Nuestro acuerdo de tratamiento de datos

Definitions

• Data Protection Law means the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it applies in the United Kingdom ("UK GDPR"), the Swiss Federal Act on Data Protection, and the US state consumer privacy laws, such as the California Consumer Privacy Act ("CCPA"), as far as each applies to the processing.
• Customer Personal Data means the personal data described in Details of the processing that we process on your behalf.
• Sub-processor means a third party we engage to process Customer Personal Data.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Controller", "processor", "data subject" and "processing" have the meanings given in the GDPR.

Roles of the parties

For Customer Personal Data, you are the controller and TermsFeed is your processor. For the personal data of your account and billing, TermsFeed is the controller, and our Privacy Policy applies instead of this DPA.

Details of the processing

• Subject matter and purpose: serving your consent banners and recording your visitors' consent choices, so you can respect and prove them; counting the page loads of your banners to measure your plan's usage; serving your Live Link pages.
• Nature of the processing: collection, recording, storage, retrieval, display, export to you, and deletion.
• Data subjects: the visitors of the websites and apps where you install a TermsFeed consent banner or link a Live Link.
• Categories of personal data:
  • Consent log: a random consent identifier stored in the visitor's browser, the consent choices (accepted, rejected and partly accepted categories), the time, the website's domain, the visitor's country, region and language, the Do Not Track and Global Privacy Control signals, and the visitor's choices about the sale or sharing of personal information and the use of sensitive personal information where they apply. The consent log stores no IP address, user agent or referrer.
  • Delivery: the IP address, the user agent, the requested address and the referrer of each request for a banner, its settings or a Live Link page, which our network provider uses to deliver the request and determine the country and region, and which our server logs record.
  • Usage: the number of page loads of each banner per day and domain.
• Special categories of data: none. Do not configure the Service to collect them.
• Frequency and duration: continuous, for as long as you use Privacy Consent or Live Links, and until deletion under Deletion and return of data.
• Retention: consent log and usage records 2 years from the day they are recorded; server logs for a limited time, for security and troubleshooting.

Your obligations

• You decide the purposes of the processing, and you are responsible for having a legal basis for it under Data Protection Law.
• You inform your visitors about the processing, for example in your Privacy Policy and Cookies Policy, and configure your banner (categories, vendors, regions and texts) to match what your website does.
• Your instructions to us must comply with Data Protection Law.

Our obligations

• Instructions. We process Customer Personal Data only on your documented instructions, which are the Terms of Use, this DPA and the settings you choose in the app, unless the law requires otherwise; in that case we tell you first, unless the law forbids it. We tell you if we believe an instruction breaks Data Protection Law.
• Confidentiality. Only staff who need access to provide the Service can access Customer Personal Data, and they are bound by confidentiality.
• Security. We apply the measures in Security measures.
• Data subject requests. You can download your consent log from the app to answer requests. If a visitor contacts us directly, we pass the request to you and don't answer it ourselves, unless you ask us to. We help you with requests the app does not cover.
• Assistance. We help you, as far as the processing requires, with data protection impact assessments, consultations with supervisory authorities, and your security obligations.
• Personal Data Breaches. We notify you without undue delay, and within 48 hours of becoming aware of a Personal Data Breach, with the information we have about it, and we take reasonable steps to contain it and limit its effects.
• No sale. We do not sell Customer Personal Data or use it for our own purposes, such as advertising.

Sub-processors

You authorize us to engage sub-processors. We impose on each one data protection obligations equivalent to those in this DPA, and we remain responsible to you for their work. Our current sub-processors for Customer Personal Data are:

We email you at least 30 days before we add or replace a sub-processor. If you object to the change on reasonable data protection grounds, tell us within those 30 days; if we cannot address your objection, you can stop using Privacy Consent and Live Links, and we refund the unused part of any period you paid for them.

International transfers

When Customer Personal Data is transferred to a sub-processor outside the European Economic Area, Switzerland or the United Kingdom, to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework where the sub-processor is certified under it, or on the European Commission's standard contractual clauses (module 3, processor to processor), with the UK addendum where needed. If you are outside the European Economic Area, the standard contractual clauses (module 4, processor to controller) apply between you and us, as far as the GDPR requires them.

Information and audits

We make available to you the information needed to show that we meet this DPA, and answer your reasonable questions about our processing. If that information is not enough, or a supervisory authority requires it, you can audit our compliance once a year, with at least 30 days' written notice, during business hours, at your cost, through an auditor bound by confidentiality, and in a way that does not compromise the security or confidentiality of other customers' data.

Deletion and return of data

• You can download the consent log of each banner from the app at any time, as a CSV file.
• When you delete a consent banner or your account, the banner's settings are removed at once, so the banner stops working, and its consent log is no longer available in the app.
• Consent log and usage records are deleted when their 2-year retention ends. Ask us in writing to delete them earlier, and we do so within 30 days, unless the law requires us to keep them.
• Deleted data leaves our encrypted backups as they are replaced.

US state privacy laws

Where the CCPA or a similar US state law applies, TermsFeed is your service provider or processor. We process Customer Personal Data only for the business purposes in this DPA; we do not sell or share it, retain, use or disclose it outside our direct business relationship with you, or combine it with personal data from other sources, except as those laws allow; and we tell you if we can no longer meet those obligations.

Liability and precedence

The limitations of liability in the Terms of Use apply to this DPA, as far as Data Protection Law allows. If this DPA and the Terms of Use conflict on the processing of Customer Personal Data, this DPA applies; if the standard contractual clauses apply and conflict with this DPA, the clauses apply.

Security measures

• Encrypted connections (HTTPS) for every request to banners, their settings, the event endpoint, Live Link pages and the app.
• Data minimization: the consent log keeps a random identifier and the visitor's choices, not IP addresses, user agents or referrers.
• Access to production systems limited to authorized staff, with individual credentials, and a log of the changes staff make to accounts through our support dashboard.
• Protection against bots and attacks by our network provider.
• Encrypted backups kept apart from the production servers.
• Monitoring of the systems that serve banners and record consent, and timely security updates.
• Staff bound by confidentiality, and an incident response process for Personal Data Breaches.

Changes to this DPA

We can change this DPA when the law, our sub-processors or our processing change. We email you at least 30 days before a material change takes effect. A change never lowers the protection of Customer Personal Data below what Data Protection Law requires.

Contact us

Questions about this DPA or the processing of your visitors' data: email [email protected].