Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement under which Axion London Limited, trading as Kontala ("Kontala", "we"), provides Kontala Marketing OS to a customer ("Customer", "you"), such as an order form and the terms it incorporates (the "Agreement"). It applies whenever Kontala processes personal data on your behalf in providing the Services, and needs no separate signature. If you need a countersigned copy, email privacy@kontala.com.

If this DPA conflicts with the rest of the Agreement on the processing of personal data, this DPA prevails.

1. Definitions

In this DPA:

• Customer Personal Data means personal data that Kontala processes on your behalf in providing the Services.
• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 and, where they apply to the processing, the EU GDPR and the Swiss Federal Act on Data Protection.
• Services means the Kontala Marketing OS services provided under the Agreement, which today are Data Capture and Analytics.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor means a third party that Kontala engages to process Customer Personal Data.

Controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in Data Protection Law.

2. Roles and scope

2.1 You are the controller of Customer Personal Data, and Kontala is your processor. Annex 1 describes the processing.

2.2 This DPA does not cover personal data that Kontala controls itself, such as the account details of your people who use the Services and our records of our relationship with you. Our Privacy Notice covers that data.

3. Your instructions

3.1 Kontala will process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law forbids that.

3.2 Your instructions are the Agreement, this DPA, and the choices you make in the Services, such as the properties you create, the capture features and data layer fields you turn on, the page and click types you confirm, and the people you give access to. Any further instruction must be in writing and consistent with the Agreement.

3.3 We will tell you promptly if, in our opinion, an instruction infringes Data Protection Law.

4. Your responsibilities

4.1 You are responsible for having a lawful basis for the processing you instruct, and for giving your website visitors the information Data Protection Law requires, including a notice that describes Kontala's cookies and what you capture.

4.2 Consent is your configuration. Unless you configure it otherwise, the Kontala tag treats every visitor as consenting: it writes its cookies and captures everything you have turned on from the first page view. Where the law requires consent before visitors are measured, you must set the tag to wait for an answer (data-consent="unknown") and pass your visitors' choices to it, as described in Consent. The tag records, but does not act on, the Global Privacy Control and Do Not Track signals; if you choose to honour them, your site must pass denied to the tag.

4.3 You decide what is captured, and you must not use the Services to capture special category data, data about criminal convictions, or payment card numbers. Use data-ac-ignore or data-ac-mask around parts of your pages that could reveal such data, and do not capture data layer fields or form values you have no need for.

4.4 You are responsible for the accuracy of the personal data you send, such as the user ids you pass to the tag, and for the security of the accounts your people use to access the Services.

5. Kontala's obligations

5.1 Confidentiality. Kontala will ensure that everyone it authorises to process Customer Personal Data is under a duty of confidentiality, and that access is limited to those who need it to provide, secure or support the Services.

5.2 Security. Kontala will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, including those in Annex 2. We may change these measures, provided the overall level of protection is not reduced.

5.3 Data subject requests. Kontala will tell you without undue delay if we receive a request from a data subject about Customer Personal Data, and will not respond to it ourselves except to direct the person to you. Taking into account the nature of the processing, we will help you to respond, including by finding, exporting or deleting the Customer Personal Data linked to an identifier you give us, such as a device id, user id or email address, in time for you to meet your legal deadline.

5.4 Assistance. Taking into account the nature of the processing and the information available to us, Kontala will give you reasonable help with your obligations on security, Security Incident notification, data protection impact assessments and prior consultation with supervisory authorities.

6. Security Incidents

6.1 Kontala will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a Security Incident.

6.2 Our notice will describe, as far as we then know, the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures we have taken or propose to take. We will provide further information as it becomes available.

6.3 Kontala will take reasonable steps to contain and investigate the Security Incident and to reduce its effects. Notifying you of a Security Incident is not an admission of fault or liability.

7. Sub-processors

7.1 You give Kontala general authorisation to engage Sub-processors. The Sub-processors we use today are listed on our Sub-processors page.

7.2 Kontala will impose on each Sub-processor, by written contract, data protection obligations that give at least the same protection as this DPA, and remains liable to you for each Sub-processor's performance of those obligations.

7.3 Kontala will tell you at least 30 days before a new Sub-processor starts processing Customer Personal Data, by email to your organisation's admins and by updating the Sub-processors page.

7.4 You may object to a new Sub-processor on reasonable data protection grounds by emailing privacy@kontala.com within 14 days of our notice. We will then work with you in good faith to resolve your objection. If we cannot, you may end the affected Services by written notice, and we will refund any fees you have paid in advance for the period after they end.

8. Where Customer Personal Data is processed

8.1 Kontala stores and processes Customer Personal Data in the European Union. A Sub-processor may process it elsewhere only as its entry on the Sub-processors page states.

8.2 Kontala will transfer Customer Personal Data to a country without an adequacy decision or regulations under Data Protection Law only under a transfer mechanism that Data Protection Law recognises, such as the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the EU standard contractual clauses themselves.

8.3 Where you are in the European Economic Area or Switzerland and the processing involves a restricted transfer from you to Kontala in the UK, the European Commission's adequacy decision for the United Kingdom applies. If that decision ends, the parties will put in place the EU standard contractual clauses (module two, controller to processor), which will then form part of this DPA.

