDPR) requires Parties to put in place a data processing agreement (DPA) to govern such data processing, the Data Processing Policy (DPP) attached to these Terms of Service as Annex A shall apply. In such event, the DPP set forth in Annex A forms an integral part of the Agreement and shall be applied to the processing of Personal Data by BrandBastion as a processor.

10.3 BrandBastion may collect and process Personal Data regarding Customer’s personnel and/or other representatives of the Customer using the Service for the Customer. Such processing is described in BrandBastion’s Privacy Policy, the current version of which is available on BrandBastion’s website. The Customer shall ensure that its employees and representatives engaging with the Service are informed about the contents of BrandBastion Privacy Policy.


11. Applicable law and dispute resolution

11.1 This Agreement will be governed by the laws of Finland excluding its provisions relating to the choice of law.

11.2 Any dispute, controversy or claim arising out of or relating to this Agreement, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The proceedings shall take place in the English language in Helsinki, Finland.

11.3 Existence of arbitral proceedings, the proceedings, any material presented or drafted in relation to the proceedings and the verdict shall be considered as confidential information under this Agreement.

11.4 Nothing in this Agreement shall be deemed to limit BrandBastion’s rights to seek interim injunctive relief or to enforce an arbitration award in any court of law. With respect to any violation by the Customer of any intellectual property rights and/or confidential information of BrandBastion and/or payment obligations under this Agreement, BrandBastion shall have the right, at its sole discretion, to seek remedies in public courts within any applicable territory.


12. General Provisions

12.1 BrandBastion is entitled to change the working methods, hardware, data communication links, software, user interface or other system components used in providing the Service. BrandBastion may also use subcontractors.

12.2 BrandBastion is entitled to use Customer's name and logo as a reference for advertising purposes.

2.3 Neither Party may assign this Agreement without other Party’s prior written consent. Parties shall, however, be entitled to assign this Agreement in whole or in part to its Affiliates and in the connection with a merger or acquisition process including but not limited to the transfer of business and/or any other corporate transaction or restructuring.

12.4 No provision or right under this Agreement shall be considered waived without an explicit written statement or agreement signed by the waiving Party in each specific case. A waiver of any term, provision or right under this Agreement shall not be construed as a waiver of any other term, provision or right hereunder. 

12.5 Neither Party shall be liable to the other for any failure to perform any of its obligations (except payment obligations) under this Agreement during any period in which such performance is delayed by circumstances beyond its reasonable control, such as fire, flood, war, embargo, strike, riot, terrorism, or the intervention of any governmental authority (a “Force Majeure”). In such event, however, the delayed Party must promptly provide the other Party with written notice of the Force Majeure. The delayed Party’s time for performance will be excused for the duration of the Force Majeure.

12.6 Unless the Customer and BrandBastion already have not entered into a prior agreement governing the use of the Service, this Agreement and the information submitted by the Customer during the registration process for the Service constitute the entire agreement with respect to its subject matter and replaces and supersedes any prior written and/or verbal communications.

12.7 If any provision herein is held to be invalid or unenforceable to any extent, then such provision will be interpreted, construed and reformed to the extent reasonably required to render it valid, enforceable and consistent with its original intent.

12.8 Headings in these Terms of Service are for convenience of reference only and shall in no way affect interpretation of the Agreement.


Annex A - BrandBastion Data Processing Policy


The General Data Protection Regulation (“GDPR”) is a set of privacy rules which has replaced the Data Protection Directive in May 2018. The purpose of BrandBastion’s Data Processing Policy (“Policy”) is to explain how BrandBastion collects, processes and protects client data and how BrandBastion intends to comply with the GDPR.

BrandBastion regards the lawful and correct processing and treatment of personal data as very important to successful business operations and to maintaining confidence with clients, partners and internal and external stakeholders. BrandBastion is committed to ensure that personal data is processed lawfully and in an appropriate manner in all its operations.

