Data Processing Addendum

1.Roles of the parties

For Personal Data contained in Customer Data, including content extracted from sites you submit and leads captured through your reports, you are the controller and we are the processor.

For Personal Data relating to your account, your users, and your billing, we act as an independent controller and our Privacy Policy governs. This DPA does not apply to that processing.

You are responsible for establishing a lawful basis for the processing you instruct, for giving any notice and obtaining any consent required from data subjects, and for the accuracy and legality of the data you cause us to process. You confirm you have the right to submit each site you audit, as required by the Terms and the Acceptable Use Policy.

2.Processing on documented instructions

We will process Personal Data only on your documented instructions, which comprise this DPA, the Terms, the product documentation, and the configuration and actions you take in the Service, including the sites you submit, the schedules you set, the lead fields you define, and the integrations you connect.

We will not process Personal Data for our own purposes, will not sell or share it, and will not use it to train our own models. Where we are required by law to process beyond your instructions, we will tell you before doing so unless that law prohibits notice.

We will inform you if, in our opinion, an instruction infringes Data Protection Law. We may suspend processing of an instruction that we reasonably believe is unlawful.

3.Confidentiality of personnel

We ensure that personnel authorized to process Personal Data are bound by confidentiality obligations that survive the end of their engagement, are informed of the confidential nature of the data, and receive access only to the extent necessary for their role. Access to production data is limited to personnel who require it to operate and support the Service.

4.Security measures

We implement the technical and organizational measures set out in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects. We may update these measures provided the level of security is not materially reduced.

You are responsible for the security configuration within your control, including who you invite to your organization, the roles you assign, how you distribute report share links, and how you protect API, CLI, and MCP credentials.

5.Subprocessors

You give general written authorization for us to engage subprocessors. The current list is in Annex III and is maintained at /legal/subprocessors.

We impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain fully liable to you for their performance.

We will give at least 30 days' notice before adding or replacing a subprocessor, by email to the address you register at privacy@pagereflect.com for that purpose. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected part of the Service and receive a pro rata refund of prepaid fees for the unused term.

6.Assistance with data subject requests

The Service gives you direct access to the Personal Data we process for you, so that you can retrieve, correct, export, and delete it yourself. That is the primary way we assist you.

If a data subject contacts us directly about data we process on your behalf, we will not respond substantively, other than to direct them to you, and we will notify you promptly. Where you cannot fulfil a request through the Service, we will provide reasonable additional assistance, at your cost where the assistance is substantial.

7.Personal data breach

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Personal Data we process for you.

The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of it at once, we will provide it in phases without undue delay.

We will cooperate with you and take reasonable steps to mitigate. Notification is not an admission of fault or liability. Reports and questions go to security@pagereflect.com.

8.Impact assessments and prior consultation

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 of the GDPR. Our security documentation at /security and the annexes below are intended to cover most of what an assessment requires.

9.Return and deletion

You may retrieve and delete Personal Data at any time through the Service. On termination, and at your choice, we will delete or return Personal Data processed on your behalf, and delete existing copies, unless law requires storage.

Deleting your account deletes the organizations you solely own, which cascades to their sites, runs, and reports. Residual copies may persist in encrypted backups for up to 30 days before rotating out, and in operational log tables until their retention window expires, as described in the Privacy Policy. Those copies remain subject to this DPA until deleted.

10.Information and audits

We will make available the information necessary to demonstrate compliance with Article 28, including our security documentation, the annexes below, and responses to reasonable security questionnaires.

You may audit our compliance no more than once in any twelve-month period, on 30 days' written notice, during business hours, without unreasonable disruption, and subject to confidentiality. An audit may not include penetration testing of our production systems or access to other customers' data. We may satisfy an audit request by providing a third-party report or a completed questionnaire where that reasonably addresses your request. You bear your own costs and our reasonable costs for audits beyond a questionnaire response.

11.International transfers

Where processing involves transferring Personal Data out of the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the parties incorporate the European Commission's Standard Contractual Clauses (Decision 2021/914) by reference, Module Two (controller to processor), with you as data exporter and us as data importer.

For those Clauses: the optional docking clause applies; Clause 9 option 2 applies with the 30-day notice period in Section 5; Clause 11 does not include the optional independent dispute resolution body; Clause 17 selects the law of Ireland; Clause 18(b) selects the courts of Ireland; and Annexes I, II, and III of the Clauses are populated by the annexes below.

For UK transfers, the parties incorporate the UK International Data Transfer Addendum to the Standard Contractual Clauses, with the tables completed by reference to this DPA and its annexes. For Swiss transfers, references to the GDPR are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

12.US state privacy law

Where the CCPA applies, we act as a "service provider" with respect to Personal Data we process for you. We will not sell or share that data, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than the services specified in the Terms, and will not combine it with data from other sources except as permitted for a service provider.

We certify that we understand these restrictions and will comply with them. You may take reasonable steps to ensure our use is consistent with your obligations, and we will notify you if we determine we can no longer meet them. Comparable terms apply under the Virginia, Colorado, Connecticut, Utah, Texas, and other US state privacy laws where they govern.

13.Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms. Nothing here limits a data subject's rights under Data Protection Law or either party's liability to a supervisory authority.

Where the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail. Otherwise this DPA prevails over the Terms as to the processing of Personal Data. This DPA terminates automatically when the Terms terminate and we have completed deletion under Section 8.

Annex I: Description of processing

This annex populates Annex I of the Standard Contractual Clauses. The data exporter is the Controller identified in the account; the data importer is needs input: ENTITY_NAME, needs input: ENTITY_ADDRESS.

Annex II: Technical and organizational measures

This annex populates Annex II of the Standard Contractual Clauses and describes measures implemented in the product today.

Annex III: Authorized subprocessors

This annex populates Annex III of the Standard Contractual Clauses. The current list is maintained at /legal/subprocessors. Register at privacy@pagereflect.com to receive change notices.