Data Processing Agreement

This data processing agreement (the “DPA”) sets out how GrantCookie processes personal data on behalf of its customers when it provides the service. It contains the provisions that Article 28(3) of the GDPR and of the UK GDPR require between a controller and its processor, and the commitments for other data protection laws described in section 15.2. It forms part of our terms and conditions for every customer, so you do not need to sign anything separately for it to apply. It is published at grantcookie.com/dpa/, and you can also obtain a copy from privacy@grantcookie.com.

1. Parties and how this DPA is entered into

1.1 This DPA is between GrantCookie, the provider of the service (“GrantCookie”, “we”, “us” and “our”), and the customer that holds an account in the application (“you” and “your”).

1.2 This DPA forms part of our terms and conditions (the “terms”). It takes effect for you when the terms do, which under the terms is when you create an account, install the banner script on a website or otherwise use the service, whichever happens first. You agree to it on behalf of the organisation you represent. If you need a countersigned copy for your records, email privacy@grantcookie.com and we send you one. The countersigned copy states our legal name and registered address, which you can also ask for at privacy@grantcookie.com at any time.

1.3 Roles. Under this DPA you are the controller of customer personal data and we are your processor. Where you use the service for your own clients, for example as an agency that manages client websites, you act either as a processor for each client, with that client’s authority to appoint us as your sub-processor, or as a controller in your own right. In either case you must have the authority to agree this DPA for every website you connect to the service.

1.4 Order of precedence. If this DPA conflicts with the terms on a matter concerning the processing of personal data, this DPA prevails. If this DPA conflicts with the SCCs or the UK Addendum where they apply, the SCCs or the UK Addendum prevail.

2. Definitions

Words that the GDPR defines, such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority”, have the meaning given there. Words that the terms define, such as “banner script”, “consent log”, “domain”, “Free plan” and “paid plan”, have the meaning given in the terms. In this DPA:

“The website” means the public pages at grantcookie.com.
“The application” means the pages at app.grantcookie.com, where customers register, sign in and use the service.
“The service” means the cookie consent management platform we provide to customers through the website and the application: the cookie scanner, the consent banner, the per-market rules, the consent log, the cookie policy generator and the integrations, including the JavaScript API, together with related support.
“A customer” is a person or organisation that holds an account in the application. Under this DPA, the customer is you.
“A visitor” is a person who reads the website, or opens the application without signing in.
“An end user” is a person who visits a customer’s website where the banner runs.
“A working day” is any day from Monday to Friday, including public holidays.
“GDPR” means Regulation (EU) 2016/679, the General Data Protection Regulation.
“UK GDPR” means the GDPR as it forms part of the law of the United Kingdom under the European Union (Withdrawal) Act 2018, read together with the Data Protection Act 2018, as amended from time to time.
“Data protection law” means the GDPR, the UK GDPR and any other law that applies to the processing of customer personal data under this DPA, including the laws described in section 15.2.
“Customer personal data” means the personal data we process on your behalf in providing the service: the consent records in your consent log, including any you ask us to import; the technical data an end user’s browser sends when the banner loads, including any server logs that contain it; and any personal data that appears in scan results, as section 4 and Annex 1 describe.
“Consent record” means the record the service creates in your consent log when an end user makes or changes a choice in the banner.
“Sub-processor” means a third party we engage to process customer personal data on our behalf.
“SCCs” means the standard contractual clauses for the transfer of personal data to third countries set out in the annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as in force from time to time.
“EEA” means the European Economic Area.

3. Subject matter, duration, nature and purpose of the processing

3.1 Subject matter. The processing covered by this DPA is the processing of customer personal data needed to provide the service to you: serving the consent banner on the websites you connect, applying the rule you have chosen for each end user’s market, recording the choices end users make, keeping those records in your consent log so that you can demonstrate consent, making each end user’s choice available to the tags and integrations you configure, keeping the service that does this available and secure, scanning your websites, and exporting, importing or deleting consent records on your instruction.

3.2 Duration. We process customer personal data for as long as you hold an account for the service, and afterwards only for the period needed to return or delete it under section 11.

