Data Processing Addendum (DPA)

Version 1.0 · Effective: 2026-10-23

This Data Processing Addendum ("DPA") forms part of the agreement between the Customer and the Provider for the Consentl service the Customer uses (the "Agreement"):

• for Consentl for Shopify (the Shopify app): the Terms of Service and Schedule 1;
• for Consentl for websites (the dashboard at app.consentl.com, the API at api.consentl.com and the platform integrations): the Terms of Service for websites and Schedule 2.

The DPA is concluded electronically when the Customer accepts it as described in the applicable Schedule. The Provider keeps a record of the acceptance (document, version, date and time, the account or shop, and the person who accepted). A Customer who wants a countersigned copy can ask for one at [email protected].

Parties

• Customer: the business or person that uses a Consentl service for its online store or website and accepts this DPA, identified by its Shopify shop (Schedule 1) or by its Consentl account (Schedule 2).
• Provider: STL EMBEDED CREATIONS SRL, Str. Kovari 75, 400217 Cluj-Napoca, Cluj, Romania; trade register no. J2020001305120, fiscal code (CUI) 42512332 (not VAT-registered; intra-Community VAT code RO46686340). Contact for this DPA: [email protected].

1. Definitions and scope

1.1 "Data Protection Law" means the laws that apply to the processing under this DPA, in particular Regulation (EU) 2016/679 ("GDPR"), Directive 2002/58/EC as implemented nationally, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the CPRA ("CCPA") and the other US state privacy laws, the Canadian PIPEDA and the Quebec Act respecting the protection of personal information in the private sector ("Quebec Law 25"), and the Brazilian LGPD, each as amended, to the extent each applies.

1.2 Terms such as "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meaning given in the GDPR. For other laws they include the equivalent terms (for example "business", "service provider", "consumer" and "personal information" under the CCPA; "operador" under the LGPD).

1.3 "Customer Personal Data" means personal data that the Provider processes on behalf of the Customer in providing the service, as described in Annex I. It does not include data for which the Provider is a controller (for example the Customer's account and staff data, billing data, support correspondence and security logs). That data is described in the Provider's privacy policies.

1.4 "Notice Address" means the e-mail address to which the Provider sends notices under this DPA (section 15.4), as defined in Schedule 1, S1.6 (Shopify) or Schedule 2, S2.5 (websites).

1.5 Order of precedence: if this DPA conflicts with the Agreement, this DPA prevails. If it conflicts with Standard Contractual Clauses or other transfer clauses incorporated under section 9, those clauses prevail. A Schedule prevails over the body of this DPA for the service it covers.

2. Roles

2.1 The Customer is the controller of Customer Personal Data, or a processor acting for another controller. The Provider is a processor, or a sub-processor.

2.2 The Customer decides whether to use each function (consent banner and consent log, privacy- request form, withdrawal function, optional customer-data actions, cookie scanning) and how to configure it. The configuration the Customer chooses is an instruction (section 3).

2.3 Customer acting as processor. Where the Customer processes the data for another controller (for example an agency that manages websites or stores for its clients), the Provider is its sub-processor. The Customer warrants that its controller has authorised the use of the Provider and of the sub-processors in Annex III, passes on the controller's instructions, and forwards to its controller the notices it receives from the Provider. The Provider may rely on instructions given by the Customer as if they came from the controller.

2.4 The platform on which the Customer runs its store or website (for example Shopify, WordPress, Shopware, PrestaShop, Magento or a website builder) is not a sub-processor of the Provider. The platform processes data under its own agreements with the Customer.

3. Instructions (Art. 28(3)(a) GDPR)

3.1 The Provider processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to third countries, unless Union or Member State law to which the Provider is subject requires otherwise. In that case the Provider informs the Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

3.2 The Customer's documented instructions are: this DPA and the Agreement; the settings and actions the Customer makes in the service (for example the plan and the retention that follows from it, exports, deletions and one-click privacy actions); and other written instructions agreed by the parties.

3.3 The Provider informs the Customer immediately if, in its opinion, an instruction infringes Data Protection Law. The Provider is not obliged to carry out a legal check of instructions.

3.4 The Customer is responsible for the lawfulness of its instructions, for having a legal basis for the processing, for informing data subjects (in particular in its own privacy and cookie policy) and for configuring the service for its store or website, its trackers and the laws that apply to it.

