Data Processing Addendum

Roles

For the personal data of your website visitors processed through the KookiOk consent script and dashboard, you are the controller and KookiOk is your processor. You determine the purposes and means; we act on your documented instructions.

Subject matter and duration

KookiOk processes visitor consent data to provide consent capture, storage and proof, help with your visitors' privacy requests, cookie and tracker scanning, analytics and reporting, for as long as you use the service.

Categories of data and data subjects

Data subjects are the visitors of your websites. The data processed includes a pseudonymous consent ID, consent choices, a timestamp, an anonymized IP address, the browser user-agent, a Global Privacy Control flag, derived country and language, the banner version and the applicable regulation.

If you record a visitor's privacy request in the dashboard and enter their email address, we also process that address to send the visitor the outcome of the request.

In consent records, IP addresses are anonymized before storage. Our hosting request logs (kept for 30 days) and error monitoring can contain the full IP address of a request. No device fingerprinting is used, and KookiOk does not intentionally process special categories of personal data.

Our obligations as processor

• Process personal data only on your documented instructions.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures.
• Assist you with data-subject requests and with security and breach obligations.
• Delete or anonymize the data on termination, as described below.

Sub-processors

You authorise us to engage the following sub-processors:

• Microsoft Azure - hosting, database, cache, logs and files in EU regions (France Central and West Europe), and delivery of the consent script through Azure Front Door.
• Resend - sends the emails the service needs, including the outcome of a privacy request to the visitor who made it. Emails leave from Ireland (EU); Resend stores email data and logs in the United States for 30 days.
• Sentry - error and performance monitoring. Error reports, performance traces of a sample of requests and server logs are stored in the EU (Frankfurt, Germany) and can contain visitor data, such as a consent ID, a user-agent, an IP address or a visitor's email address.

We will inform you of intended changes to this list, and you may object on reasonable data-protection grounds.

Security measures

Measures include EU hosting, encryption in transit, IP anonymization in consent records, SHA-256 integrity hashing of consent records, SSRF-protected scanning, access controls and audit logging, and keeping advertising and analytics trackers out of the consent script and the dashboard.

International transfers

Our servers and databases are located in the European Union, and the consent script is delivered through Azure Front Door's global network. Resend stores email data in the United States, and Sentry, a US company, can access the error data it stores in the EU. For these transfers we rely on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.

Data-subject requests and deletion

We assist you in responding to access, erasure and portability requests. Erasure replaces the consent ID in the visitor's consent records with a random one and removes their user-agent and anonymized IP address; the records themselves remain without these identifiers. The privacy request itself, with the email address you entered, is kept until the site is deleted.

When you delete a site, or we delete your account at your request, its consent records are deleted with it; otherwise each record is deleted when it reaches the retention period in our Privacy Policy.

Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting the data we process for you, with the information you reasonably need to meet your own notification obligations.

Audits

On reasonable request, we will make available the information necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, subject to appropriate confidentiality and reasonable notice.

Liability, changes and contact

This Addendum is subject to the liability provisions of the Terms of Service. We may update it to reflect legal or operational changes. Questions: contact@kookiok.com.