Data Processing Addendum

This Data Processing Addendum ("DPA") is between Grid Design Agency Limited, trading as AgoraScan, company number 14577642, 124 City Road, London, EC1V 2NX, United Kingdom ("AgoraScan", "we") and the business customer who accepts our terms of service ("Customer", "you").

It forms part of the terms of service and applies automatically when you use a Studio, Agency or API plan, the embeddable website scanner, or otherwise use AgoraScan to process Customer Personal Data. You accept it when you accept the terms or enable those features. If you need a signed copy, email hello@agorascan.ai. If this DPA conflicts with the terms, this DPA wins for data protection matters; if it conflicts with the Standard Contractual Clauses, the Clauses win.

• "Data Protection Laws": the UK GDPR, the Data Protection Act 2018, the EU GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and other US state privacy laws, and any other law on personal data that applies to the processing, each as amended.
• "Customer Personal Data": personal data we process on your behalf in providing AgoraScan, as described in section 4.
• "controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings in the UK GDPR or EU GDPR. "Business", "service provider", "sell" and "share" have the meanings in the CCPA.
• "Sub-processor": a third party we engage to process Customer Personal Data.
• "SCCs": the EU standard contractual clauses (Commission Implementing Decision 2021/914). "UK Addendum": the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

For Customer Personal Data, you are the controller (or a processor acting for your own client, in which case you confirm you have your client's authority) and we are your processor (or sub-processor). Under the CCPA, you are the business and we are your service provider.

We are a separate controller for: your account, billing and contact data; security and abuse prevention (including hashed IP codes used to limit scans); data about our own website visitors; and producing aggregated, anonymised statistics about websites. Our privacy notice covers that processing.

• Subject matter: providing AgoraScan website audits, the embeddable website scanner, white-label reports and the API to you.
• Duration: the term of your subscription or API agreement, plus the deletion period in section 11.
• Nature: collection, storage, retrieval, transmission to sub-processors (including AI analysis), display in reports and dashboards, emailing to you, and deletion.
• Purpose: to provide the services you request, as described in the terms of service, and as you instruct us in writing or through the product.
• Data subjects: (a) people who use your embedded website scanner; (b) people whose personal data appears on public web pages you or your platform users submit for audit; (c) your platform's end users, if you send their details to us through the API; (d) your team members, to the extent not covered by our own controller processing.
• Personal data: (a) scanner leads: email address, the web address entered, date and time, consent confirmation, link to their report; (b) personal data visible on audited pages, such as names, photos, job titles, contact details and testimonials, captured in screenshots and page text; (c) API: whatever identifiers you include with a request [define in the API agreement]; (d) team members: name and email.
• Special category data: none intended. Incidental special category data may appear on audited pages; you must not submit pages you know contain it.
• Frequency: continuous, for as long as you use the services.

• You have a lawful basis for the processing and have given people any information required by Data Protection Laws, including linking your own privacy notice next to the website scanner.
• You only send marketing to scanner leads where the law allows, for example with consent where required under the UK Privacy and Electronic Communications Regulations, the EU ePrivacy rules, Canada's anti-spam law or the Australian Spam Act.
• Your instructions comply with Data Protection Laws. The terms of service, your configuration of AgoraScan and your use of its features are your complete instructions.
• You only submit public web pages, as required by our acceptable use policy.

• We process Customer Personal Data only on your documented instructions, including about international transfers, unless the law requires otherwise (in which case we'll tell you first unless the law forbids it). We'll tell you if we think an instruction breaks Data Protection Laws.
• Everyone we authorise to process Customer Personal Data is bound by confidentiality.
• We apply the security measures in section 13.
• We help you, taking into account the nature of the processing, to respond to requests from data subjects. If we receive a request about Customer Personal Data, we'll pass it to you and won't respond ourselves except to redirect the person.
• We help you with security, breach notifications, data protection impact assessments and prior consultation with regulators, using information available to us. [We may charge reasonable costs for assistance beyond what's available through the product.]
• We make available the information needed to show we comply with this DPA and allow audits as set out in section 12.

As your service provider, we will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose (including any commercial purpose) other than providing the services specified in the terms, or outside our direct business relationship with you; or combine it with personal data we receive from others or collect ourselves, except as the CCPA permits for service providers. We'll comply with the CCPA and give the same level of privacy protection it requires, tell you if we can no longer meet our obligations, and let you take reasonable steps to stop and remedy unauthorised use. We certify that we understand these restrictions.

