Data Transfer Agreement
This Data Transfer Agreement (“Exhibit 2”) forms an integral part of the Adryse Publisher Terms of Service and governs the flow of personal data generated by visitors to the publisher's channels when they interact with Adryse tracking links. Adryse is operated by Idealy AB (org. nr 556880-7464), Saturnusvägen 70, 352 64 Växjö, Sweden.
1. Purpose and scope
This Exhibit sets out the terms under which the publisher and Adryse exchange and process personal data relating to visitors whose interactions with Adryse tracking links generate click, attribution, or conversion events.
Personal data about the publisher itself — name, contact, tax identifiers, payout information — is covered separately by the Publisher Data Processing Agreement (Exhibit 1), under which Adryse acts as controller. This Exhibit does not cover that flow.
2. Definitions
“Personal data”, “processing”, “controller”, and “processor” have the meanings set out in the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”).
“Visitor” means an end user who visits the publisher's channel and interacts with an Adryse tracking link.
“Click” means an individual interaction by a Visitor with an Adryse tracking link, as recorded by the Adryse tracker at track.adryse.net.
“Transferred data” means the personal data described in Section 5 of this Exhibit, exchanged between the parties in connection with Clicks, attribution, and conversion reporting.
3. Controllership
Each of the publisher, Adryse, and any brand participating in the Adryse network acts as an independent controller in relation to Transferred data. None of the parties assumes the role of processor in respect of the others under this Exhibit unless expressly agreed in writing.
Where the parties determine the purposes and means of processing jointly in respect of a specific activity — for example, a dispute investigation — they may agree in writing to a joint-controller arrangement for that activity only. In the absence of such an agreement, independent controllership applies.
4. Representations and warranties
Each party warrants to the other that:
- it will process Transferred data solely in accordance with Applicable Data Protection Law and this Exhibit;
- it will limit processing to what is necessary to provide, measure, and administer the affiliate relationship;
- it will not transfer Transferred data to third parties except as expressly permitted by this Exhibit or as required by law;
- it will maintain appropriate technical and organisational measures to protect Transferred data;
- it will obtain and maintain any Visitor consents required by Applicable Data Protection Law in the jurisdiction where the Visitor is located, including cookie consent and ePrivacy consent where applicable.
5. Data transferred from publisher to Adryse
When a Visitor clicks an Adryse tracking link on the publisher's channel, the Visitor's browser makes an HTTP request to track.adryse.net. Adryse records the following information about that request:
- SHA-256 hash of the Visitor's IP address, salted with a rotating server-side secret. The raw IP address is never stored. The hash is irreversible without the current salt, which Adryse rotates periodically.
- SHA-256 hash of the Visitor's User-Agent header, salted with the same rotating secret.
- Country code (ISO 3166-1 alpha-2), derived from the Visitor's IP address by Cloudflare at the edge. The raw IP address is not retained after country derivation.
- Referrer host (e.g.
example-blog.se), truncated to host only. Full referrer URLs, paths, and query strings are never stored. - Timestamp of the request (UTC).
- Tracking identifiers: channel id, creative id, brand id, publisher organisation id, and (where applicable) a publisher-supplied deep-link target URL validated against the brand's allowlist.
Adryse does not set browser cookies as part of click tracking. Attribution is performed server-side using the tracking identifiers above.
The raw IP address and User-Agent string are processed in memory at the edge for the limited purpose of computing the salted hashes listed above, and are not persisted to Adryse storage at any point.
5.1 Retention
Click records are retained for 90 days rolling. After 90 days, source click rows are aggregated into daily counters per brand, publisher, channel, and country, and the source rows are deleted. The aggregated counters do not qualify as personal data under the GDPR.
6. Data transferred from Adryse to the publisher
Adryse surfaces aggregate and individual click data to the publisher through the Adryse dashboard. Per-click data visible to the publisher is limited to:
- Click timestamp;
- Destination brand;
- Publisher channel;
- Creative used;
- Country code;
- Referrer host.
The publisher may not use this data to attempt to re-identify an individual Visitor, combine it with data from other sources to re-identify, or resell it.
7. Data transferred from Adryse to brands
To enable conversion attribution and dispute investigation, Adryse shares the following tracking identifiers with the destination brand when a conversion event is posted back or claimed:
- Click id;
- Click timestamp;
- Publisher organisation id;
- Channel id;
- Creative id;
- Country code;
- Referrer host;
- Deep-link target URL where the Visitor explicitly clicked a deep-linked tracking URL.
Brands receive no hashes of Visitor IP addresses or User-Agent strings from Adryse. Brands may collect their own Visitor data once the Visitor lands on the brand's own site, under the brand's own privacy policy and lawful basis.
8. Consent obligations
The publisher is responsible for obtaining any Visitor consent required by Applicable Data Protection Law and the ePrivacy Directive in the jurisdiction where the Visitor is located, including cookie-banner consent for trackers used on the publisher's channel unrelated to Adryse.
Adryse's own tracker does not set browser cookies and therefore does not require a Visitor cookie consent. However, the publisher must ensure that any embedded Adryse tracking link is accompanied by sufficient disclosure under applicable marketing and consumer-protection law (for example, in Sweden, Konsumentverket's guidance on influencer marketing and Marknadsföringslagen).
9. Cooperation and assistance
Each party will provide reasonable and timely assistance to the other in complying with Applicable Data Protection Law, including in relation to:
- Requests from data subjects exercising their rights under the GDPR;
- Inquiries, audits, or investigations by supervisory authorities;
- Personal data breach notification and incident response;
- Data protection impact assessments, where the processing is likely to result in high risk to the rights and freedoms of natural persons.
Each party will bear its own costs of compliance unless otherwise agreed in writing.
10. International transfers
Transferred data is primarily stored in the European Economic Area (EEA). Where an Adryse sub-processor transfers Transferred data outside the EEA, Adryse relies on the European Commission's Standard Contractual Clauses (2021/914) or an applicable adequacy decision. Current sub-processors are listed in the Publisher Data Processing Agreement and the Privacy Policy.
11. Indemnification
Each party will indemnify, defend, and hold harmless the other party from and against any direct damages, fines, or costs (excluding indirect or consequential losses) arising out of a material breach by the indemnifying party of this Exhibit or of Applicable Data Protection Law in respect of Transferred data, subject to the indemnification procedure and liability limitations set out in the Publisher Terms of Service.
12. Amendments
Adryse may amend this Exhibit from time to time, including where necessary to reflect changes in Applicable Data Protection Law or in the technical architecture of the Adryse tracker. Material amendments will be communicated to publishers at least 30 days before they take effect, via email to the address registered to the publisher's account and through in-platform notification.
13. Duration
This Exhibit takes effect upon the publisher's acceptance of the Publisher Terms of Service and remains in force for as long as either party processes Transferred data.
14. Governing law and jurisdiction
This Exhibit is governed by Swedish substantive law. Disputes arising from or in connection with this Exhibit fall within the exclusive jurisdiction of Växjö tingsrätt as the court of first instance, subject to any mandatory consumer protection jurisdictions available to natural-person publishers under Applicable Data Protection Law.
15. Contact
Questions about this Exhibit can be sent to:
Idealy AB
Saturnusvägen 70
352 64 Växjö
Sweden