3.3 Nature. The processing consists of collecting, recording, organising, storing, retrieving, using, making available within the end user’s browser, exporting and deleting customer personal data, all by automated means. We do not use customer personal data to build profiles of end users or for advertising, and we make no decision about an end user other than applying the banner rules you have configured.

3.4 Purpose. The purpose of the processing is to let you collect, record and prove the choices that end users of your websites make, in line with the regulations you have selected in the application, and to produce your scan results. Delivering the banner and keeping the service available and secure are part of that purpose. We process customer personal data only for that purpose and as your instructions under section 5 provide, and we do not process it for any purpose of our own.

3.5 Data we process as a controller. This DPA does not cover personal data that we process as a controller under our privacy policy, which is published on the website. That data is: account data about you and the people who use your account, such as email addresses, sign-in details, names and company names where given, billing details and records of how the application is used; personal data about visitors, including the server logs of the website and the application; and personal data about people who contact us or subscribe to our newsletter. The technical data an end user’s browser sends when the banner loads, and any server logs that contain it, are customer personal data under this DPA and not data we control.

3.6 Scan results. The cookie scanner crawls the pages of the websites you connect that it can reach, and records the cookies, trackers and pixels it finds, sorted into categories, with the third parties that set them named. Scan results describe your website rather than a person. If a scanned page contains personal data about someone, for example a name in a page address, we process that personal data only to produce the scan results and treat it as customer personal data under this DPA.

4. Types of personal data and categories of data subjects

4.1 Categories of data subjects. The data subjects are the end users who visit the websites you have connected to the service. They may include your customers, prospective customers, employees and any other member of the public who visits those websites. Where a scanned page contains personal data, the data subjects also include the people it concerns.

4.2 Types of personal data. The service processes:

in each consent record, and nothing else: the choice the end user made for each cookie category (necessary, functional, analytics and marketing), whether an acceptance, a refusal or an opt-out; the date and time of the choice; the version of the banner the end user was shown, which ties the record to the text and categories the end user was presented with, so that the record shows what the end user was asked and not only what they answered; and, where you enable IAB TCF v2.3, the consent string that framework defines;
the technical data an end user’s browser sends with each request to the service, such as the IP address, the user agent string and the browser’s language setting, together with the country or region the service associates with the request. The service uses it while it handles the request, to show the banner in the end user’s language, to apply the rule you have chosen for the end user’s market and to keep the service secure. It is not added to the consent record. Our servers may record it in server logs, which we keep only for as long as we need them for those purposes and then delete on a fixed schedule, as part C of Annex 1 states;
where you send us consent records from another platform to import on a paid plan, the fields contained in the file you give us;
any personal data that appears in scan results, as section 3.6 describes.

4.3 What consent records do not contain. A consent record does not contain the end user’s name, email address, account details or IP address, and we do not link it to any other data we hold. Consent records you import hold the fields in the file you send us.

4.4 Special categories. The service is not designed to process special categories of personal data under Article 9 of the GDPR or personal data relating to criminal convictions and offences, and you must not use it to do so.

4.5 Details. Annex 1 gives the full details of the processing, including the source, purpose and retention period of each type of personal data.

5. Your instructions and responsibilities

5.1 Documented instructions. We process customer personal data only on your documented instructions, including with regard to transfers of customer personal data to a third country or an international organisation, unless a law of the European Union, a member state or the United Kingdom that applies to us requires otherwise. In that case we tell you of the legal requirement before we process the data, unless that law prohibits us from telling you on important grounds of public interest.

5.2 What your instructions are. Your documented instructions consist of:

this DPA and the terms;
the configuration choices you make in the application, including the domains you connect, the regulations you select, the banner copy and languages you set, how the banner behaves on a first visit and the integrations you enable;
your authorisation, given in section 8, of the transfers described there and in the sub-processor list;
your instruction to count pageviews on your domains so that the limits of your plan can be applied, as the terms describe;
your use of consent log export where your plan includes it, any file of consent records you send us to import, and any deletion or return instruction you give under section 11;
any further written instruction you send to privacy@grantcookie.com that we agree to follow.

