Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Mihail Hummel, Tsar Ivan Aleksandar 116, 9700, Shumen, Bulgaria ("Processor", "Trackero") and the Business Customer ("Controller", "you"). It is concluded by accepting the Terms and applies whenever the Processor processes personal data on the Controller's behalf. Capitalised terms not defined here have the meaning given in the Terms or, where applicable, in the GDPR.

1. Subject matter, duration and nature

1.1 The Processor processes personal data on behalf of the Controller in order to provide the Service, in particular to perform redirects (on the Processor's redirect domain and on custom domains the Controller connects), record and analyse scans and clicks, generate statistics and dashboards, and store Customer Content. The details are set out in Annex 1.

1.2 This DPA applies for as long as the Processor processes personal data on behalf of the Controller, including any retrieval period after termination of the Terms.

1.3 Data protection laws covered by this DPA ("Data Protection Laws") are: Regulation (EU) 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), and US state privacy laws (including the CCPA), in each case to the extent applicable.

2. Instructions

2.1 The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do otherwise by Union or Member State law to which the Processor is subject; in that case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits this.

2.2 The Terms, this DPA and the Controller's configuration and use of the Service (for example creating codes, activating dashboards, deleting data) constitute the Controller's complete documented instructions. Further instructions must be given in writing and are subject to agreement on any additional costs.

2.3 The Processor immediately informs the Controller if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the instruction until it is confirmed or changed.

3. Controller's responsibilities

The Controller is responsible for the lawfulness of the processing, including having a legal basis for collecting Scan Data, providing the information required by Articles 13 and 14 GDPR to data subjects (for example on its destination pages), handling data subject requests addressed to it, and ensuring that the Customer Content it uploads may lawfully be processed. The Controller must not instruct the Processor to process special categories of personal data (Art. 9 GDPR) or data relating to criminal convictions.

4. Confidentiality

The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access personal data only to the extent needed for their tasks.

5. Security of processing

The Processor implements and maintains the technical and organisational measures set out in Annex 2, which ensure a level of security appropriate to the risk in accordance with Article 32 GDPR. The Processor may update these measures as technology develops, provided that the overall level of security is not reduced.

6. Sub-processors

6.1 The Controller gives the Processor general authorisation to engage sub-processors. The sub-processors in use at the date of this DPA are listed in Annex 3 and in our Privacy Policy.

6.2 The Processor informs the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance, by email or in the Service, giving the Controller the opportunity to object. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected Service with effect from the change and receive a pro-rata refund of prepaid fees. In an emergency (for example the sudden failure of a provider), a shorter notice period may apply.

6.3 The Processor imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable to the Controller for the performance of its sub-processors' obligations.

7. International transfers

7.1 The Processor transfers personal data outside the EEA, the UK or Switzerland only in compliance with Chapter V GDPR (and its UK and Swiss equivalents), in particular based on an adequacy decision (including the EU–U.S. Data Privacy Framework for certified recipients) or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), supplemented by the UK International Data Transfer Addendum and the amendments required by the Swiss FDPIC where applicable, together with supplementary measures where needed.

7.2 Where the Controller is located outside the EEA and the Processor returns personal data to it, the parties agree that Module 4 (processor to controller) of the SCCs applies, which are incorporated by reference. For the SCCs: clause 7 (docking clause) applies; the governing law and forum are those of Bulgaria; and Annexes I and II are completed by Annexes 1 and 2 of this DPA.

8. Assistance

8.1 Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights (Articles 12 to 22 GDPR). Most requests can be handled by the Controller directly in the Service (viewing, exporting and deleting data). If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay where the Controller can be identified, and does not respond itself except on the Controller's instructions.

8.2 The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to it.

9. Personal data breaches

The Processor notifies the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller's personal data. The notification contains, as far as available, the information required by Article 33(3) GDPR, which may be provided in phases. The Processor takes reasonable steps to contain the breach and mitigate its effects. Notification is not an acknowledgement of fault or liability.

10. Deletion and return

10.1 The Controller can export and delete its data at any time using the functions of the Service. When the Terms end, the Processor deletes the Controller's personal data after the retrieval period described in Section 15.6 of the Terms, unless Union or Member State law requires further storage. Data deleted by the Controller is removed from the live systems immediately and from backups within the normal backup rotation, at the latest within 30 days.

10.2 On request, the Processor confirms the deletion in writing.

11. Information and audits

11.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, in particular this DPA, its technical and organisational measures, and, where available, certifications or audit reports of its sub-processors.

11.2 If this information is not sufficient, or if a supervisory authority requires it, the Controller may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once a year (unless there is a breach or a regulatory request), with at least 30 days' notice, during normal business hours, and without disrupting operations or compromising the security or confidentiality of other customers' data. Each party bears its own costs, unless the audit reveals a material breach by the Processor.

12. US state privacy laws

To the extent the CCPA or similar US state laws apply, the Processor acts as a "service provider" or "processor" and: (a) processes personal information only for the business purposes set out in the Terms and this DPA; (b) does not sell or share it, and does not use it for cross-context behavioural advertising; (c) does not retain, use or disclose it outside the direct business relationship with the Controller, or combine it with personal information from other sources except as permitted by law; (d) complies with the applicable law and provides the same level of privacy protection as required of the Controller; (e) notifies the Controller if it can no longer meet its obligations; and (f) allows the Controller to take reasonable steps to stop and remedy unauthorised use. The Processor certifies that it understands these restrictions.

13. Liability and precedence

13.1 Liability under this DPA is subject to the limitations of liability in the Terms, to the extent permitted by Data Protection Laws. Article 82 GDPR remains unaffected with respect to data subjects.

13.2 In the event of a conflict, the SCCs (where applicable) prevail over this DPA, and this DPA prevails over the Terms in respect of data protection matters.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

• Encryption: TLS for all data in transit (HTTPS enforced with HSTS); encryption of data at rest by our hosting and database providers.
• Access control: row-level security in the database so each customer can access only their own data; service credentials kept in server-side secret storage and never in the client; staff access limited to named administrators on an allow-list, with an audit log of administrative actions.
• Data minimisation and pseudonymisation: no storage of scanner IP addresses; salted, per-code hashing for unique-visitor counts; no cookies on scanners' devices; hashed keys for rate limiting.
• Input control and integrity: server-side validation of inputs, restriction of redirect targets to safe URL schemes, database constraints; custom domains are activated only after DNS-based proof of control and are re-checked regularly.
• Availability and resilience: managed cloud infrastructure with automated backups, DDoS protection and rate limiting through Cloudflare and our database.
• Separation: logical separation of each customer's data within the database.
• Payment data: processed only by a PCI-DSS Level 1 certified payment provider; no card data on our systems.
• Organisational: confidentiality obligations for all personnel, processor agreements with all sub-processors, a defined process for incident response and breach notification, and regular review of these measures.

Annex 3: Sub-processors

Contact

Data protection questions, sub-processor notifications and requests for a countersigned copy: privacy@trackero.co.