3.5 Requests from public authorities. If a public authority requests Customer Personal Data, the Provider refers it to the Customer, informs the Customer without delay unless the law prohibits this, challenges a request it considers unlawful where it has reasonable grounds to do so, and discloses only what it is legally compelled to disclose.

4. Confidentiality (Art. 28(3)(b) GDPR)

4.1 The Provider ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access is limited to the named persons who need it to operate, support or secure the service (Annex II).

4.2 The Provider's personnel may use software tools, including AI coding assistants, to develop and maintain the service. These tools work on source code and test data. They are not given access to Customer Personal Data, to production databases or to production logs (Annex II). If the Provider ever decides otherwise, the provider of such a tool becomes a sub-processor and section 6 applies before it is used.

5. Security (Art. 28(3)(c) and Art. 32 GDPR)

5.1 The Provider implements the technical and organisational measures described in Annex II. They may be updated as technology develops, provided the overall level of protection is not reduced.

5.2 The Customer is responsible for the security of its own accounts (Shopify account, Consentl account and team members, platform admin), its staff access, its site code and the settings it chooses.

6. Sub-processors (Art. 28(2) and (4) and Art. 28(3)(d) GDPR)

6.1 General authorisation. The Customer gives general written authorisation for the Provider to engage sub-processors. The sub-processors at the date of this DPA are listed in Annex III and on the sub-processor list, which states for each one which service it is used for.

6.2 Notice of changes. The Provider informs the Customer of any intended addition or replacement of a sub-processor, or of a new purpose or location of an existing one, at least 30 days before the change, by e-mail to the Notice Address and by an entry in the change log of the sub-processor list.

6.3 Objection. The Customer may object within that period on reasonable grounds relating to data protection, by e-mail to [email protected], stating the grounds. The Provider answers within 14 days and either offers a reasonable alternative (for example not using the sub-processor for the Customer) or explains why it cannot. If the objection is not resolved within 30 days of the objection, the Customer may terminate the Agreement for the affected service with effect before the change applies to it. The Customer should export its data first (section 11).

6.4 Refund. On a termination under 6.3 the Provider refunds the fees paid for the unused part of the current billing period, as set out in the applicable Schedule.

6.5 Emergency replacement. If a sub-processor must be replaced urgently (security incident, insolvency, termination or breach by the sub-processor), the Provider may make the change with shorter notice. It informs the Customer as soon as possible. The Customer may still object under 6.3; if it terminates, the refund under 6.4 is calculated from the date of the change.

6.6 Flow-down and liability. The Provider imposes on each sub-processor, by contract, data protection obligations that are in substance the same as in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. The Provider remains fully liable to the Customer for the performance of its sub-processors' obligations, subject to section 14.

7. Assistance

7.1 Data subject requests (Art. 28(3)(e) GDPR). Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures in responding to requests to exercise data subject rights under Chapter III GDPR and equivalent rights under other laws. The service provides:

• the privacy-request form with e-mail verification and a request log with deadlines;
• CSV export of the consent log; (Schedule 1) CSV exports of privacy requests and withdrawals; (Schedule 2) a JSON export of all data of the Customer's account, including the privacy requests and withdrawals of every site;
• the withdrawal log;
• (Schedule 1, optional) export and erasure of the customer's Shopify data.

Consent records are pseudonymous: a record can be found by the consent ID that the data subject can read from the consentl cookie in their browser, using the consent log filters and the CSV export. On the Customer's written instruction, the Provider deletes individual consent records or other individual records within 30 days, until the service offers this as a function. If the Provider receives a request directly from a data subject, it forwards the request to the Customer without undue delay and does not answer it itself unless the Customer instructs it to.

7.2 Other obligations (Art. 28(3)(f) GDPR). Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification and communication to data subjects, data protection impact assessments, prior consultation) and with equivalent duties under other Data Protection Law (for example privacy impact assessments under Quebec Law 25 before data is communicated outside Quebec), in particular by providing the information in Annexes I–III.

7.3 Assistance beyond the functions of the service and reasonable e-mail support may be charged at reasonable cost if it is substantial and is not caused by the Provider's breach.