5.3 Unlawful instructions. We tell you immediately if, in our opinion, an instruction infringes data protection law. We are not obliged to review your instructions for legal compliance, and telling you does not amount to legal advice.

5.4 Instructions the service does not support. If you ask us to process customer personal data in a way the service does not support as standard, we may decline, or we may agree to do the work and charge for it at a rate we tell you in advance.

5.5 Your responsibilities. You are responsible for:

deciding which regulations apply to your websites and selecting them in the application;
the lawfulness of the processing you carry out through your websites, including the cookies and trackers you set and the tags you fire once an end user has made a choice;
installing the banner script and your tags as our documentation describes, so that the banner can apply end users’ choices;
the text of the banner, your cookie policy and your privacy notice, and informing end users about the processing of their personal data, including that a consent record is kept;
the accuracy and lawful origin of any consent records you send us to import;
keeping your account credentials secure and controlling who in your organisation has access to the application;
having the authority to agree this DPA for every website you connect, including websites that belong to your clients.

5.6 Consent signals made available to third parties. When you enable Google Consent Mode v2, IAB TCF v2.3, Google Tag Manager or another integration, the service makes the end user’s choice available inside the end user’s browser so that the tags and vendors you have chosen to use can read it. Those tags and vendors receive the choice on your instruction and act for you or on their own account, not as our sub-processors. You are responsible for your relationship with them.

6. Our obligations as processor

6.1 Confidentiality. We ensure that every person we authorise to process customer personal data, whether an employee or a contractor, is bound by a written confidentiality obligation or is under a statutory duty of confidentiality, and knows that customer personal data is confidential.

6.2 Access on a need-to-know basis. We limit access to customer personal data to the people who need it to provide, support or secure the service, and we remove access when it is no longer needed. Every person with access processes customer personal data only on your instructions as set out in section 5.

6.3 Security. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to end users, we implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as Article 32 of the GDPR requires. The measures we commit to are described in Annex 2. We may update them, but we do not reduce the overall level of protection they provide during the term of this DPA.

6.4 Records of processing. We keep a record of the categories of processing we carry out on your behalf, as Article 30(2) of the GDPR requires, and make it available to a supervisory authority on request.

6.5 Data protection contact. Questions about this DPA, our sub-processors, our security measures and data protection generally, and all notices under this DPA, go to privacy@grantcookie.com. We reply within one working day.

7. Sub-processors

7.1 General authorisation. You give us a general written authorisation to engage sub-processors to help us provide the service, such as hosting and infrastructure providers that run the application, store data and deliver the banner script, email delivery providers and the tools we use to run support. Where a sub-processor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that sub-processor’s obligations.

7.2 Terms with sub-processors. Before a sub-processor processes customer personal data, we assess its security and put in place a written contract that imposes on it data protection obligations no less protective than those in this DPA, in particular the confidentiality, security, international transfer and deletion obligations.

7.3 Current list. The current list of our sub-processors, stating each one’s function and the country in which it processes customer personal data, is available on request from privacy@grantcookie.com. We keep the list up to date and send you the current version whenever you ask.

7.4 Changes and your right to object. We notify you by email to the address on your account at least 30 days before we add or replace a sub-processor, and we describe what the new sub-processor will do. If you have reasonable grounds relating to data protection to object, tell us by email to privacy@grantcookie.com within those 30 days. We then work with you in good faith to resolve the objection, for example by not using the new sub-processor for your data where the service allows it. If we cannot resolve the objection within 30 days of receiving it, you may close your account with immediate effect by notice to privacy@grantcookie.com, and we refund the fees you have paid for the part of the billing period after closure. Section 6.7.2 of the terms lists this refund among the exceptions to its no-refund rule. If you do not object within the 30 days, the change is accepted.

7.5 Urgent replacements. If we must replace a sub-processor urgently to maintain the security or availability of the service, we may do so with less than 30 days’ notice. We notify you as soon as we can, and your right to object under section 7.4 runs from the date of that notice.

