Data Processing Agreement
1. Subject matter and duration of the processing
Through the cookie banner displayed on the Subscriber's website, the processor records visitors' cookie consent so that the Subscriber can demonstrate that consent has been given (Article 7(1) GDPR). The processor also receives and stores requests submitted via the Subscriber's hosted data subject request form and forwards them by e-mail to the account members designated by the Subscriber. The processing lasts for the term of the subscription.
2. Data subjects and categories of data
Data subjects: visitors to the Subscriber's website and persons who complete the data subject request form.
- Consent log: a random consent identifier, the time of the decision, the selected categories and services, the banner version and language, the regional rule applied, the approximate country derived from the browser time zone, the device type, browser and operating system, the page address (without query parameters), the browser's user agent string and a one-way hashed value of the IP address. The IP address is not stored in clear form.
- Data subject requests: name, e-mail address, message, request type, language and a one-way hashed value of the IP address.
- Cookie declaration: the banner transmits the names (not the values) of cookies seen on the website in order to compile the cookie declaration.
Statistics (by device, browser, operating system, approximate country and language) are aggregated counts and contain no personal data. The approximate country is derived from the browser time zone, not from the IP address. To measure the pageview limit, the banner sends one empty signal per page load; only the website's daily pageview count is stored.
3. Obligations of the processor
- It processes the data solely on the documented instructions of the Subscriber, i.e. in accordance with the settings of the Service, and does not use it for its own purposes.
- It commits the persons with access to the data to confidentiality.
- It applies appropriate technical and organisational measures: encrypted data traffic (HTTPS), role-based access control, two-factor authentication, rate-limited login attempts, one-way hashing of IP addresses, an isolated scanner environment, regular backups and automatic deletion of outdated data.
- It assists the controller in fulfilling data subject requests: the record belonging to a consent identifier can be looked up and exported in the admin interface, and requests submitted via the data subject request form can be managed there.
- It notifies the Subscriber of a personal data breach without undue delay and at the latest within 48 hours.
- It makes available the information necessary to demonstrate compliance.
4. Sub-processors
The Subscriber grants general authorisation for the engagement of the following sub-processors:
- hosting: Microsoft Ireland Operations Ltd. (Microsoft Azure, Sweden Central data centre), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland;
- Microsoft Ireland Operations Ltd. (Ireland): Microsoft Azure hosting and Microsoft 365 / Microsoft Graph e-mail delivery, including notifications of data subject requests;
- e-mail delivery: Microsoft Ireland Operations Ltd. (Microsoft 365);
- Stripe Payments Europe Ltd. (Ireland): collection of subscription fees; it receives no visitor data.
- KBOSS.hu Kft. (Számlázz.hu, Hungary): issuing and sending the Subscriber's invoices; it receives no visitor data.
The processor will notify the Subscriber at least 15 days in advance of the engagement of any new sub-processor. The Subscriber may object and, in that case, terminate the contract.
5. Place of storage, retention and deletion
The data is stored in the European Union. Consent log entries are retained for 3 years and then deleted automatically, unless the Subscriber deletes them earlier. Data subject requests are retained until the Subscriber deletes them. Upon termination of the contract, the processor hands over the data in an exportable format at the Subscriber's request and deletes it within 30 days.