8. Personal data breaches (Art. 33(2) GDPR)

8.1 The Provider notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, including a breach at a sub-processor that the sub-processor has notified to the Provider. The Provider forwards the information it receives from a sub-processor within the same period. The notice is sent by e-mail to the Notice Address.

8.2 The notice includes, as far as available (and in phases where necessary): the nature of the breach, including the categories and approximate number of data subjects and records concerned; the contact point for more information; the likely consequences; and the measures taken or proposed, including measures to mitigate possible adverse effects (Art. 33(3) GDPR).

8.3 The Provider takes reasonable steps to contain and remediate the breach, keeps a record of breaches, and cooperates with the Customer's notification to supervisory authorities and, where required, its communication to data subjects (Art. 34 GDPR).

8.4 For personal information subject to Quebec law, the Provider also notifies the Customer without delay of any attempted violation of the confidentiality of that information of which it becomes aware.

8.5 Notification is not an acknowledgement of fault. Notices the Provider must give to a platform under its own terms (Schedule 1) do not delay the notice to the Customer.

9. International transfers

9.1 The Provider stores Customer Personal Data in the European Union (DigitalOcean, Frankfurt, Germany). Some sub-processors are established outside the EEA or may access data from there (Annex III).

9.2 Transfers to sub-processors. Transfers to sub-processors outside the EEA, Switzerland and the UK that are not covered by an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) are made under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three (processor to processor), concluded by the Provider with its direct sub-processors and by each sub-processor with its own sub-processors.

9.3 Customers in third countries (Module Four). To the extent that the Provider's disclosure of Customer Personal Data to a Customer established in a third country without an adequacy decision (for example by an export, an e-mail notification or the display of data in the dashboard) is a transfer under Chapter V GDPR, the parties incorporate Module Four (processor to controller) of the Standard Contractual Clauses by reference, with these options: Clause 7 (docking clause) included; the optional wording in Clause 11 not used; Clause 17: the law of Romania; Clause 18: the courts of Cluj-Napoca, Romania. Annexes I–III of this DPA complete the Annexes of the Standard Contractual Clauses. Where the Customer is a processor (section 2.3), Module Three applies instead, with the same options. If the European Commission adopts standard contractual clauses for importers whose processing is subject to the GDPR under its Art. 3(2), those clauses apply instead for such Customers.

9.4 United Kingdom. To the extent that a transfer by the Provider of personal data subject to the UK GDPR is a restricted transfer that is not covered by UK adequacy regulations, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies to the clauses incorporated under 9.3, with Table 1 completed with the parties' details above, Table 2 with the module and options selected in 9.3, Table 3 with Annexes I–III, and Table 4 allowing either party to end the Addendum as it provides.

9.5 Switzerland. For transfers subject to the FADP, the Standard Contractual Clauses apply with these adjustments: references to the GDPR are read as references to the FADP; the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority; and the term "Member State" includes Switzerland, so that data subjects can sue in their place of habitual residence.

9.6 Brazil. Where the LGPD applies to a transfer of personal data from the Customer to the Provider and no adequacy decision of the Brazilian authority (ANPD) covers it, the standard contractual clauses approved by ANPD Resolution CD/ANPD No. 19/2024 are incorporated, with the Customer as exporter (controller) and the Provider as importer (operator).

9.7 The Customer can ask for a copy of the safeguards relied on at [email protected].

10. US state privacy laws (CCPA/CPRA service-provider terms)

10.1 For personal information subject to the CCPA, the Customer is a "business" and the Provider is a "service provider" (Cal. Civ. Code §1798.140(ag)). The Customer discloses personal information to the Provider only for these limited and specified business purposes: recording and proving consumers' consent and opt-out choices (including opt-out preference signals such as Global Privacy Control); receiving, verifying, tracking and documenting consumer privacy requests and withdrawal requests; sending the related transactional e-mails; scanning the Customer's store or website for cookies and trackers; and the security, integrity and debugging of the service (§1798.140(e)(2), (e)(3) and (e)(5)).

10.2 The Provider shall not (§1798.100(d); 11 CCR §7051(a)):

• sell or share the personal information;
• retain, use or disclose it for any purpose (including any commercial purpose) other than the business purposes specified in 10.1, or as otherwise permitted by the CCPA and its regulations;
• retain, use or disclose it outside the direct business relationship with the Customer;
• combine it with personal information received from or on behalf of another person, or collected from the Provider's own interaction with the consumer, except as permitted by the CCPA regulations (11 CCR §7050).