8. International transfers

8.1 Where data is processed. We and our sub-processors may process customer personal data in countries other than the one in which you are established. On request to privacy@grantcookie.com we tell you the country in which we are established, and the sub-processor list in section 7.3 states the country of processing for each sub-processor.

8.2 Transfer conditions. We do not transfer customer personal data that is protected by the GDPR or the UK GDPR to a country outside the EEA or the United Kingdom, and we do not allow a sub-processor to do so, unless one of the following applies:

for transfers from the EEA, the destination country, territory or sector benefits from an adequacy decision of the European Commission, and for transfers from the United Kingdom, transfers to the destination are approved by regulations made under UK data protection law;
the transfer is covered by the SCCs and, for transfers from the United Kingdom, the UK Addendum, or by another transfer mechanism that data protection law recognises;
the transfer is otherwise permitted by data protection law.

8.3 Incorporation of the SCCs. Where providing the service involves a transfer of customer personal data from you to us that needs a transfer mechanism, the SCCs are incorporated into this DPA and apply as follows:

Module Two (transfer from controller to processor) applies where you act as a controller, and Module Three (transfer from processor to processor) applies where you act as a processor for your own clients;
you are the data exporter and we are the data importer;
Clause 7, the docking clause, applies;
in Clause 9, Option 2 (general written authorisation) applies, and the notice period is the period in section 7.4;
in Clause 11, the optional language on an independent dispute resolution body does not apply;
in Clause 13, the competent supervisory authority is determined in accordance with Clause 13(a) and Annex I.C, completed by part B of Annex 1 of this DPA;
in Clause 17, Option 2 applies: the SCCs are governed by the law of the EU member state in which you are established or, where you are not established in an EU member state, by the law of the EU member state whose supervisory authority is competent under Clause 13;
in Clause 18, disputes are resolved by the courts of the EU member state whose law governs the SCCs under Clause 17;
Annex I of the SCCs is completed with section 1 and Annex 1 of this DPA, Annex II of the SCCs is completed with Annex 2 of this DPA, and Annex III of the SCCs is the sub-processor list referred to in section 7.3;
the parties are treated as having signed and dated the SCCs, their annexes and, where it applies, the UK Addendum on the date this DPA takes effect under section 14.1.

8.4 Transfers from the United Kingdom. For transfers of customer personal data that are subject to the UK GDPR, the SCCs as completed in section 8.3 apply together with the UK Addendum. Table 1 of the UK Addendum is completed with the parties’ details in section 1 and part A of Annex 1, and its start date is the date this DPA takes effect. Table 2 is completed with the version of the SCCs described in section 8.3, Table 3 with Annex 1, Annex 2 and the sub-processor list, and in Table 4 either party may end the UK Addendum as set out in section 19 of the UK Addendum.

8.5 Assessment and supplementary measures. Before we rely on the SCCs for a transfer, we assess whether the law and practice of the destination country would prevent the data importer from meeting its obligations under the SCCs, and we apply the supplementary measures needed, including encryption in transit and at rest as described in Annex 2. If we receive a legally binding request from a public authority for access to customer personal data, we notify you before we respond unless the law prohibits it, we challenge the request where there are reasonable grounds to do so, and we disclose only the minimum the law requires.

8.6 If a transfer mechanism stops being valid. If a transfer mechanism we rely on is invalidated or becomes inadequate, we work with you to put an alternative mechanism in place without delay. Until then, we suspend the transfer concerned so far as we can while continuing to provide the service. If we cannot do so, you may suspend the transfer or terminate the affected part of the service by written notice to privacy@grantcookie.com.

9. Assistance with data subject requests, security and impact assessments

9.1 Requests from end users. If an end user contacts us directly about personal data we process on your behalf, we do not respond on the substance. We reply within one working day, tell the end user to contact you and, where we can identify you from the request, forward it to the email address on your account.

9.2 Helping you respond. Taking into account the nature of the processing, we help you, by appropriate technical and organisational measures, to respond to requests from end users to exercise their rights under Chapter III of the GDPR, including the rights of access, rectification, erasure, restriction, portability and objection. Where your plan includes consent log export, you can export the records yourself from the application. Where you cannot complete a request through the application, send it to privacy@grantcookie.com and we complete it for you without undue delay and in any case in time for you to meet the statutory deadline that applies to the request, provided you forward it to us promptly after receiving it.

