SiteAirbag data processing addendum

1. Scope and roles

The customer is controller/business and SiteAirbag is processor/service provider for customer personal data in runtime operations and deliberate rescue requests. Each party is independently responsible for processing it determines for its own account, security, billing, legal or support purposes. Terms such as controller, processor, personal data, processing and data subject have the meanings in applicable data protection law.

2. Instructions and purpose limitation

SiteAirbag processes customer personal data only to provide, secure, support and improve the contracted service under documented instructions in the Terms, configuration and support requests. SiteAirbag will notify the customer if an instruction appears unlawful, unless prohibited by law. SiteAirbag will not sell customer personal data, share it for cross-context behavioral advertising, or combine it with unrelated personal data except as permitted for a service provider.

3. Processing details

Subject matter: configured website-action observation, controlled detection-quality evaluation and optional rescue requests. Duration: the contract plus documented deletion periods. Data subjects: customer account users and visitors using protected sites. Data: minimized technical event and versioned decision data, explicit owner quality labels, contact details and approved business-safe rescue details. Detection-quality records exclude raw form data, full URLs and error text. Frequency: as visitors interact with configured actions or customers use the service. Sensitive data is prohibited.

4. Confidentiality and security

Personnel with access are bound by confidentiality and receive access only as needed. Technical and organizational measures include tenant isolation with Row Level Security, scoped and short-lived credentials, encryption in transit and provider-managed encryption at rest, secrets management, signature verification, audit logging, rate limiting, secure development checks, backup/restore procedures and incident response. The customer remains responsible for account access, site configuration, legal notices and safe rescue-field choices.

5. Subprocessors

The customer gives general authorization for the listed subprocessors. SiteAirbag remains responsible for imposing materially equivalent data-protection obligations. SiteAirbag will publish material changes before use where reasonably practicable. A customer with a substantiated data-protection objection may contact privacy@siteairbag.com; the parties will seek a reasonable solution, and if none exists the affected service may be terminated.

6. Assistance

Taking account of the processing and information available, SiteAirbag will reasonably assist with data-subject requests, security assessments, breach obligations and data-protection impact assessments. The customer is responsible for responding as controller. SiteAirbag may charge reasonable costs for exceptional assistance beyond the service's standard controls where permitted by the contract.

7. Security incidents

SiteAirbag will notify the customer without undue delay after confirming a breach of customer personal data and will provide available information about nature, likely consequences, affected data and mitigation. Notification is not an admission of fault. The customer is responsible for regulator and data-subject notifications unless law assigns that duty otherwise.

8. Deletion and return

During the service, customer data can be exported through the documented workflow. Following a verified deletion request or contract end, SiteAirbag will delete or return customer personal data under the retention schedule, except where law requires retention. Provider backups age out through their protected lifecycle and remain isolated from ordinary use.

9. Audits

SiteAirbag will provide current security and subprocessor information reasonably necessary to demonstrate compliance. No more than once annually, unless required by a regulator or confirmed incident, the customer may request additional evidence. Audits must protect other customers, security, confidentiality and service availability; independent reports and remote evidence are preferred before an on-site review.

10. Transfers

For restricted international transfers, the applicable controller-to-processor Standard Contractual Clauses are incorporated by reference, with the customer as exporter and SiteAirbag as importer, Module Two applying, optional docking applying, and the law/forum selected consistently with the customer's EEA establishment where permitted. The UK Addendum applies to UK restricted transfers. The processing description and security measures in this DPA form the annexes.

11. Conflict and contact

This DPA prevails over conflicting Terms for its subject matter. Mandatory law prevails over both. Data-protection contact: privacy@siteairbag.com.

Data Processing Addendum