10.3 The Provider complies with the obligations that apply to it under the CCPA and its regulations, provides the same level of privacy protection as the CCPA requires of businesses, and implements reasonable security procedures and practices (Cal. Civ. Code §1798.81.5). It notifies the Customer without undue delay, and in any event within five business days, if it determines that it can no longer meet these obligations.

10.4 The Customer may take reasonable and appropriate steps to ensure that the Provider uses the personal information consistently with the Customer's CCPA obligations, including the information and audit rights in section 12 (one audit in every 12-month period, and further audits in the cases listed in section 12.2), and, upon notice, to stop and remediate unauthorised use of the personal information, including by asking the Provider to confirm deletion.

10.5 The Customer informs the Provider of any consumer request under the CCPA that the Provider must comply with and gives the Provider the information it needs to comply. The Provider assists the Customer in responding to verifiable consumer requests (section 7.1).

10.6 The Provider makes available to the Customer the information it reasonably needs for its risk assessments and cybersecurity audits under the CCPA regulations, and cooperates with them.

10.7 The Provider engages any subcontractor that processes the personal information under a written contract containing the same restrictions (section 6), and certifies that it understands and will comply with the restrictions in this section 10.

10.8 For the other US state privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the other states covered by the service's region presets), the Provider is a "processor". Sections 3 to 8, 11 and 12 provide the processor terms those laws require: instructions, confidentiality, deletion or return, information, cooperation with assessments, audits (or, where the law allows, an independent audit report), and subcontractor flow-down with an opportunity to object (section 6).

10.9 The Provider does not sell or share personal information and does not use sensitive personal information for any purpose.

11. Deletion or return (Art. 28(3)(g) GDPR)

11.1 Return. The export functions of the service (CSV exports listed in the Schedules) are the means by which the Customer obtains its data. The Customer chooses return by exporting before the data is deleted.

11.2 Retention during the Agreement. Customer Personal Data is kept and deleted as stated in Annex I. Proof of consent is kept at least as long as the consent it documents is used (consent lifetime + 30 days); a plan change that shortens retention keeps the previous period for 30 days. Closed privacy requests and withdrawals are kept for 2 years by default so that the Customer can meet record-keeping duties (for example 11 CCR §7101) and are deleted automatically 3 years after they were closed. The Customer may instruct earlier deletion: in the service where a deletion function exists, otherwise by written instruction, which the Provider carries out within 30 days.

11.3 After the Agreement ends, the Provider deletes all Customer Personal Data as stated in the applicable Schedule. Copies in encrypted database backups are overwritten within the backup retention period of the managed database (daily backups and point-in-time recovery, kept for 7 days) and are not restored except for disaster recovery; if a backup is restored, deletions made since the backup are applied again. The Provider does not store or export request logs: the application logs exist only as the runtime output of the running application at DigitalOcean, which is cleared when a new version is deployed (they contain no visitor IP addresses or request bodies, Annex II). Request data at the hosting provider's edge network and Brevo's transactional e-mail logs are deleted within those sub-processors' retention periods and are not used for any other purpose. To be confirmed: DigitalOcean is confirming the retention period of its edge network.

11.4 Deletion does not apply where Union or Member State law requires the Provider to store the data; the Provider then protects it and processes it only for that purpose.

11.5 Switching (Regulation (EU) 2023/2854, Data Act). Where the Data Act applies, the Customer can switch to another provider or to its own systems as stated in the Agreement: the exportable data is the consent log, privacy requests, withdrawals, the cookie declaration and the banner settings; the Customer has a retrieval period of at least 30 days; the Provider charges no switching fee and erases the data after the retrieval period.

11.6 On request, the Provider confirms the deletion in writing.

12. Information and audits (Art. 28(3)(h) GDPR)

12.1 The Provider makes available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA and its Annexes, and, on request, the security certifications or reports of its main sub-processors (for example DigitalOcean's SOC 2 Type II report and ISO/IEC 27001 certificate) where their terms allow them to be shared.

