Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is concluded between the customer named in the acceptance record, acting as controller (the "Customer"), and Mantas Lukošius, a sole proprietor (individuali veikla) registered in Lithuania, VAT number LT100014517418, Liepų g. 71A, Ginduliai, Klaipėdos r., Lithuania, who operates CookieSentry and acts as processor ("CookieSentry" or the "Processor"). Contact for data protection matters: [email protected].

This DPA supplements the Terms of Service at https://cookiesentry.com/terms (the "Terms"), under which CookieSentry provides its service to the Customer (the "Service"). If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in Regulation (EU) 2016/679 (the "GDPR"). "Customer Data" means the personal data that CookieSentry processes on behalf of the Customer under this DPA, as described in Annex 1.

Subject matter: CookieSentry scans the publicly accessible websites that the Customer adds to its account for cookies and third-party requests, monitors them on the schedule the Customer sets, sends alerts and reports to the recipients the Customer names, and administers the Customer's account.

Nature of the processing: collecting, storing, organising, analysing, displaying, sending by email and deleting Customer Data, as far as needed to provide the Service. The scanner loads the Customer's pages with a headless browser as an anonymous first-time visitor. It does not sign in to the Customer's website, does not submit forms, and has no access to the website's backend, its visitor statistics or the cookies of its real visitors.

Purpose: providing the Service under the Terms, including support and the security of the Service.

Duration: this DPA applies from its acceptance for as long as CookieSentry processes Customer Data for the Customer. It ends when the Customer's account is deleted and the Customer Data has been deleted or returned under section 12.

The types of personal data and the categories of data subjects are listed in Annex 1.

CookieSentry processes Customer Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless EU or Member State law to which CookieSentry is subject requires otherwise. In that case CookieSentry informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Terms, this DPA and the Customer's settings and actions in the Service (for example adding a website, choosing a scan schedule, naming alert recipients, sharing a report or deleting data) are the Customer's complete documented instructions at the time of acceptance. The Customer gives further instructions in writing or in text form (email to [email protected]); they must be compatible with the Service. Instructions that change the scope of the Service can be agreed as a change to the Terms.

CookieSentry informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions. CookieSentry may suspend that instruction until the Customer confirms or changes it.

CookieSentry also uses billing and payment data, and the data it needs for its own obligations in accounting, tax, security and abuse prevention, for its own purposes as an independent controller under its Privacy Policy (https://cookiesentry.com/privacy). That use is not covered by this DPA.

The Customer is responsible for the lawfulness of the processing it instructs, in particular for being allowed to scan the websites it adds (Terms, Acceptable Use Policy) and for having a legal basis to name the alert recipients.

The Customer informs CookieSentry without undue delay if it finds errors or irregularities in the processing with regard to data protection.

CookieSentry ensures that persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation continues after this DPA ends.

CookieSentry is run by its owner as a sole proprietorship. Where other persons are given access to Customer Data (for example a contractor for maintenance work), they are bound in writing to confidentiality and to this DPA before they get access.

CookieSentry implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Art. 32 GDPR), taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

The measures are subject to technical progress. CookieSentry may replace them with alternative measures that provide at least the same level of security. CookieSentry documents material changes and includes them in Annex 2 with the next version of this DPA.

The Customer gives CookieSentry general authorisation to engage subprocessors. The subprocessors engaged when this version was published are listed in Annex 3. The current list, including changes notified under clause 7.2, is kept at https://cookiesentry.com/legal/hosting.

CookieSentry informs the Customer at least 30 days in advance of any intended addition or replacement of a subprocessor, by email to the account email address and by updating https://cookiesentry.com/legal/hosting.

The Customer may object to the change in writing or in text form within that period on reasonable grounds relating to data protection. The parties then discuss the objection in good faith. If CookieSentry cannot reasonably avoid the change, the Customer may terminate the Service with effect from the date the change takes effect.

CookieSentry imposes on each subprocessor, by contract, data protection obligations that offer at least the level of protection of this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. CookieSentry remains liable to the Customer for the performance of its subprocessors' obligations (Art. 28(4) GDPR).

Ancillary services that CookieSentry uses from third parties, such as telecommunications or postal services, are not subprocessing as long as no Customer Data is processed in them.

Taking into account the nature of the processing, CookieSentry assists the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights under Chapter III GDPR.

