Data Processing Agreement

1. Roles

For account, billing, and product operation data about your users, we act as an independent controller as described in the Privacy Policy.

For personal data you instruct us to process through monitors (including URLs you configure and metadata in check results or optional failure screenshots that may incidentally include personal data from a page), you are the Controller and we are the Processor under GDPR Art. 28.

2. Subject matter and duration

Processing is limited to providing Lead QA monitoring, alerts, history, and support for the term of your account, and for a short residual period afterward needed for backups and legal holds as described in the Privacy Policy.

3. Nature and purpose

Automated browser checks against URLs you authorize; storage of check outcomes; alerting; optional masked failure screenshots; support. We do not process form submissions or visitor lead content as a product feature.

4. Types of personal data and data subjects

• Categories may include IP addresses and other technical data in logs; names/emails of your team; alert recipients; and incidental personal data visible on pages you monitor (which we seek to minimize).
• Data subjects may include your employees/contractors and, only incidentally, visitors to pages you monitor.

5. Processor obligations

We will:

• Process personal data only on documented instructions from you (configuring monitors and using the product), unless required by EU or Member State law;
• Ensure persons authorized to process data are bound by confidentiality;
• Implement appropriate technical and organizational security measures (Art. 32);
• Not engage another processor without complying with §6;
• Assist you, where reasonably possible, with data-subject requests and with security, breach, DPIA, and prior consultation obligations, taking into account the nature of processing;
• Delete or return personal data after the end of services, at your choice, unless law requires storage;
• Make available information necessary to demonstrate compliance with Art. 28 and allow audits as described in §8.

6. Sub-processors

You authorize us to use the sub-processors listed in our Privacy Policy §5 (as updated from time to time). We will impose data-protection obligations no less protective than this DPA. We will provide notice of material additions where practical; continued use after notice constitutes acceptance unless you object on reasonable GDPR grounds and terminate the affected service.

7. International transfers

Where personal data is transferred outside the EEA, we use appropriate safeguards under GDPR Chapter V, typically Standard Contractual Clauses with our providers, and where applicable the EU–US Data Privacy Framework for certified recipients.

8. Audits

Upon written request no more than once per twelve months (unless a competent authority or confirmed breach requires otherwise), we will provide reasonable information to demonstrate compliance. On- site audits are available on reasonable notice, at your expense, during business hours, without disrupting operations, and subject to confidentiality.

9. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, with information reasonably available to help you meet Art. 33/34 duties.

10. Liability

Liability under this DPA is subject to the limitations in the Terms of Service, except where mandatory law provides otherwise.

11. Contact

Processor contact: contact@leadqa.app.