All user-generated content received across defined accounts and platforms is accessed in real time BrandBastion will take the following actions:

  • Gathering and aggregating data for the purposes of social media analytics, data visualization, or social media listening reports     
  • Sending email notifications set up by the user on the platform
  • Showing what actions BrandBastion is taking (removing harmful content, sending alerts, responding to client inquiries) as per separate agreement, for Moderation and Responding subscribers.

Under these services, BrandBastion:

  • Utilizes the APIs available on each social media platform to extract the user-generated content posted on the client accounts that BrandBastion’s application has been authorized on or extracting user-generated content based on agreed upon parameters
  • The user-generated content is run through BrandBastion’s system for processing, whereupon the user-generated content is processed by BrandBastion.

BrandBastion as a data controller and data processor

In order to provide the Services, BrandBastion may process personal data on behalf of the Customer      as data processor for the purposes of providing the Services.

BrandBastion processes certain personal data relating to the Customer relationship as data controller. Such personal data includes, inter alia, name and contact details of the Customer’s contact persons, invoicing details and other personal data of Customer’s contact persons which BrandBastion processes in order to maintain the Customer relationship.

In this section, “Personal Data” refers to any information relating to an identified or identifiable natural person BrandBastion has access to via the Services and processes on behalf of the Customer in the course and within the scope of providing the Services.

In connection with the use of the Services, BrandBastion may process various data on behalf of the Customer. Such data might include Personal Data. The Customer shall be considered as the sole data controller and BrandBastion as the data processor with respect to such data. The following terms and conditions set forth in this section concern the data processing activities of BrandBastion as data processor with respect to the Personal Data it processes on behalf of the Customer.

General requirements relating to processing of Personal Data

The Customer shall be responsible for the lawful collection, processing and use, and for the accuracy of the Personal Data, as well as for preserving the rights of the individuals concerned. If and to the extent legally required, the Customer shall inform the individuals concerned regarding the processing of their Personal Data by BrandBastion, and shall obtain their consent if necessary.

The Personal Data processed by BrandBastion on behalf of the Customer may include e.g. Personal Data of the users of Customer’s social media accounts (“Users”), such as names, profile pictures and usernames of the Users as well as user-generated content such as comments that the Users leave on the Customer’s social media properties or social media platforms at large if covered by BrandBastion’s services.

The Customer acknowledges that due to the nature of the Services, BrandBastion cannot control and has no obligation to verify Personal Data BrandBastion processes on behalf of the Customer when the Customer uses the Services. The Customer ensures that BrandBastion may lawfully process the Personal Data on behalf of the Customer in accordance with this Agreement.

BrandBastion shall not use Personal Data for any purpose other than that of rendering and providing the Services and will not assert liens or other rights over, or sell or disclose the Personal Data to any third parties, without the Customer’s prior written approval. BrandBastion shall process Personal Data in accordance with this Agreement and documented instructions from the Customer. The Customer’s instructions must be commercially reasonable, compliant with applicable data protection laws and consistent with this Agreement. BrandBastion shall not be obliged to verify whether any instructions given by the Customer are consistent with applicable laws, as the Customer is responsible for such compliance verification of its instructions. However, if BrandBastion detects that any instruction given by the Customer is non-compliant with the requirements of any data protection legislation applicable to BrandBastion’s operations, BrandBastion shall inform the Customer of this in writing (email will suffice).   

BrandBastion and the Customer shall comply with EU Regulation 2016/679 (“GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“Regulation”) and any applicable European or foreign data protection laws as amended.

BrandBastion and the Customer shall implement and maintain appropriate technical and organizational security measures to protect the Personal Data within their area of responsibility, in order to safeguard the Personal Data against unauthorized or unlawful processing or access and against accidental loss, destruction or damage. Such measures include where necessary and appropriate, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons the following measures:

  • access right controls to systems containing Personal Data;
  • the pseudonymization and encryption of Personal Data;
  • the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
  • the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
  • a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

When BrandBastion provides certain regular reports to the Customer, the Personal Data shall primarily be in pseudonymized format. BrandBastion and the Customer may separately agree on the scope and extent of the pseudonymization.