Account holders can view, correct and delete most Customer Data themselves in the dashboard (profile, websites, alert recipients, account deletion). Where that is not enough, CookieSentry helps on request.

If a data subject contacts CookieSentry directly about Customer Data, CookieSentry forwards the request to the Customer without undue delay and answers it only on the Customer's instruction.

CookieSentry notifies the Customer of a personal data breach affecting Customer Data without undue delay, and no later than 48 hours after becoming aware of it. The notice goes to the account email address.

The notice contains, as far as known:

1. the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;
2. the likely consequences of the breach;
3. the measures taken or proposed to address the breach and to mitigate its possible adverse effects;
4. a contact point for further information.

Information that is not yet available is provided as soon as it is.

CookieSentry takes the measures needed to secure the Customer Data and to mitigate possible adverse effects, and documents the breach. Notifying the supervisory authority and the data subjects is the Customer's decision; CookieSentry does so only on the Customer's instruction.

Taking into account the nature of the processing and the information available to it, CookieSentry assists the Customer in meeting its obligations under Art. 32 to 36 GDPR (security of processing, notification and communication of personal data breaches, data protection impact assessment and prior consultation).

CookieSentry may ask for reimbursement of reasonable costs for assistance that goes beyond the information in this DPA and its annexes, unless the assistance is needed because CookieSentry breached this DPA.

CookieSentry stores Customer Data in the EU (Frankfurt, Germany). Where an Annex 3 subprocessor is outside the EU/EEA or may access data from there, Annex 3 names the transfer mechanism.

Customer Data is transferred to a country outside the EU/EEA only on the Customer's documented instructions (section 3) and only where the conditions of Chapter V GDPR are met, for example through an adequacy decision or the EU Standard Contractual Clauses. Engaging the subprocessors in Annex 3, including any onward transfer described there, is part of these instructions.

The Customer can delete individual websites and its whole account at any time in the dashboard. Deleting the account removes the account, its websites, scan results and cookie inventory from the production database straight away.

Before deleting, the Customer can save its reports as PDF. On request made before the account is deleted, CookieSentry provides the Customer Data in a common machine-readable format (JSON or CSV).

On request in writing or in text form, CookieSentry also deletes, within 30 days, the uploaded logo file, the email delivery records and the log entries that relate to the Customer. Data that remains in backups kept by a subprocessor is deleted in that subprocessor's regular backup cycle.

Beyond that, CookieSentry keeps only data that EU or Member State law requires it to store, for example invoices and payment records under tax law (clause 3.4), and the acceptance record of this DPA as proof of the agreement.

On request, CookieSentry confirms the deletion in text form.

CookieSentry makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA with Annex 2 and Annex 3, and answers reasonable questions in writing (for example a security questionnaire).

Where the written information is not sufficient, the Customer, or an independent auditor bound to confidentiality and mandated by the Customer, may carry out audits, including inspections. Audits require at least 30 days' notice, take place during normal business hours, are limited to once per calendar year unless a supervisory authority requires it or a personal data breach has occurred, and must not disrupt the Service. Each party bears its own costs.

Subprocessors are checked through the information and audit reports they publish or provide, as far as their terms allow.

CookieSentry informs the Customer without undue delay of inspections and measures by a supervisory authority that concern Customer Data.

Liability under this DPA follows the "Limitation of Liability" section of the Terms. This does not apply where mandatory law, in particular Art. 82 GDPR, does not allow a limitation.

This DPA is concluded in electronic form (Art. 28(9) GDPR) when the Customer accepts it in the account settings. The acceptance record (company, person accepting, version, language, date and time) forms part of this DPA. CookieSentry agrees to this DPA by offering it in the Service.

This DPA runs for as long as the Terms and ends with them. Provisions that by their nature are meant to continue (confidentiality, deletion, information) continue until the Customer Data is deleted.

CookieSentry may update this DPA, for example because of changes in the law or in the Service. A new version is published with a new version number and shown in the account settings; it applies once the Customer accepts it. Until then, the version the Customer accepted continues to apply. Changes of subprocessors follow section 7.

This DPA is governed by the law that governs the Terms (the law of the Republic of Lithuania), without prejudice to the GDPR. The courts named in the Terms have jurisdiction.

This DPA is available in English and German. If the versions differ, the English version prevails.

If a provision of this DPA is invalid, the rest of this DPA remains valid. The invalid provision is replaced by a valid one that comes closest to the intention of the parties and to the requirements of Art. 28 GDPR.