9.3 Identifying an end user. Consent records do not contain an end user’s name, email address, account details or IP address, so a record usually cannot be found from those details alone. You are responsible for verifying the identity of an end user who makes a request and for giving us the details that let us find the record concerned. Where we can find it, we export or delete it as you instruct.

9.4 Security, impact assessments and prior consultation. Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 of the GDPR so far as they concern the service, including by carrying out the security measures in Annex 2, notifying you of personal data breaches under section 10, and helping you carry out data protection impact assessments and, where required, consult a supervisory authority in advance. Annex 1, Annex 2 and the sub-processor list contain the information you usually need. If you need more, email privacy@grantcookie.com. We reply within one working day and answer in full without undue delay.

9.5 Charges. We provide the assistance in this section free of charge where it relates to the standard features of the service. Where a request needs substantial work beyond that, we may charge for the time at a rate we tell you in advance.

10. Personal data breaches

10.1 Notification. If we become aware of a personal data breach affecting customer personal data, we notify you without undue delay, and in any case within 72 hours of becoming aware of it. We send the notification by email to the address on your account and to any additional security contact address you have sent to privacy@grantcookie.com.

10.2 Content of the notification. So far as the information is available to us at the time, the notification describes the nature of the breach, the categories and approximate number of end users and consent records concerned, the likely consequences, the measures we have taken or propose to take to address the breach and reduce its effects, and a contact point for more information. Where we cannot provide all of this at once, we provide it in phases without further undue delay.

10.3 Cooperation. We cooperate with you and take the reasonable steps you ask of us to help you investigate, contain and remedy the breach and to meet your own duties to notify supervisory authorities and end users. We do not notify a supervisory authority or end users of a breach affecting customer personal data on your behalf unless you ask us to in writing or the law requires us to.

10.4 No admission. A notification under this section is not an admission of fault or liability.

10.5 Incidents that are not breaches. Unsuccessful attempts that do not compromise the security of customer personal data, such as blocked sign-in attempts, port scans or denial of service attempts that do not affect data, are not personal data breaches, and we do not notify them individually.

11. Return and deletion

11.1 Deletion during the service. You may instruct us at any time to delete the consent records for a domain, or particular consent records, by email to privacy@grantcookie.com. We carry out the deletion without undue delay and confirm it to you.

11.2 Retention while your account is open. We keep consent records for as long as your account is open, unless you instruct us to delete them earlier. The end of a trial, a move to the Free plan, a suspension under the terms and the disconnection of a domain are not instructions to delete: the consent records concerned stay with your account until you instruct us to delete them under section 11.1 or your account closes, when section 11.3 applies.

11.3 Return or deletion when your account closes. When your account closes, whether you or we close it, you choose whether we return or delete customer personal data. For 30 days after closure you may ask us at privacy@grantcookie.com for a copy of your consent records, and we send it to you in a common machine-readable format, whatever plan you were on. You may instead instruct us to delete the data at once.

11.4 Deletion after closure. When those 30 days have passed, or earlier if you instruct us, we delete customer personal data from our production systems without undue delay. It is removed from our backups as those backups expire on a fixed schedule, and until then we keep the backups protected under Annex 2 and use them for no other purpose. On request we tell you the maximum period for which a backup is kept. Once removed from backups, the data cannot be recovered.

11.5 Retention required by law. We may keep a copy of customer personal data where a law of the European Union, a member state or the United Kingdom that applies to us requires it. In that case we keep the copy only for as long as that law requires, keep it confidential and process it for no other purpose.

11.6 Confirmation. On request, we confirm in writing that deletion has been completed.

12. Audits and information

12.1 Information. We make available to you all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR and in this DPA. In the first instance we do this by answering your security reviews and questionnaires and by providing documentation, including Annex 2, our sub-processor list and summaries of the results of the security testing described in Annex 2. Send requests to privacy@grantcookie.com.

