Joint Controller Arrangement
The Article 26 arrangement between Encore and each publisher, covering the serving of third-party offers. Published in full, because Article 26(2) requires its essence to be available to the people it concerns.
Version 1.0 · Effective 20 August 2026
Who this applies to
This Arrangement applies to every publisher that integrates the Encore SDK, and is incorporated into the Encore terms of service. It is not optional and does not need to be requested.
That is deliberate. Whether a given publisher has users in the EU, EEA or UK is a fact neither party reliably knows in advance — Encore resolves a user's country from their IP address at the moment of a request, and app stores distribute to European territories by default. An arrangement that only existed for publishers who asked for one would be missing precisely where it was needed.
Encore is Peach Works, Inc, a Delaware corporation trading as Encore.
Who does what
Article 26(1) requires the parties to determine their respective responsibilities in a transparent manner. In summary:
| Obligation | Responsible |
|---|---|
| Informing end users (Art. 13/14) | Publisher |
| Honouring objection to direct marketing (Art. 21(2)) | Publisher |
| Access, erasure and portability (Art. 15–20) | Either — executed by Encore for data Encore holds |
| Declaring the app's audience | Publisher, verifiable by Encore |
| Security of processing (Art. 32) | Each party, for its own systems |
| Breach notification (Art. 33/34) | Notifying party informs the other within 24 hours |
Allocation determines who acts first. It does not limit a data subject's right under Article 26(3) to approach either party.
Terms
1. Joint controllership and scope
For Offer Serving — the selection and presentation of a third-party offer following a trigger in the Publisher's application — the parties are joint controllers within the meaning of Article 26 GDPR.
Encore determines the campaign catalogue, the eligibility rules and the ranking method, none of which the Publisher designs or sees, and processes for its own commercial purpose. The Publisher determines whether, where and when the SDK is invoked, and to which of its users. Neither party processes Offer Serving data solely on the other's documented instructions.
This Arrangement does not alter the parties' roles for any other processing. Encore acts as a processor for entitlement delivery under the Data Processing Agreement, and as a controller for Publisher portal accounts and for visitors to its own website.
2. Transparency to data subjects
The Publisher shall make the information at Schedule 2 available to end users before or at the time of the first offer presentation, in its own privacy notice or an equivalent surface, and shall keep it current.
The Publisher shall not represent that Encore acts as a processor, service provider or vendor in respect of Offer Serving.
Encore shall make the essence of this Arrangement available to data subjects by publishing it at a public address, which it does by means of this page.
3. Objection to direct marketing (Article 21(2))
The Publisher shall operate a mechanism by which an end user may object to direct marketing, and that mechanism shall extend to third-party offers served through the Encore SDK. Where a user has objected, the Publisher shall not invoke the SDK in respect of that user.
The Publisher acknowledges that a mechanism limited to the Publisher's own communications does not satisfy this clause. The right under Article 21(2) is absolute and admits no balancing.
4. Data subject requests received by either party
Each party shall inform the other within five business days of any data subject request, complaint or supervisory authority contact concerning Offer Serving, and shall provide the other with reasonable assistance in responding.
Neither party shall refuse or defer a request on the ground that responsibility for it is allocated to the other. Article 26(3) permits a data subject to exercise their rights against each controller irrespective of the terms of this Arrangement, and this Arrangement does not purport to limit that.
Encore executes access, erasure and portability requests for the data it holds, across both its application database and its analytics store, and discloses in its response where a record cannot be shown to be exhaustive.
5. Children's audiences
The Publisher shall declare, and keep current, whether each application is directed at children or likely to be accessed by them, together with the minimum age of its expected audience.
Encore may make its own assessment of an application's audience. Where Encore's assessment is stricter than the Publisher's declaration, the Publisher may not relax it; the Publisher may at any time declare a stricter classification than Encore has assessed.
The Publisher shall notify Encore before relocating the SDK to a different surface within an application, since the audience reachable at a given surface is a fact only the Publisher holds.
6. Security and personal data breach
Each party shall implement appropriate technical and organisational measures under Article 32 in respect of the systems it controls. Neither party warrants the security of the other's infrastructure.
A party becoming aware of a personal data breach affecting Offer Serving data shall inform the other without undue delay and in any event within 24 hours, with sufficient information for the other to meet its own obligations under Articles 33 and 34. The 24-hour period exists so that neither party's 72-hour notification clock is consumed by the other's delay.
7. Transfers, duration and precedence
Offer Serving data is processed in the United States. Transfers are made under the Standard Contractual Clauses and, for UK data subjects, the UK International Data Transfer Addendum, as incorporated by the Data Processing Agreement.
This Arrangement takes effect on the Publisher's acceptance of the Encore terms of service and continues for as long as Offer Serving is performed. Clauses 4 and 6 survive termination for as long as either party holds Offer Serving data.
Where this Arrangement conflicts with the Data Processing Agreement in respect of Offer Serving, this Arrangement prevails. In respect of all other processing, the Data Processing Agreement prevails.
Schedule 1 — the processing
Purpose. To select and present a third-party offer when an end user reaches a trigger in the Publisher's application, and to ensure each user can redeem each offer only once. Preventing repeat redemption is simultaneously the attribution mechanism and the fraud control.
Data subjects. End users of the Publisher's application.
Personal data. An identifier for the user within the application, supplied by the Publisher or generated by the SDK where the Publisher supplies none; device model, platform and SDK version; an IP address, resolved to a country in memory and not stored. Where the Publisher chooses to send them, a country code and a language.
No profiling. The identifier is used to exclude offers already redeemed, to apply trial limits and to attribute completed offers. It is not an input to the selection of which offer is shown. Ranking uses aggregate statistics at the level of the application, with no per-user input, so nothing evaluates or predicts personal aspects of an individual within the meaning of Article 4(4).
Lawful basis. Legitimate interests, Article 6(1)(f), in operating the service and in preventing fraud. Recital 47 expressly recognises fraud prevention as a legitimate interest.
Retention. Application data for the life of the account plus 30 days, enforced by a scheduled job. Analytics records under a 25-month expiry. In backups, restore points are retained for 7 days and any residual object is deleted at 30 days — the latter being the longest personal data can persist anywhere, and so the binding constraint on any erasure timescale.
Schedule 2 — information for end users
This is the information the Publisher makes available under clause 2. Publishers can take the drafted wording, ready to paste, from the publisher guide.
- That a third party, Peach Works, Inc trading as Encore, selects and delivers the offers, acting as a joint controller.
- What Encore receives, and what it does not receive.
- What Encore does with it, and that it does not build a profile or use personal data to choose which offer is shown.
- That Encore relies on legitimate interests, and that a copy of its balancing assessment may be requested.
- How long the data is kept.
- How to object, and how to reach both parties — Encore at admin@encorekit.com.
Contact
Questions about this Arrangement, or requests under it, go to admin@encorekit.com. Data subjects may contact us directly and need not go through the publisher first.