12.2 The Provider allows for and contributes to audits, including inspections, conducted by the Customer or by an auditor mandated by it, under these conditions:

• at least 30 days' written notice;
• no more than one audit in any 12-month period, except where a supervisory authority requires it, after a personal data breach, or where the Customer has reasonable indications of non-compliance with this DPA;
• an audit by written questionnaire and documents first; an on-site or remote inspection only if the answers are not sufficient;
• during business hours, without access to other customers' data or to the Provider's trade secrets beyond what is needed;
• the auditor is bound by confidentiality and is not a competitor of the Provider;
• each party bears its own costs, unless the audit reveals a material breach by the Provider.

13. Customer obligations

The Customer:

• uses the service in accordance with Data Protection Law and gives only lawful instructions;
• informs data subjects about the processing, including the use of Consentl, in its own privacy and cookie policy, using the information in Annex I;
• configures the service correctly (regions, categories, blocking of trackers, texts) and checks the result; the Provider does not guarantee that any configuration makes the store or website compliant (see the Agreement);
• does not ask data subjects to submit special categories of data (Art. 9 GDPR) through the forms;
• answers privacy and withdrawal requests within the statutory deadlines;
• gives the Provider access credentials (Schedule 2: HTTP basic-auth credentials for scans) only for sites it is entitled to have scanned;
• keeps its Notice Address current.

14. Liability

14.1 Each party's aggregate liability arising out of or in connection with this DPA is limited to the greater of (a) three times the fees paid by the Customer for the affected service in the 12 months before the first event giving rise to liability and (b) EUR 5,000.

14.2 The limit in 14.1 does not apply to: liability for intent or gross negligence; liability towards data subjects under Art. 82 GDPR and under Clause 12 of the Standard Contractual Clauses (which cannot be limited); and liability that cannot be limited by law. Where the Customer is a consumer, section 14.1 applies only to the extent permitted by the mandatory consumer law that applies to it.

14.3 For claims under this DPA, the limit in 14.1 replaces the limitation of liability in the Agreement. Where both parties are liable to a data subject for the same damage, each party may claim back from the other the part of the compensation corresponding to the other party's part of responsibility (Art. 82(5) GDPR), within the limit in 14.1.

14.4 Fines imposed on a party by a supervisory authority are borne by that party, except to the extent they result from the other party's breach of this DPA, in which case they may be claimed within the limit in 14.1.

15. Term, changes, notices and law

15.1 This DPA applies for as long as the Provider processes Customer Personal Data and ends automatically afterwards. Sections 8, 11, 14 and 15 survive.

15.2 Changes. The Provider may update this DPA to reflect changes in law, in the service or in the sub-processors. It gives at least 30 days' notice by e-mail to the Notice Address of changes that reduce the Customer's protection; the Customer may then object and terminate as in 6.3 and 6.4. Changes required by law, or that only improve the Customer's protection, may apply sooner. Where a change concerns a clause the Customer accepted expressly (section 15.6), the Provider asks for a new express acceptance; until it is given, the previous version of that clause applies. Previous versions of this DPA remain available on request.

15.3 Evidence. The electronic records of acceptance, notices and instructions kept by the Provider are evidence of their content and date between the parties (Romanian Law 214/2024 on the use of electronic signatures).

15.4 Notices. The Provider sends notices under this DPA (sub-processor changes, breaches, changes to the DPA) by e-mail to the Notice Address defined in the applicable Schedule. The Customer keeps it current. The Customer sends notices to [email protected].

15.5 Governing law and courts. This DPA is governed by Romanian law. The competent courts of Cluj-Napoca, Romania, have exclusive jurisdiction, except where the Standard Contractual Clauses or mandatory law (including the rules that protect consumers) provide otherwise.

15.6 Express acceptance (Romanian Civil Code art. 1203). The Customer expressly accepts the following clauses of this DPA: 6.3–6.5 (objection, termination and refund mechanics), 14 (limitation of liability), 15.2 (changes) and 15.5 (governing law and exclusive jurisdiction). Business customers accept them with a separate checkbox when they accept the Agreement.

Schedule 1 — Consentl for Shopify

S1.1 Service and Agreement. The service is the Consentl app for Shopify (the "App"). The Customer is the merchant that installs it on its Shopify store. The Agreement is the Terms of Service.

S1.2 Conclusion. The DPA is accepted in the App's acceptance step (onboarding, and again for a new version that requires it), together with the Terms.

