Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the CI-Addon Terms of Service ("Terms") between the Customer and For A Fact ApS, CVR 40 58 49 43, Gammel Køge Landevej 55, 2500 Valby, Denmark ("For A Fact", "we", "us"). It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The Customer accepts it together with the Terms.

Terms defined in the GDPR, such as "personal data", "processing", "controller", "processor" and "personal data breach", have the same meaning in this DPA.

Need a signed copy? Email support@ci-addon.com.

1.1 The Customer is the controller, and For A Fact is the processor, for the personal data described in Annex 1. This is personal data about visitors to the Customer's websites and event portals that is processed when the Customer uses Smart Embed, form capture scripts and event portals.

1.2 For A Fact is a controller, not a processor, for personal data about the Customer's own users of CI-Addon, for billing, and for our website. This is described in our privacy policy. This DPA does not cover that data.

1.3 Form submissions and event registrations are sent from the visitor's browser directly to Microsoft Dynamics 365 Customer Insights – Journeys ("CIJ"). For A Fact does not receive or store them. Microsoft processes them under the Customer's own agreement with Microsoft. Microsoft is not our sub-processor.

1.4 The Customer must not use CI-Addon to process special categories of personal data (Article 9 GDPR) or data about criminal offences through For A Fact's systems.

2.1 We process personal data only on the Customer's documented instructions. The Terms, this DPA and the Customer's settings in CI-Addon (for example which countries require double opt-in) are the Customer's complete instructions. Additional instructions must be agreed in writing.

2.2 We may process personal data without instructions where EU or Member State law requires it. In that case we will inform the Customer first, unless the law prohibits it.

2.3 We will inform the Customer without undue delay if we believe an instruction infringes the GDPR or other data protection law.

Everyone who works for For A Fact and has access to the personal data is bound by a duty of confidentiality.

4.1 We implement appropriate technical and organisational measures under Article 32 GDPR. They are described in Annex 2 and on our Security page.

4.2 We may update the measures as long as the overall level of security is not reduced.

5.1 The Customer gives general authorisation to use the sub-processors listed in Annex 3.

5.2 We will notify the Customer by email at least 30 days before we add or replace a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may cancel the affected subscription before the change takes effect, and we will refund any prepaid amount for the remaining period.

5.3 We impose data protection obligations on each sub-processor that are equivalent to those in this DPA. We remain responsible to the Customer for our sub-processors.

6.1 Our servers and database are located in the EU. Some sub-processors are based in the United States, and their global networks may handle a visitor's request at a location close to the visitor, including outside the EU/EEA.

6.2 Such transfers are based on the EU-U.S. Data Privacy Framework, where the sub-processor is certified, and/or the European Commission's Standard Contractual Clauses (Article 46 GDPR).

7.1 Data subject requests. We do not store personal data about the Customer's visitors in our database. If we receive a request from a data subject concerning the Customer, we will forward it to the Customer without undue delay and will not respond ourselves unless the Customer instructs us to.

7.2 Other assistance. Taking into account the nature of the processing, we will help the Customer meet its obligations under Articles 32 to 36 GDPR. That includes security, breach notification, data protection impact assessments and prior consultation.

8.1 We will notify the Customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach that affects the Customer's personal data.

8.2 The notification will describe, as far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not available at first will be provided as soon as possible.

8.3 We send notifications to the owners and admins of the Customer's organisation in CI-Addon.

9.1 The processing is transient. We do not store the personal data in Annex 1 in our database. Technical logs at our sub-processors are deleted automatically within their retention periods (Annex 1).

9.2 When the Terms end, we stop processing the Customer's personal data. Our deletion rules for the Customer's other data are set out in section 9 of the Terms.

10.1 We will make available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR. This includes answers to reasonable written questions and the certifications or reports of our sub-processors.

10.2 If this is not sufficient, the Customer or an independent auditor bound by confidentiality may carry out an audit at most once per year, with at least 30 days' written notice, during normal business hours, and at the Customer's own cost. Audits by a supervisory authority are not limited by this section.

11.1 The limitations of liability in section 13 of the Terms apply to this DPA, unless mandatory law provides otherwise.

11.2 This DPA applies for as long as we process personal data on the Customer's behalf.

11.3 This DPA is governed by Danish law, and disputes are resolved as set out in section 17 of the Terms.

Not included: form submissions and event registrations, which go directly to Microsoft (section 1.3). Also not included: the shared translation dictionary, which contains form texts and not personal data (section 7.4 of the Terms).

• Data minimisation: no personal data about the Customer’s visitors is stored in our database. Submissions go directly from the browser to Microsoft.
• Hosting in the EU: application servers in the EU (Vercel, Paris) and database in the EU (Supabase, Frankfurt).
• Encryption: all traffic uses HTTPS/TLS. Data in the database is encrypted at rest by our provider.
• Access control: users sign in with Microsoft accounts. Data is separated per organisation with row-level security in the database. Roles (admin, editor) limit what users can change; only admins can invite and remove people, change roles and manage the subscription.
• Internal access: production access is limited to the people at For A Fact who need it. Secrets are kept in our hosting provider’s encrypted environment settings, not in code.
• Backups: the database is backed up daily by our database provider.
• Change control: all code and database changes are tracked in version control and deployed through a controlled process.
• Monitoring: automatic monitoring of the Customer’s forms and of the service.
• Sub-processors: only providers with recognised security certifications and data processing agreements (Annex 3).

Providers that are not sub-processors under this DPA:

• Microsoft, the Customer's own provider of CIJ.
• Anthropic, which receives only form texts for translation and no personal data.
• Alunta and Stripe, which we use as controller for our own billing.