12.2 Audits. You, or an independent auditor you appoint who is bound by confidentiality and is not a competitor of ours, may audit, including by inspection, our compliance with this DPA once in any period of 12 months, and additionally where a supervisory authority requires it or after a personal data breach affecting your data. You give us at least 30 days’ written notice, we agree the scope, timing and duration in advance, and the audit takes place during normal business hours with the least possible disruption to our operations and to other customers. Where an audit needs access to a sub-processor’s premises or systems, we obtain the access the sub-processor’s contract allows and otherwise provide the sub-processor’s own audit reports or summaries.

12.3 Costs and findings. Each party bears its own costs of an audit. You give us a copy of the findings, and we correct any non-conformity the audit identifies within a reasonable time that we agree with you. The findings are confidential information of both parties.

12.4 Supervisory authorities. We cooperate with a supervisory authority that has jurisdiction over the processing, including by making information available and submitting to an audit, as data protection law requires.

13. Liability

13.1 Each party’s liability to the other arising out of or in connection with this DPA, including the SCCs and the UK Addendum where they apply between the parties, is subject to the exclusions and limitations of liability in section 13 of the terms, so far as the SCCs and the UK Addendum allow. Those exclusions and limitations apply to the terms and this DPA together, as a single aggregate, and not separately to each.

13.2 Section 13.2 of the terms excludes liability for loss of or damage to data except to the extent it results from our breach of this DPA. Loss of or damage to customer personal data caused by our breach of this DPA is therefore not excluded, but it is subject to the limit on total liability in section 13.3 of the terms.

13.3 Nothing in this DPA limits either party’s liability towards a data subject or a supervisory authority under Article 82 of the GDPR or any other provision of data protection law, or any liability that cannot be limited by law.

13.4 Nothing in this DPA limits the rights that the SCCs give to a data subject as a third-party beneficiary.

13.5 You are responsible to us, as sections 8.4 and 8.5 of the terms provide, for loss we suffer because you connected a website to the service without the authority that sections 1.3 and 5.5 require.

14. Term and changes to this DPA

14.1 Term. This DPA takes effect when the terms take effect for you under section 1.2, and continues for as long as we process customer personal data on your behalf, including the return and deletion period in section 11, even if the terms have ended.

14.2 Changes. We may update this DPA where a change in data protection law, in the SCCs or in the service requires it. We notify you by email at least 30 days before an update takes effect, unless the law requires a shorter period, and we publish the updated DPA at grantcookie.com/dpa/. We do not make an update that reduces the protection this DPA gives to customer personal data unless data protection law requires it. If an update materially reduces your rights under this DPA and you do not accept it, you may close your account with immediate effect by notice to privacy@grantcookie.com before the update takes effect, and we refund the fees you have paid for the part of the billing period after closure. Section 6.7.2 of the terms lists this refund among the exceptions to its no-refund rule.

15. General

15.1 UK GDPR. Where the UK GDPR applies to the processing, references in this DPA to the GDPR and to its articles are read as references to the UK GDPR and to the corresponding provisions of the UK GDPR and the Data Protection Act 2018, references to the European Union or a member state are read as references to the United Kingdom, and references to a supervisory authority are read as references to the Information Commissioner.

15.2 Other data protection laws. Where you are subject to a data protection law other than the GDPR or the UK GDPR that requires specific terms between you and your processor or service provider, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, the consumer privacy laws of other US states, and India’s Digital Personal Data Protection Act, 2023:

we act as your processor, service provider or data processor, as that law describes the role, and process customer personal data only for the business purposes described in section 3 and on your instructions under section 5;
we do not sell or share customer personal data, as that law defines those terms, and we do not retain, use or disclose it for any other purpose, or outside our direct business relationship with you, except as that law permits;
we do not combine customer personal data with personal data we receive from anyone else, or collect ourselves, except as that law permits;
we comply with the obligations that law places on us and give customer personal data the level of privacy protection it requires;
the confidentiality, security, sub-processor, assistance, breach notification, deletion and audit commitments in this DPA apply to that data, and you may take reasonable steps, including under section 12, to make sure we use it in line with your obligations and to stop and remedy any use that is not authorised;
we tell you if we can no longer meet these commitments.

