Data processing agreement
How we process personal data on your behalf. It applies automatically as part of our terms of service.
Effective
1. Parties and application
This data processing agreement (“DPA”) is between Serpfull (“processor”) and the customer that agreed to our Terms of service (“controller”). It applies automatically whenever we process personal data on the customer’s behalf, and it prevails over the Terms if they conflict on data protection. It meets the requirements of Article 28 of the UK GDPR and the EU GDPR.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter and duration | Providing the Service for the length of the Terms, plus the deletion period in section 9 |
| Nature and purpose | Collecting, storing, analysing, displaying and deleting data to provide Analytics, Recordings, Cookie consent, Bot protection, status pages, reports, alerts and integrations |
| Data subjects | Visitors to the controller’s websites; people who submit the controller’s protected forms; status page subscribers and report recipients; the controller’s users |
| Personal data | Online identifiers, shortened or hashed IP addresses, approximate location, device and browser details, pages viewed and interactions, masked session recordings, consent choices, form check signals and email addresses or phone numbers of subscribers and recipients |
| Special category data | None. The controller must not configure the Service to process it |
3. Our obligations
- Process personal data only on the controller’s documented instructions, which are the Terms, this DPA and the controller’s settings, unless the law requires otherwise (in which case we’ll tell the controller unless the law forbids it). We’ll tell the controller if we think an instruction breaks data protection law.
- Make sure everyone authorised to process the data is bound by confidentiality.
- Apply the security measures in section 5.
- Help the controller, taking into account the nature of the processing, to respond to data subject requests, carry out data protection impact assessments and consult regulators.
- Make available the information needed to show compliance with this DPA and allow audits as described in section 8.
4. The controller’s obligations
The controller is responsible for having a lawful basis for the processing, giving visitors and subscribers the information the law requires, getting any consent needed (including for cookies and similar technologies), and the accuracy and lawfulness of the data and instructions it gives us.
Service improvement. The controller instructs and authorises us to use personal data processed under this DPA, de-identified or aggregated where practical, to train and improve our AI features and the Service, as described in the Terms and our Privacy policy. For that limited use we act on our own legitimate interests. The controller can opt out at any time by emailing support@serpfull.com, and we’ll then stop using its data for this purpose.
5. Security measures
- Encryption in transit (TLS) and encryption of credentials, tokens and secrets at rest.
- Masking of form fields and personal details in the visitor’s browser before recordings are uploaded; shortening and salted hashing of IP addresses in consent logs.
- Logical separation of each customer’s data with row-level access controls.
- Two-factor authentication, role-based permissions and least-privilege staff access, with staff access logged in the customer’s audit log.
- Backups, monitoring, rate limiting and abuse protection.
- Retention limits that delete data automatically at the end of the periods in our Privacy policy.
6. Sub-processors
The controller gives general authorisation for us to use sub-processors in the categories listed in our Privacy policy. We’ll give at least 30 days’ notice of a new sub-processor; the controller may object on reasonable data protection grounds, and if we can’t resolve the objection, may end the affected Service and receive a refund of prepaid fees for it. We impose data protection obligations on each sub-processor equivalent to this DPA and remain responsible for them.
7. International transfers
We transfer personal data outside the UK or EEA only with appropriate safeguards: adequacy regulations or decisions, or the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses (module 2 or 3 as relevant), which are incorporated by reference where needed.
8. Breaches and audits
We’ll notify the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own duties, and we’ll take reasonable steps to contain it.
On reasonable written request, no more than once a year (or after a breach or at a regulator’s request), we’ll answer security questionnaires and provide relevant documentation. Where that isn’t enough, the controller may carry out an audit by an independent auditor bound by confidentiality, on 30 days’ notice, at its own cost.
9. Return and deletion
The controller can export its data from the dashboard and API at any time. When an organisation is deleted or the Terms end, we delete the personal data within 30 days, and from backups in the normal backup cycle, unless the law requires us to keep it.
10. General
Each party’s liability under this DPA is subject to the limits in the Terms. This DPA is governed by the law of England and Wales. Questions: support@serpfull.com.
Effective 26 October 2026.