Get a free audit
Legal

Data processing agreement

Version 2026-10-05 · updated 5 October 2026. Part of the terms of service.

This data processing agreement is part of the nForce Terms of Service (/terms) between B2B Factory AB (org.nr 559515-4476; "nForce", the processor) and the company that accepted those terms (the "customer", the controller). It meets Article 28 of the EU General Data Protection Regulation (GDPR).

1. What is processed, and why

  1. Purpose and nature: providing the nForce service: reading the customer's LinkedIn ad account, auditing it, planning, writing and building campaigns, and reporting on them, on the customer's instructions.
  2. Personal data: names, email addresses and LinkedIn member ids of the customer's people who use nForce; personal data that appears in ads, creatives or Page posts; and anything else the customer gives nForce.
  3. Not processed: the answers people give in the customer's LinkedIn lead forms. nForce does not read them. Results are read as aggregate counts.
  4. Data subjects: the customer's employees and contractors, and people named or shown in the customer's ads.
  5. Duration: for the term of the agreement and the deletion period after it (section 6).

2. Instructions

nForce processes the personal data only on the customer's documented instructions: the terms, this agreement, and the customer's approvals in the conversation. nForce tells the customer if it believes an instruction breaks data protection law.

3. Confidentiality and security

  1. Only people who need the data to provide the service have access, and they are bound to confidentiality.
  2. nForce keeps the data secure with appropriate technical and organisational measures, including: LinkedIn tokens encrypted with AES-256-GCM, with the key kept apart from the data; transport over HTTPS only; access to stored data limited to nForce's founder; a log of every nForce action; and LinkedIn tokens never sent to an AI model or to the customer's AI assistant.

4. Sub-processors

  1. The customer authorises nForce to use these sub-processors: Netlify (hosting and storage, United States); Anthropic (AI models, United States); Google Workspace (email); Stripe (payments, for billing data); Apify (reads the public LinkedIn Ad Library for the audit, United States); GitHub (stores records from our older sign-up form, United States).
  2. nForce tells the customer by email at least 30 days before adding or replacing a sub-processor. The customer may object on reasonable grounds; if we can't resolve it, the customer may end the agreement without further fees.
  3. nForce binds each sub-processor to data protection terms that protect the data at least as well as this agreement.

5. Transfers outside the EU/EEA

Where personal data is processed outside the EU/EEA, it is protected by the EU's Standard Contractual Clauses or the EU-US Data Privacy Framework, as each sub-processor's data processing terms set out.

6. Deletion

When the customer asks, nForce returns the personal data or deletes it, as the customer chooses, and deletes the data read from the customer's LinkedIn account within 10 days, unless the law requires it to be kept. Without a request, the privacy policy's periods apply: data from the customer's ad accounts 90 days after nForce was last used, the rest 12 months after.

Anonymous benchmarks, combined from at least five other accounts so that no customer or person can be identified, are not personal data; nForce keeps them as its own, as the terms (/terms) describe.

7. Helping the customer

  1. nForce helps the customer answer requests from data subjects (access, correction, deletion and the other GDPR rights) and with data protection impact assessments where needed, as far as its processing is concerned.
  2. nForce tells the customer without undue delay, and where feasible within 72 hours of becoming aware of it, about a personal data breach affecting the customer's data, with the information the customer needs to meet its own obligations.

8. Audits

nForce gives the customer the information needed to show it meets this agreement, first through a written questionnaire. If that is not enough, the customer may audit, or have an independent auditor audit, compliance once a year with 30 days' notice, remotely where possible, at the customer's cost, under confidentiality and without access to other customers' data.

9. Liability and precedence

Liability follows the terms. For personal data, this agreement takes precedence over the terms.