Data Processing Addendum

Effective [EFFECTIVE DATE]

This addendum is part of the Terms of Service between [COMPANY LEGAL NAME] ("Processor") and the Customer ("Controller"). It applies where the Processor processes personal data on the Controller's behalf in providing the Service, and meets Article 28 of the GDPR and of the UK GDPR, and equivalent laws.

1. Subject matter, nature and purpose

Device identification and the detection of automation, fraud and abuse on the Controller's sites and apps, and the reporting of its results to the Controller, for the duration of the agreement.

2. Categories of data subjects and of data

Data subjects: visitors to and users of the Controller's sites and apps; the Controller's staff who use the dashboard.

Personal data: IP addresses, or keyed digests of them where the Controller chooses; request headers and TLS characteristics; device and browser characteristics and the visitor identifiers derived from them; interaction timing and movement (never typed content); and what the Controller sends for an assessment — account identifiers, email addresses, card fingerprints, phone numbers, messages — which are processed as keyed digests or sketches and not stored as sent.

No special categories of data are processed, and the Controller does not send them.

3. The Processor's obligations

The Processor:

1. processes the data only on the Controller's documented instructions — these terms, the integration and the settings the Controller chooses — including for transfers, unless the law requires otherwise, in which case it tells the Controller first where it may;
2. ensures the people who process it are bound to confidentiality;
3. takes the measures in Annex 1;
4. engages sub-processors only as section 4 provides;
5. assists the Controller, by the Service's own features (export, deletion, the per-visitor erasure endpoint) and otherwise, with requests from data subjects and with security, breach notification, impact assessments and consultations;
6. notifies the Controller of a personal data breach without undue delay, and in any case within [48] hours of becoming aware of it, with what it knows and as it learns more;
7. deletes the data at the end of the agreement — the Controller can export it before — within [30] days, and from backups as they expire, unless the law requires it be kept;
8. makes available the information needed to show compliance with this addendum, and allows audits by the Controller or an auditor it mandates, on reasonable notice, no more than once a year unless a breach or a regulator requires it; and
9. tells the Controller if, in its opinion, an instruction infringes the law.

4. Sub-processors

The Controller authorises the sub-processors listed at [SUBPROCESSORS URL]: [HOSTING PROVIDER] (hosting and the databases); an IP geolocation provider, where the Service looks visitors' addresses up with one rather than in databases on its own servers — [IP GEOLOCATION PROVIDER: ipinfo.io, or ipapi.co; none], which receives the address alone; and, for the Processor's own operations, Stripe and Resend. Where the Controller has the Service read its Android apps' Play Integrity verdicts with a Google service account of its own, the verdict tokens go to Google under the Controller's own agreement with it, not as the Processor's sub-processor. The Processor gives at least thirty days' notice of a new sub-processor, during which the Controller may object on reasonable grounds; if no solution is found, the Controller may terminate the affected Service. The Processor holds each sub-processor to obligations no less protective than these and remains responsible for it.

5. Location and transfers

The Controller's data is stored and processed in the region it chose at sign-up — United States, European Union or Asia-Pacific — and not moved out of it, but for a visitor's address sent to the IP geolocation provider, where the Service uses one (section 4). Keyed digests of the email addresses of the Controller's own users, by which signing in finds their region, are held in [DIRECTORY REGION, e.g. the United States] for the Processor's own operations. Where personal data is nonetheless transferred out of the European Economic Area, Switzerland or the United Kingdom, the European Commission's standard contractual clauses (Module 2, controller to processor, and Module 3 where onward), with the UK addendum, are incorporated by reference, with this addendum supplying their annexes.

6. Liability

As set out in the Terms of Service.

Annex 1 — Technical and organisational measures

• Encryption in transit (TLS) everywhere, and at rest by the database provider; results the Controller asks to be sealed are encrypted with its own key.
• Secrets never stored: API keys, session tokens, invitation and email links are stored only as hashes; passwords as salted scrypt hashes.
• Access: role-based access within each organization; two-factor sign-in (authenticator apps, passkeys) and single sign-on available and enforceable; every security-relevant action in an audit log the Controller can read.
• Minimisation: IP addresses can be kept only as keyed digests; assessed identifiers and messages are processed as keyed digests or sketches; retention is set by the Controller, from one day.
• Isolation: each organization's data is separated by organization and environment in every query; data regions are separate deployments with separate databases.
• Resilience: the integrations fail open, so an outage does not take the Controller's sites down; backups and point-in-time recovery by the database provider.
• Testing: automated tests of tenancy, access control and the detection pipeline on every change, and independent reviews of security-relevant code.