Data processing agreement

1.1Pertento provides the Product to the Client under the Terms. In doing so, Pertento processes personal data on the Client’s behalf. This DPA governs that processing.

2.1Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in the GDPR (Regulation (EU) 2016/679). Other capitalised terms have the meaning given in the Terms.

2.2Client Data: personal data processed by Pertento on behalf of the Client, as described in Annex I.

3.1The Client is the controller and Pertento is the processor of Client Data.

3.2Out of scope. This DPA does not cover:

• account data about the Client’s users (name, email, role, login events);
• billing data, including data shared by Polar as merchant of record;
• usage data Pertento uses for metering, plan management and accounting;
• support correspondence.

Pertento processes that data as an independent controller under its Privacy Policy. Polar Software Inc. processes payment data as an independent controller under its own privacy policy, using Stripe, Inc. as its payment processor. Neither is a subprocessor under this DPA.

4.1Pertento processes Client Data only on the Client’s documented instructions, including with regard to transfers outside the EEA, unless EU or Member State law requires otherwise. In that case Pertento informs the Client before processing, unless the law prohibits it.

4.2The Terms, this DPA, and the Client’s configuration and use of the Product are the Client’s complete instructions. Pertento informs the Client if it considers an instruction to infringe data protection law.

4.3The Client is responsible for the lawfulness of the processing, including informing data subjects and obtaining any consent required for the Pertento script on its websites.

5.1Pertento ensures that persons authorised to process Client Data are bound by confidentiality and have access only to the extent needed for their tasks.

6.1Pertento implements the technical and organisational measures in Annex II, appropriate to the risk under Article 32 GDPR. Pertento may update the measures provided the overall level of protection is not reduced.

7.1The Client gives general written authorisation for Pertento to engage subprocessors. The current subprocessors are listed in Annex III.

7.2Pertento notifies the Client at least 30 days before adding or replacing a subprocessor. The Client may object on reasonable data protection grounds within 30 days of notice. The parties discuss the objection in good faith. If it is not resolved, the Client may terminate the affected services without penalty.

7.3Pertento binds each subprocessor by written contract to data protection obligations at least as protective as this DPA, and remains fully liable to the Client for its subprocessors.

8.1Client Data is stored in the EEA and is not accessed from outside the EEA without the Client’s prior consent.

8.2Any transfer outside the EEA requires the Client’s consent and a valid transfer mechanism under Chapter V GDPR, in place before the transfer begins.

8.3Switching on AI features counts as the Client’s consent to transfer the data needed for them to the United States for that purpose only, as described in section 9.

9.1AI features are off by default. They are in scope of this DPA only when an Owner or Admin switches them on.

9.2When switched on, the data needed for the requested AI action is transferred to Anthropic in the United States, under the EU standard contractual clauses (Decision (EU) 2021/914, Module Three) in Pertento’s agreement with Anthropic.

9.3Switching AI features off withdraws the instruction and the transfer consent for later requests.

10.1Pertento assists the Client, taking into account the nature of the processing, with responding to data subject requests, and with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR.

10.2Pertento forwards any data subject request it receives about Client Data to the Client without undue delay and does not respond to it directly unless the law requires.

11.1Pertento notifies the Client without undue delay, and no later than 24 hours after becoming aware of a personal data breach affecting Client Data.

11.2The notification includes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

12.1Pertento makes available the information needed to demonstrate compliance with this DPA and allows audits by the Client or an auditor it mandates.

12.2Audits require at least 30 days’ written notice, take place during business hours, and are limited to once in any 12-month period, except after a personal data breach or where a supervisory authority requires an audit.

12.3Audit rights survive for 3 years after the end of this DPA.

13.1Roles. For an agency’s own Account, the agency is the controller and Pertento the processor. For client Accounts, the agency’s client is the controller, the agency is the processor, and Pertento is the agency’s subprocessor.

13.2Flow-down. The agency confirms that its agreement with each client permits the engagement of Pertento and its subprocessors, and that this DPA gives the client the protection required by Article 28(4) GDPR.

13.3Point of contact. Pertento’s obligations under this DPA are owed to the agency. Pertento sends breach notifications, subprocessor notices and audit information to the agency, which passes them to its clients in time. A client’s objection or audit request is raised through the agency.

13.4Data subject requests about a client Account are forwarded to the agency.

13.5Agency no longer available. If the agency has ceased to exist in law or in fact, or has become insolvent, the client may instruct Pertento directly to return or delete its data. Pertento may require reasonable proof that the instruction comes from the client.

14.1This DPA applies for as long as Pertento processes Client Data under the Terms.

14.2Lapsed Accounts. When an Account lapses for non-payment or cancellation, serving stops and no new Client Data is collected. Pertento continues to store existing Client Data so the Client can view and export it, while the Account is read-only. This storage is processing on the Client’s instruction under this DPA.

14.3A read-only Account ends when the Client deletes it, or when Pertento terminates it with at least 30 days’ notice under the Terms.

15.1The Client can export Client Data from the Product while the Account is active or read-only.

15.2Pertento deletes Client Data, including backups, no later than 90 days after an Account is terminated, unless the Client instructs otherwise before termination or EU or Member State law requires storage.

15.3The optional visitor ID described in Annex I is deleted automatically 12 months after collection, regardless of Account status.

16.1Anonymised data, and models trained on it under section 28 of the Terms, are not personal data and are not subject to deletion under section 15.

17.1Liability under this DPA is subject to the limits in the Terms, except where those limits cannot apply under the GDPR or other mandatory law.

17.2For the processing of Client Data, this DPA prevails over the Terms.