Data processing agreement

Parties

Purpose and scope

These terms apply to the processing of personal data by the processor on behalf of the controller in the course of the service described below. They form part of the processor’s terms of service and apply automatically, without signature, to every client who accepts those terms. If they conflict with the terms of service on the processing of personal data, these terms prevail. They are intended to meet the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR).

Service

Privacyboard takes care of your privacy policy, your providers and your customers’ privacy requests, so you can get on with your business. Free to set up.

Processing instructions

The processor processes personal data only on documented instructions from the controller, including instructions relating to transfers to a third country or an international organization, unless required to do so by law. In that case, the processor informs the controller of that legal requirement before processing, unless the law prohibits it. The processor informs the controller immediately if, in its opinion, an instruction infringes data protection law.

Confidentiality

The processor ensures that the persons authorized to process the personal data are bound by a duty of confidentiality, by contract or by law.

Security

The processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures in place at the effective date are described in Annex 2.

Personal data breaches

The processor notifies the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the controller's data, and provides the information the controller needs to meet its own notification obligations.

Subprocessors

The controller gives general authorization for the use of the subprocessors listed below. The processor informs the controller of any intended addition or replacement, at least 30 days in advance, by email or through its published list of subprocessors, so that the controller can object.

The processor imposes on each subprocessor the same data protection obligations as in this agreement, and remains fully liable to the controller for the performance of its subprocessors.

• Vercel — Host business websites, online services or other company systems. — France
• Supabase — Provide database, authentication and file storage for enabled Supabase services. — France
• Resend — Deliver transactional emails such as account notifications and password resets. — Ireland
• Google Workspace — Provide internal business email and the support mailbox that receives the messages customers send us. — EU
• Anthropic — Used to translate specific passage of Privacy Center's documentations. — United States
• Cloudflare — Bot protection on sign-up and login forms, and real-browser scans of the websites customers ask us to check — Worldwide

International transfers

The processor transfers personal data outside the European Economic Area only on the controller's documented instructions or where required by law, and only with the safeguards required by Chapter V GDPR.

Some subprocessors process data outside the European Economic Area (Anthropic, Cloudflare). For these transfers, the processor relies on standard contractual clauses approved by the European Commission.

Assistance to the controller

Taking into account the nature of the processing, the processor assists the controller, by appropriate technical and organizational measures, in responding to requests from individuals exercising their rights, and forwards without delay any such request it receives. The processor also assists the controller in ensuring compliance with its obligations on security, personal data breach notification, data protection impact assessments and prior consultation.

Return or deletion

At the end of the service, and at the controller's choice, the processor deletes or returns all personal data and deletes existing copies, unless the law requires storage of the data.

Deletion procedure: We manually delete personal data upon request.

Audit and information

The processor makes available to the controller all information necessary to demonstrate compliance with this agreement, and allows for and contributes to audits, including inspections, conducted by the controller or an auditor mandated by it, on reasonable notice.

Duration

This agreement applies for as long as the processor processes personal data on behalf of the controller, and until that data has been returned or deleted.

Retention during the service, for each processing:

Service delivered on behalf of clients: as instructed by each client, then returned or deleted at the end of the contract

Annex 1 - details of processing

Processing carried out for clients:

Service delivered on behalf of clients — Provide the service to clients and process their data only on their documented instructions (data: Data of clients' end users processed through the service: cookie consent records of their website visitors (consent choices, date, banner version, region, pseudonymous identifier), identity and contact details and content of privacy requests sent to them (name, email address, request), and any other data clients choose to share; people: Clients' website visitors, people sending privacy requests to clients, and clients' customers, users or employees; kept: As instructed by each client, then returned or deleted at the end of the contract)

Duration: for the term of the service, with the retention set out in the Duration section

Annex 2 - security measures

Multi-factor authentication for administrative access

Regular backups

Encryption of personal data in transit and at rest

Hosting region: France

Acceptance

These terms are accepted electronically, together with the processor’s terms of service, when the client creates an account or orders the service. No signature is needed. A client that wants a countersigned copy can ask hello@privacyboard.io.