We may create statistics from audit results (such as scores, issue counts and categories) about websites, combined across many customers so that no website from a private audit, no customer and no person can be identified, and use them for benchmarks and published research. We don't use scanner leads, emails or other personal data for this, and we don't use Customer Personal Data to train AI models.

• You give us general authorisation to use the sub-processors listed on our sub-processors page.
• We'll tell you at least [30 days] before adding or replacing a sub-processor, by updating that page and emailing the account owner.
• You can object on reasonable data protection grounds within that notice period. We'll then try in good faith to find a solution. If we can't, you can end the affected service and get a refund of prepaid fees for the unused period.
• We impose data protection terms on each sub-processor that give at least the same protection as this DPA, and we remain responsible to you for their performance.

We may transfer Customer Personal Data to sub-processors in countries without an adequacy decision, including the United States, only with a valid transfer mechanism, such as the EU-US Data Privacy Framework and its UK Extension, or the SCCs and UK Addendum with our sub-processors.

To the extent you transfer Customer Personal Data to us from the EU or EEA, you and we agree that the SCCs, Module Two (controller to processor) or Module Three (processor to processor), are incorporated into this DPA, with: Clause 7 (docking) included; Clause 9 option 2 (general authorisation) with the notice period in section 9; Clause 11 optional wording not included; Clause 17 governed by the law of [Ireland]; Clause 18 courts of [Ireland]; Annex I completed by section 4 of this DPA; Annex II completed by section 13; Annex III by our sub-processors page. [Drafting note: the UK is adequate for the EU, so EU-to-UK transfers don't need the SCCs. Keep this clause for onward transfers and for customers who require it.]

For transfers from the UK, the UK Addendum applies, completed with the information above, and either party may end it as allowed by its Section 19. For transfers from Switzerland, the SCCs apply with the references to the GDPR read as the Swiss Federal Act on Data Protection and the competent authority being the Swiss FDPIC.

During your subscription you can export reports (PDF) and scanner leads, and delete them, from your dashboard. When your subscription ends, you can export data for [30 days]. After that, we delete Customer Personal Data within [30 days], and from backups within a further [30 days], unless the law requires us to keep it. Scanner leads are also deleted when you delete them.

On request we'll provide a written summary of our security measures and answer reasonable security questionnaires [once a year]. If that isn't enough to show compliance, or a regulator requires it, you (or an independent auditor bound by confidentiality) may audit our compliance with this DPA on at least 30 days' notice, during business hours, at your cost, no more than once a year unless there's been a breach. Audits of sub-processors are carried out by relying on their certifications and audit reports.

• Encryption in transit (TLS) for all traffic and encryption at rest for the database and file storage.
• Private file storage; reports reachable only by the owner or with an unguessable share token; free reports public only by unlisted link.
• Access to production systems limited to named Grid Design staff with multi-factor authentication, on a need-to-know basis.
• Secrets stored in the hosting provider's encrypted environment settings, never in code.
• Sign-in managed by Clerk, with email verification and optional Google sign-in.
• IP addresses hashed before storage; scanning restricted to public addresses, with protection against server-side request forgery.
• Logical separation of each customer's data in the database by account.
• Rate limits and abuse controls on scanning and the website scanner.
• Dependency updates and security patches applied promptly; database backups by our database provider.
• Sub-processors chosen for their security certifications (for example, SOC 2 or ISO 27001).
• A written incident response procedure.

We'll tell you without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting Customer Personal Data. We'll give you the information you reasonably need to meet your own obligations (what happened, the data and people affected, likely consequences, and what we're doing), updating you as we learn more. We'll take reasonable steps to contain and fix it. Telling you about a breach is not an admission of fault.

Each party's liability under or in connection with this DPA is subject to the limits in the terms of service [or: is limited to [amount]], except where the law does not allow liability to be limited. Nothing limits either party's liability to data subjects under Data Protection Laws.

We may update this DPA to reflect changes in law or our services, giving at least [30 days'] notice of changes that materially affect you. This DPA lasts as long as we process Customer Personal Data. It is governed by the law of England and Wales, except where the SCCs require otherwise.