15.3 Governing law. This DPA is governed by the law that governs the terms, and disputes are resolved as the terms provide, except where the SCCs or the UK Addendum require otherwise for the matters they cover.

15.4 Severance. If a provision of this DPA is found to be invalid, the rest of the DPA continues to apply, and the parties replace the invalid provision with a valid one that achieves the same purpose so far as possible.

15.5 Notices. Notices to us under this DPA, including objections and instructions, go to privacy@grantcookie.com, as section 17.6 of the terms also provides. Notices to you go to the email address on your account, so keep that address current. A notice sent by email is treated as received on the next working day after it is sent.

15.6 Entire agreement on processing. This DPA, together with the terms and, where they apply, the SCCs and the UK Addendum, is the complete agreement between the parties on the processing of customer personal data and replaces any earlier data processing agreement between us.

16. Annex 1: details of processing

This annex describes the processing in the detail that Article 28(3) of the GDPR requires and completes Annex I of the SCCs and Tables 1 and 3 of the UK Addendum where they apply.

A. Parties

Role	Party	Contact and activities
Data exporter (controller, or processor acting for its own clients)	You, the customer named on the account	The email address on your account. Activities: operating one or more websites on which the consent banner is shown to end users and for which consent records are kept.
Data importer (processor)	GrantCookie	privacy@grantcookie.com, for the attention of the member of staff responsible for information security and data protection. Our legal name and registered address are stated in the countersigned copy of this DPA that you can request under section 1.2. Activities: providing the cookie consent management service described in this DPA.

Each party is treated as having signed and dated this annex on the date this DPA takes effect, as section 8.3 provides.

B. Description of the processing

Item	Detail
Subject matter	Providing the consent banner, the per-market rules, the consent log, the cookie scanner and the integrations of the service for the websites you connect.
Categories of data subjects	End users who visit the websites you have connected to the service, and any person whose personal data appears on a page the scanner crawls.
Categories of personal data	In each consent record, and nothing else: the choice for each cookie category, the date and time of the choice, the banner version shown and, where you enable IAB TCF v2.3, the consent string that framework defines. Also: technical data sent with each request, such as the IP address, user agent string and browser language setting, and the country or region associated with the request; the fields of any consent records you send us to import; and any personal data that appears in scan results.
Special categories	None. The service is not designed for them and you must not use it to process them.
Nature of the processing	Collection, recording, organisation, storage, retrieval, use, making available within the end user’s browser, export and deletion, all by automated means.
Purpose of the processing	To let you collect, record and prove end users’ choices in line with the regulations you have selected in the application, and to produce your scan results, including delivering the banner and keeping the service available and secure.
Frequency	Continuous, each time an end user is shown the banner or makes or changes a choice, plus each scheduled scan, and export, import and deletion on your instruction.
Duration and retention	For the term of your account and afterwards for the return and deletion period in section 11. Retention for each type of personal data is in part C.
Transfers to sub-processors	For the functions and in the countries stated in the sub-processor list available from privacy@grantcookie.com, for the duration in this part B, under the safeguards in section 8.
Competent supervisory authority	For processing subject to the GDPR: the supervisory authority of the EU member state in which you are established or, if you are not established in the EU, the authority of the member state in which your representative under Article 27 of the GDPR is established or, if you do not need one, of the member state in which the end users concerned are located, as Clause 13(a) of the SCCs provides. For processing subject to the UK GDPR: the Information Commissioner.