S1.3 Shopify. Shopify is not a sub-processor of the Provider. On the Customer's instruction the Provider discloses data to Shopify as the Customer's own platform: the e-mail address of a shopper who opts out of sale or sharing, or who sends a Global Privacy Control signal while logged in, so that Shopify records the opt-out on the customer (dataSaleOptOut); erasure requests forwarded through the optional one-click actions; and the published banner configuration, stored as metafields of the shop.

S1.4 Shopify compliance webhooks. The App processes Shopify's mandatory customers/data_request, customers/redact and shop/redact notifications as described in Annex I-A.

S1.5 Optional scopes. The scopes read_customers, write_customers and read_orders are requested only when the Customer enables the one-click privacy actions or the matching of withdrawals to orders, and are granted by the Customer explicitly.

S1.6 Notice Address. The privacy and security contact the Customer designates in the App's Settings. Until one is designated, the e-mail address of the Shopify store owner account as returned by Shopify, and if Shopify returns none, the store's contact e-mail address.

S1.7 Refunds. Refunds under section 6.4 are made through Shopify, as a refund or an app credit, at the Provider's choice.

S1.8 End of the Agreement and deletion. When the App is uninstalled, the Provider deletes the access token immediately and all other Customer Personal Data when Shopify sends the shop/redact notification (48 hours after uninstall), and in any case no later than 30 days after uninstall. Before uninstalling, the Customer can move to the Free plan and keep the App installed for as long as it needs to export its data (this is also the retrieval period for switching under 11.5); exports are available on every plan. The Provider e-mails the Customer a warning with the record counts when the App is uninstalled.

S1.9 Platform notices. Where Shopify's terms require the Provider to inform Shopify of a security incident affecting merchant or customer data, the Provider does so in addition to section 8.

S1.10 Annexes. Annex I-A describes the processing in the App.

Schedule 2 — Consentl for websites and the platform integrations

S2.1 Service and Agreement. The service is Consentl for websites: the dashboard at app.consentl.com, the public API at api.consentl.com (loader, banner, consent beacons, privacy and withdrawal forms, hosted cookie declaration and accessibility pages) and the cookie scanner (the "Service"), used directly or through the integrations the Provider publishes (website snippet, Google Tag Manager template, WordPress/WooCommerce, Shopware, PrestaShop and Magento plugins, and guides for other website builders). The Agreement is the Terms of Service for websites.

S2.2 Conclusion. Business customers accept the DPA with a checkbox when they create their account, and again for a new version that requires it; an account that has not accepted the current version is asked to do so before it can continue to use the dashboard. For customers who use the Service as consumers, the DPA forms part of the Terms of Service for websites that they accept when they create their account.

S2.3 Integrations. The integrations run on the Customer's own server or platform. They store no personal data of visitors there. Their server-side calls to api.consentl.com (checking the site key, fetching the loader so that it can be placed in the page) carry only the site key, the language and the site's host name. Customer Personal Data is processed by the Provider only when visitors' browsers call api.consentl.com. The Provider is not a processor for the Customer's platform or shop system.

S2.4 Data flows. Annex I-B lists the data: consent records (including records sent without a verifiable browser origin, which are accepted with stricter limits), banner counters, privacy requests and withdrawals sent through the forms, e-mails to visitors, cookie scans of the Customer's sites and, on the Enterprise plan, the HTTP basic-auth credentials the Customer gives for scanning protected sites.

S2.5 Notice Address. The notice address the Customer sets on the Account page, once it is confirmed (through the confirmation link, or because it is the verified address of a member of the account). Until one is confirmed, the verified e-mail addresses of the account owners and admins.

S2.6 Refunds. Refunds under section 6.4 are made through Stripe to the original payment method, pro rata for the unused part of the paid period.

S2.7 End of the Agreement and deletion.

• The Customer can export, at any time and on every plan, the consent log of a site as CSV and all data of its account ("Download my data (JSON)") as JSON, including every site's settings, cookie list, privacy requests, withdrawals and consent log.
• Deleting a site deletes its data at once (cascade); the dashboard asks for confirmation and recommends an export first. Deleting a site is the Customer's instruction to erase that site's data.
• When a paid subscription ends, the site moves to the Free plan and its data stays available for export (this is also the retrieval period for switching under 11.5).
• Account deletion: the account owner deletes the account in the dashboard (after cancelling paid subscriptions) or asks for it at [email protected]. The account stays available for 30 days (retrieval period: export, or cancel the deletion; banners keep working), then the account, its sites and all Customer Personal Data of those sites are deleted.
• Backups and sub-processor logs: section 11.3.

