Data Processing Agreement
Last updated 2026-11-05
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and [SiteScout legal entity], [Registered postal address] ("Processor"). You accept it by ticking the box at signup.
1. Subject matter and duration
The Processor processes lead data on the Controller's behalf to provide SiteScout, for as long as the account exists plus the retention periods in the Privacy policy.
2. Nature and purpose
Storage, enrichment, scoring, demo preview generation, drafting and sending (from the Controller's own mailbox) of B2B outreach, and compliance logging.
3. Data subjects and categories
- Data subjects: owners, staff and contacts of businesses the Controller researches (often sole traders or small partnerships).
- Categories: business name, address, phone, website, published business email, public Google reviews (with reviewer display names), website test results.
- No special categories of data are intended to be processed.
4. Processor obligations (GDPR Art. 28(3))
- Process personal data only on the Controller's documented instructions, including for transfers.
- Ensure that people authorised to process the data are bound by confidentiality.
- Apply appropriate technical and organisational measures (Annex 2).
- Use sub-processors only as listed in Annex 1, with 30 days' notice of changes and a right to object.
- Help the Controller respond to data subject requests. Objections and erasure requests from the public data notice page are applied automatically.
- Help with security, breach notification (without undue delay, and within 48 hours of becoming aware), DPIAs and prior consultation.
- Delete or return the data at the end of the service (30-day export window, then deletion), unless the law requires storage.
- Make available the information needed to demonstrate compliance and allow for audits on reasonable notice.
5. International transfers
Where data leaves the EEA, UK or Switzerland, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor) and, for the UK, the International Data Transfer Addendum. They are incorporated by reference.
Annex 1: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| VPS hosting provider | Application and database hosting | [VPS provider and region] |
| Stripe, Inc. | Subscription billing | USA / Ireland |
| Postmark (ActiveCampaign) | Account emails (verification, password reset, invites) | USA |
| Google LLC | Places API, PageSpeed Insights, Gmail API (if connected) | USA |
| Microsoft Corporation | Graph API (if Microsoft 365 is connected) | USA / EU |
| Anthropic PBC or OpenAI LLC (if enabled) | Drafting outreach text | USA |
Annex 2: Security measures
- Per-customer isolation with Postgres row-level security, enforced for the application's database role.
- Encryption in transit (TLS) and of secrets at rest (AES-256-GCM: OAuth tokens, API keys).
- Password hashing with scrypt; server-side sessions; rate limits; CSRF origin checks.
- Least-privilege database roles; append-only audit log kept 3 years.
- Nightly encrypted database backups with rotation.
- Automated retention and deletion jobs.