9. Shared classification models

9.1 Kontala recognises the types of pages, clicks and data layer fields on your site with machine learning models that are trained on all our customers' data in a region and used for all of them. You instruct Kontala to use Customer Personal Data to train and improve those models, unless you opt out.

9.2 The models learn from how pages, clicks and data layers are structured and labelled, and keep aggregated statistics, not records of individual visits or visitors. Copies of Customer Personal Data made for training are deleted within 180 days of being made.

9.3 You can opt out at any time, separately for the page type, click type and data layer models, in the Services. Opting out leaves your data out of every training run after it.

10. Retention, return and deletion

10.1 During the Agreement, Kontala keeps captured events for 400 days, after which they are deleted automatically. Results and downloads from Kontala Analytics are deleted after 7 days.

10.2 Before the Agreement ends, you can download data from Kontala Analytics.

10.3 Within 90 days after the Agreement ends, Kontala will delete all Customer Personal Data, unless the law requires us to keep it, in which case this DPA continues to protect it for as long as we hold it. On request, we will confirm the deletion in writing.

11. Information and audits

11.1 Kontala will make available to you the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR, including answers to reasonable security questionnaires.

11.2 Where that information is not enough to demonstrate compliance, or a supervisory authority requires it, Kontala will allow an audit by you, or by an independent auditor you appoint who is bound by confidentiality, no more than once in any 12 months, on at least 30 days' written notice, during business hours and without disrupting the Services or other customers' data. You will bear the cost of an audit you request.

12. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under Data Protection Law.

13. Term and changes

13.1 This DPA lasts for as long as Kontala processes Customer Personal Data.

13.2 Kontala may update this DPA to reflect changes in Data Protection Law, the Services or our Sub-processors, provided that an update does not reduce the protection it gives Customer Personal Data. We will tell you of material changes by email to your organisation's admins.

14. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the EU standard contractual clauses require otherwise.

Annex 1: Details of the processing

Depending on the capture features and data layer fields the Customer turns on, the personal data processed can include:

• Online identifiers: random device and visit ids stored in first-party cookies; user and organisation ids the Customer passes to the tag, which can be email addresses; usernames or email addresses typed into sign-in forms; Shopify client and customer ids; ids from other analytics tools present in the data layer; and advertising click ids.
• Page and navigation data: page addresses including query strings, page titles, referrers and campaign parameters.
• Interaction data: clicks and the text and attributes of the elements clicked, scroll depth, page speed, errors and signs of frustration.
• Form and search data: values submitted in forms, and search terms, other than passwords, card security codes, one-time codes, PINs and anti-forgery tokens.
• Device data: browser user agent, screen and window size, language and time zone.
• Network and location data: a shortened IP address, a keyed hash of the IP address that changes daily, country, region, city and network operator. The full IP address is processed in transit and kept only in server request logs, for 30 days.
• Commerce data: carts, checkouts and orders, discount codes and payment method, and, through the Shopify pixel, the buyer's name, email address, phone number and billing and delivery addresses.
• Data layer data: the data layer values the Customer chooses to capture.
• Consent data: the consent state the Customer's site passes to the tag, and the Global Privacy Control and Do Not Track signals.

Annex 2: Security measures

Access to the Services

• Each person signs in with their own account, created by invitation from an admin of their organisation.
• Passwords are stored as bcrypt hashes. Two-step verification with an authenticator app is available to every user, with recovery codes stored as hashes.
• Access tokens last 15 minutes. Refresh and password reset tokens are stored as hashes.
• Roles (admin, member and viewer) control who can change tracking, manage keys and invite people, and carry over to Kontala Analytics, which is reached only by signing in to Kontala.
• Write keys can be revoked at any time.

Separating customers

• Every event is stored with its organisation, and Kontala Analytics reads each organisation's data only through views limited to that organisation.
• Customers have no direct database or SQL access.

Kontala personnel

• Administrative access is limited to the small number of Kontala staff who need it to provide, secure and support the Services.
• Changes to organisations, members, invitations, users, properties and keys, including those made by Kontala staff, are written to an append-only audit log.

Minimising what is captured

• Every capture feature other than page views and page signals is off until the Customer turns it on, and the collector refuses data a property has not turned on.
• Raw IP addresses are not stored with events: only a shortened address and a daily-rotating keyed hash.
• Location comes from a local database; no IP address is sent to a third party to look it up.
• The tag never fingerprints browsers and uses no local or session storage, and it can run without cookies.
• Passwords, card security codes, one-time codes, PINs and anti-forgery tokens are never sent, and the collector checks again on arrival.
• Email addresses and card-like numbers are removed from the text and attributes of clicked elements.
• Page address fields used for analysis are cleaned of query parameters the Customer has not chosen to keep, and of email addresses, tokens and card-like numbers.
• Without granted consent, device and visit ids, user ids, IP data, location below country level, the browser, page address, referrer and data layer are removed before an event is stored.
• data-ac-ignore and data-ac-mask let the Customer exclude parts of its pages.

Encryption and infrastructure

• All traffic over public networks uses TLS, and the app sends HTTP Strict Transport Security.
• Data at rest is encrypted by Google Cloud. Two-step verification secrets are also encrypted by the application.
• The Services run on Google Cloud in the European Union, with secrets kept in a managed secret store.

Retention

• Captured events expire automatically after 400 days, and Kontala Analytics results and downloads after 7 days.
• Expired sign-in sessions are deleted automatically.

Annex 3: Sub-processors

See our Sub-processors page.