S2.8 Automatic deletion. The Service deletes automatically: consent records after the site's retention period (Annex I-B); privacy requests whose e-mail address was never confirmed 30 days after submission; every other privacy request and every withdrawal 3 years after its last change, whatever its status; daily and A/B counters after 2 years; scan results other than the latest scan of a site 400 days after the scan. Earlier deletion on the Customer's instruction: section 11.2.

S2.9 Annexes. Annex I-B describes the processing in the Service.

Annex I — Description of the processing

A. List of parties

Competent supervisory authority: the authority competent for the Customer (data exporter) under Clause 13 of the Standard Contractual Clauses; for the Provider: the Romanian ANSPDCP (www.dataprotection.ro (external site)).

Common to both services

• Categories of data subjects: visitors of the Customer's store or website (consent records, banner views); persons who submit a privacy request or a withdrawal through the store or website; (Shopify, optional) customers whose Shopify profile and orders are read or erased through the one-click privacy actions.
• Special categories of data: none intended. The Customer must not request them. Free-text fields could contain them if a requester enters them; they are protected like all other data.
• Nature of the processing: collection through the storefront or website script and forms, storage, retrieval and display to the Customer, export, transmission by e-mail, automated deletion.
• Purposes: the business purposes in section 10.1.
• Frequency: continuous, for the duration of the Agreement.
• Sub-processors: Annex III.

B. Consentl for Shopify (Annex I-A)

Categories of personal data

Retention

C. Consentl for websites (Annex I-B)

Categories of personal data

Retention

Annex II — Technical and organisational measures

Measures in place at the date of this DPA, for both services unless a product is named. Items described as planned are not in place yet. Some measures refer to the Provider's internal security and incident policy, production access register and records of processing activities; these documents are internal, and the Customer can receive a copy on request under section 12.1.

Pseudonymisation and minimisation

• IP addresses are shortened at ingestion to IPv4 /24 or IPv6 /48 before storage; the full IP is never written to the database or to application logs (it is held only in memory, Annex I).
• Consent records use a random identifier generated in the browser and are not linked to customer accounts; page URLs are reduced to the path; user agents are truncated to 400 characters.
• Banner views are stored only as daily counters; the runtime sends nothing before a decision, and a view is counted together with the visitor's first decision (no separate view request).
• Shopify: customer and order records are read from Shopify on demand and not copied, except the identifiers needed to link a request or withdrawal to the customer or order. Optional Shopify scopes for customer data are requested only when the Customer enables the functions that need them.

Encryption

• All traffic is served over HTTPS (TLS). Shopify webhooks and API calls, Stripe and Brevo API calls use TLS.
• The managed PostgreSQL databases and their backups are encrypted at rest by DigitalOcean.
• Shopify storefront passwords and website scan credentials are encrypted with AES-256-GCM; the keys are held only in the hosting platform's encrypted environment variables.
• E-mail verification and dashboard tokens are stored only as SHA-256 hashes; single-use tokens are removed or marked used after use.

