Data Processing Agreement

This DPA forms part of the Terms between the customer ("Controller") and [LEGAL NAME] ("Processor", KiteTrack).

1. Subject and duration

The Processor processes personal data of the Controller's website visitors and customers to provide server-side tracking, for as long as the Controller uses the Service.

2. Nature and purpose

Receiving events from the Controller's website, store or CRM; enriching, hashing and forwarding them to platforms chosen by the Controller; showing delivery and health information in the dashboard; sending alerts.

3. Types of data and data subjects

• Data subjects: visitors, leads and customers of the Controller.
• Data: IP address, user agent, cookie and click identifiers, page and event data, order and lead details, and (if sent by the Controller) email, phone, name and address — hashed before sharing with ad platforms where supported.

4. Processor obligations

The Processor will:

1. process data only on the Controller's documented instructions (the Terms, the setup chosen in the dashboard, and this DPA);
2. ensure staff are bound by confidentiality;
3. apply appropriate security measures (Annex 1);
4. use sub-processors only as listed in the Privacy Policy and give 14 days' notice of changes, allowing the Controller to object;
5. help the Controller respond to data subject requests and, where required, with impact assessments;
6. notify the Controller without undue delay (target: 72 hours) after becoming aware of a personal data breach;
7. delete or return personal data at the end of the Service, unless the law requires storage;
8. make available information needed to show compliance.

5. Controller obligations

The Controller ensures it has a lawful basis and any required consent to collect the data and send it to the platforms it chooses, and that its privacy notice describes this.

6. International transfers

Where data leaves the UK / EEA, the parties rely on standard contractual clauses or another valid transfer mechanism.

Annex 1 — Security measures

Encryption in transit (TLS); hashed identifiers before sharing with ad platforms; access limited to authorised staff with two-factor login; audit log of staff actions; backups; isolated tracking container per customer.

Annex 2 — Sub-processors

See the Privacy Policy, section 5.