C. Types of personal data

Personal data	Source	Why we process it	How long we keep it
The choice for each cookie category (acceptance, refusal or opt-out)	The end user’s interaction with the banner	To apply the end user’s choice on your website and to record it so that you can demonstrate it	For as long as your account is open, unless you instruct us to delete it earlier, and then as section 11 provides
Date and time of the choice	Generated by the service when the choice is made or changed	To show when consent was given, changed or withdrawn	Same as the choice
Banner version shown, which ties the record to the text and categories the end user was presented with	Your configuration at the time the banner was shown	To show what the end user was asked, not only what they answered	Same as the choice
IAB TCF v2.3 consent string, where you enable that framework	Generated by the service from the end user’s choice	To make the end user’s choice available to vendors in the format that framework defines	Same as the choice
Technical data sent with each request, such as the IP address, user agent string and browser language setting, and the country or region associated with the request	The end user’s browser, when it requests the banner or records a choice	To deliver a banner that works in the end user’s browser and language, to apply the rule you have chosen for the end user’s market, and to keep the service secure	Used while the request is handled and not added to the consent record. Server logs that contain it are kept only for as long as we need them to deliver the banner and keep the service secure, then deleted on a fixed schedule. On request we tell you the period.
Imported consent records	The CSV file you send us on a paid plan	To continue your audit trail from a previous platform	Same as the choice
Personal data that appears in scan results	The pages of your website that the scanner crawls	To produce the scan results for your website	For as long as your account is open, and then as section 11 provides

17. Annex 2: security measures

This annex describes the technical and organisational measures we implement and maintain under section 6.3. It completes Annex II of the SCCs and Table 3 of the UK Addendum where they apply.

A. Organisational measures

Responsibility. We assign responsibility for information security and data protection to a named member of staff, who can be reached through privacy@grantcookie.com.
Policies. We keep written information security and data protection policies, review them at regular intervals and after any significant change to the service or to the risks, and update them where needed.
Confidentiality. Every person we authorise to process customer personal data is bound by a written confidentiality obligation, or is under a statutory duty of confidentiality, before receiving access, as section 6.1 provides.
Training. Every person with access to customer personal data receives security and data protection training before receiving access and at regular intervals afterwards.
Access control. We grant access to customer personal data on the principle of least privilege, review access rights at regular intervals and remove access promptly when a person leaves or changes role.
Sub-processors. We assess the security of a sub-processor before engaging it, put a written contract in place as section 7.2 describes, and review each sub-processor at regular intervals and after any significant change to the service or to the risks.
Incidents. We keep a written procedure for detecting, containing, assessing and recording security incidents and for notifying you under section 10, and we test it at regular intervals.
Continuity and restoration. We keep a plan for restoring the availability of, and access to, customer personal data in a timely manner after a physical or technical incident, and we test restoration from backups at regular intervals.
Records. We keep the record of processing that section 6.4 describes.

B. Technical measures

Encryption in transit. Customer personal data travelling between an end user’s browser and the service, and between your browser and the application, is encrypted using TLS.
Encryption at rest. We encrypt customer personal data where it is stored, including in backups.
Pseudonymisation and minimisation. Consent records contain only the items listed in section 4.2. They do not contain an end user’s name, email address, account details or IP address, and we do not link them to any other data we hold. We design the banner script to collect only the data described in Annex 1.
Separation of customers’ data. We keep each customer’s personal data separate from other customers’ data, and the application shows it only to the people authorised on the account that owns it.
Administrative access. We restrict access to the systems that hold customer personal data to authorised staff, and we keep a record of administrative access to those systems.
Monitoring. We monitor the service for failures and for suspicious activity, and we act on what we find without waiting for a customer report.
Vulnerability management. We apply security updates to the systems that run the service promptly and in an order that reflects their severity, and we check our systems and the software we depend on for known vulnerabilities at regular intervals.
Security testing. We regularly test, assess and evaluate the effectiveness of these measures, including by testing the application and the banner script for security weaknesses, and we fix what we find according to its severity.
Backups. We back up customer personal data regularly and protect backups to the same standard as the data in production.
Deletion. We carry out deletion as section 11 provides, and backups and server logs expire on fixed schedules so that deleted data does not persist in them beyond those schedules.

C. Measures to help you meet your obligations

Export of consent records from the application, where your plan includes consent log export, and a copy on request after your account closes, under sections 9.2 and 11.3.
Finding, exporting and deleting consent records on your instruction, under sections 9.3 and 11.1.
Notification of personal data breaches within 72 hours of our becoming aware of them, under section 10.
Information for your impact assessments and consultations with supervisory authorities, under section 9.4.
The same measures, so far as they are relevant to the processing a sub-processor carries out, are required of each sub-processor under section 7.2.