Confidentiality and access control

• Shopify: admin access requires a Shopify session token verified on every request (App Bridge, token exchange); data is always scoped to the authenticated shop. Webhooks are accepted only with a valid HMAC signature.
• Websites: passwords hashed with scrypt; session tokens stored as SHA-256 hashes, 30-day lifetime and 7-day idle expiry; CSRF protection on every dashboard form; sensitive actions need a recent password confirmation; dashboard and public API on separate hosts; every site page checks the user's membership; Stripe webhooks are signature-verified.
• Public endpoints accept only a valid public key and matching host or shop domain; consent beacons are schema-validated, size-limited (4 KB) and rate-limited per IP address and per shop or site (limits are per server instance).
• Secrets (API keys, app secrets, e-mail and payment keys) are stored as encrypted environment variables of the hosting platform and in GitHub Actions secrets, never in source code.
• Production access (DigitalOcean, databases, logs) is limited to the named persons recorded in the Provider's production access register, which also records whether two-factor authentication is enabled on the accounts that give access to production systems and to the mailboxes (DigitalOcean, GitHub, Stripe, Brevo, Proton, which hosts the [email protected] and [email protected] mailboxes, the domain registrar and, for the Shopify app, the Shopify Partner/Dev Dashboard). The register is reviewed at least once a year and whenever a person joins or leaves.
• The production databases accept connections only from the Provider's own applications; local machines and CI cannot connect.
• The Provider's internal administration area (customer lists, installations, usage statistics) is read-only, is available only to named operator accounts with two-factor authentication and a recent re-authentication, shows no consent-record contents and no data of shoppers or visitors, reads the Shopify database through a read-only role limited to non-visitor columns, and logs every access (who, when, what) in an append-only audit log.
• AI coding assistants and other development tools work on source code, staging systems and test data. They never access production databases, production logs or Customer Personal Data: they do not read production logs, do not run queries or one-off jobs against production databases and do not copy production data. They may make infrastructure changes (application specifications, environment variables, secrets written without reading them). If this rule is ever changed, the provider of the tool (for example Anthropic PBC for Claude) is listed in Annex III first (section 6).
• No production personal data is placed in the source-code repository, issues, CI logs, test fixtures or screenshots.
• Shopify protected customer data: the measures attested in the Shopify Partner Dashboard are the ones described in this Annex; a copy of the attestation is kept with the DPA records. Access through the administration area is logged; other access to customer personal data by staff (for example a database job during an incident) is not yet logged individually (planned).

Separation

• Staging and production run as separate applications with separate databases; Shopify and website data are in separate databases.
• The website Service uses dedicated database users without administrator rights (the scanner has its own user, limited to the scan tables). The Shopify App currently connects with the database cluster's administrator user; a dedicated user is planned.
• The cookie-scanner worker is isolated from the web applications (separate container, a browser environment without database credentials or secrets, egress limited to public addresses on ports 80/443, a time budget per scan). It serves several environments and holds their database credentials; on the website Service's database it uses the restricted scanner role.

Integrity

• Consent records are append-only in the application (no edit function).
• Database migrations are versioned and applied automatically before each deployment.
• Changes are developed on branches and checked by automated type checking, linting, tests and builds in CI on every push. Production is deployed only from the production branch, and a merge to that branch needs the owner's explicit approval; CI must pass before production is deployed. These rules are part of the Provider's security and incident policy.

Availability and resilience

• Managed hosting with health checks and automatic restarts; managed databases with automated daily backups and point-in-time recovery, kept for 7 days.
• Previous deployments can be rolled back.

Retention and deletion

• Automated purge jobs per Annex I (every 6 hours: consent records, statistics, privacy requests, withdrawals, scans and, for websites, accounts whose deletion period has ended). Shopify: mandatory compliance webhooks.

E-mail

• Transactional e-mails are sent through the Brevo API from the consentl.com domain (SPF, DKIM, DMARC). Brevo's open and click tracking is anonymised (no engagement data linked to the recipient), and the Provider does not use engagement data.
• In production the e-mail API key is always configured; without it (development only) e-mails are written to the application log instead of being sent. A code guard that refuses to log message content in production is planned.

Logging

• Application logs contain operational data (shop domains or site ids, job results, error messages) and no visitor IP addresses or request bodies. Request logs: Annex I. The Provider does not store or forward logs: runtime logs exist at DigitalOcean only while the application runs and are cleared when a new version is deployed; build and deployment logs, which contain no personal data of visitors, are kept by DigitalOcean for 90 days. Edge-network request data: section 11.3.

Location

• Application servers and databases in Frankfurt, Germany (DigitalOcean region fra/fra1).

Organisational

• Confidentiality commitment of every person with access (section 4); written confidentiality undertakings for any staff or contractors.
• Incident response follows the Provider's written security and incident policy: detect, contain, assess within 24 hours, notify the Customer per section 8 (and, as controller, the supervisory authority within 72 hours), recover, and record every breach in a breach register. An incident lead (and, once designated, a backup contact) is named in the production access register.
• Records of processing activities as processor (Art. 30(2) GDPR) are kept and reviewed at least once a year.
• Data protection by design: privacy review of new features before release.

Annex III — Sub-processors

The authorised sub-processors at the date of this DPA. Details, locations, safeguards and the change log are on the sub-processor list.

Source: docs/legal/DPA.md in the Consentl repository.