Data processing agreement

Processing of personal data about visitors to the Controller’s websites and the Controller’s customers, to provide analytics, revenue attribution, identity resolution, AI-generated insights and related features, for as long as the Controller uses the Service plus the deletion period in section 9.

Data subjects: website visitors, the Controller’s customers and leads, and the Controller’s staff who use the Service.

Categories: online identifiers (cookie IDs, hashed IP addresses), device and browser data, approximate location, browsing and interaction events, campaign data, email addresses and names provided by the Controller, payment and subscription records (no card numbers), and CRM deal records. No special-category data is intended to be processed; the Controller must not send it.

The Processor will: process personal data only on documented instructions from the Controller (these terms and the Controller’s configuration of the Service); ensure staff with access are bound by confidentiality; implement the security measures in section 6; assist the Controller with data subject requests and with data protection impact assessments where reasonably needed; notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach; and make available information needed to demonstrate compliance, including responding to reasonable audit requests once a year.

The Controller authorises the subprocessors below. The Processor will give at least 30 days’ notice of new subprocessors by email and on this page; the Controller may object on reasonable data protection grounds and, if no solution is found, terminate the affected service.

Geolocation uses a database hosted on Kratly’s own servers; no visitor data is sent to its publisher. Advertising platforms and CRMs are contacted only with credentials the Controller connects and act as the Controller’s own providers.

Transfers outside the EEA or UK are made under the Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK addendum, which are incorporated by reference. [Confirm with counsel.]

TLS for all traffic; AES-256-GCM encryption of stored credentials; bcrypt password hashing; hashed single-use tokens; IP addresses never stored in raw form; role-based access control per site with owner, admin, member and viewer roles; audit logging of sensitive actions; least-privilege database accounts; separation of customer data by site; regular backups with tested restores; prompt security patching; and access to production limited to authorised personnel.

The Controller is responsible for the lawfulness of the data it sends, including notices and consent for visitors, and for configuring consent or cookieless modes where required.

Questions to the AI assistant, and the aggregated or record-level data needed to answer them, are sent to the AI subprocessor solely to produce the answer. Customer data is not used to train AI models.

The Controller can export data as CSV at any time while the account is active. Within 30 days of account closure, the Processor deletes Customer Data, except where retention is required by law; backups roll off within [35] days.