BrandBastion’s assistance obligations

In order to assist the Customer to respond to requests from individuals exercising their rights as foreseen in applicable data protection law, such as the right of access and the right to rectification or erasure, BrandBastion shall provide the Customer with commercially reasonable assistance, without undue delay, taking into account the nature of the processing. BrandBastion shall further provide the Customer with commercially reasonable assistance in ensuring compliance with the Customer’s obligations to perform security and data protection assessments, breach notifications and prior consultations of the competent supervisory authority, as set out in the applicable data protection law, taking into account the nature of the processing and the information available to BrandBastion. In case such assistance requires extensive measures from BrandBastion, the Customer shall pay additional reasonable remuneration to BrandBastion for handling such assistance requests (additional remuneration can be agreed upon in writing via email).

In addition, BrandBastion shall, and shall procure that its personnel (including its subcontractors’ personnel) shall:

  • only process Personal Data in accordance with the Customer’s written instructions and not for BrandBastion’s own purposes;
  • ensure that individuals processing Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Transfers of Personal Data

The Customer accepts that BrandBastion may have Personal Data processed and accessible by its subprocessors outside the Customer’s country of domicile to provide the Services. In case the processing is subject to any EU data protection law and Personal Data is transferred from the European Economic Area (“EEA”) to a subprocessor for processing in any country outside the EEA that is not recognized by the European Commission as providing an adequate level of protection for personal data, BrandBastion provides for appropriate safeguards by standard contractual clauses, adopted or approved by the European Commission and applicable to the processing by the non-EEA subprocessor or by any other appropriate safeguard as foreseen under Regulation.


The Customer shall have the right to audit the facilities and processing activities of BrandBastion under this Agreement to examine the level of protection and security provided for Personal Data processed under this Agreement and to assess the compliance of BrandBastion with the terms and conditions relating to Personal Data set out herein. Each Party shall bear its own costs for any such audit.

Where an audit may lead to the disclosure of business or trade secrets of BrandBastion or threaten intellectual property rights of BrandBastion, the Customer shall employ an independent expert to carry out the audit, and the expert shall agree to be bound to confidentiality to BrandBastion’s benefit.


General authorization. The Customer gives its general authorization to allow BrandBastion to involve BrandBastion’s affiliated companies and other subcontractors as subprocessors to process Personal Data in connection with the provision of the Services, to the extent such appointment does not lead to non-compliance with any applicable law or BrandBastion’s obligations under this Agreement. BrandBastion ensures that the involved subprocessors are properly qualified, will be under a data processing agreement with BrandBastion, and comply with data processing obligations similar to the ones which apply to BrandBastion under this Agreement. BrandBastion shall be liable towards the Customer for the processing of Personal Data carried out by BrandBastion’s subprocessors.

Change of subprocessor. BrandBastion is free to choose and change its subprocessors. Upon Customer’s written request, BrandBastion shall inform the Customer of subprocessors currently involved. In case there is a later change of subprocessor (addition or replacement), BrandBastion shall notify the Customer of such change. In case the Customer      objects such change of subprocessor on reasonable grounds, the Customer has the right to request change of the subprocessor.



BrandBastion shall, without undue delay after having become aware of it, inform the Customer      in writing about any data breaches relating to Personal Data and any other events where the security of Personal Data processed on behalf of the Client has been compromised. BrandBastion’s notification about the breach to the Client shall include at least the following:

  • description of the nature of the breach;
  • name and contact details of BrandBastion’s contact point where more information can be obtained;
  • description of the measures taken by BrandBastion to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.


Deletion and return of Personal Data

Personal Data shall be processed under this Agreement until the Customer has ceased to use the Services.

Within a reasonable time after the termination or expiry of this Agreement, or after the Customer has permanently ceased to use the Services, BrandBastion shall permanently delete Personal Data from its storage media, except to the extent that BrandBastion is under a statutory obligation to continue storing such Personal Data. On the Customer’s request, BrandBastion shall confirm the deletion in writing (email will suffice). The obligation to delete Personal Data shall not apply to Personal Data contained in regular back-up copies of comprehensive datasets from which the individual deletion of Personal Data would not be possible without significant efforts or costs.