Data Processing Agreement
1. Preamble
This Data Processing Agreement ("DPA" or "Agreement"), together with all Annexes hereto, forms part of the agreement between UXIFY (CY) LIMITED ("Uxify" or "Processor") and the Customer identified in the applicable Order Form, Terms of Service, or other agreement executed between the parties ("Controller") for the provision of Uxify's real user monitoring, UX analytics, and website optimisation platform (the "Service").
This DPA reflects the parties' agreement with respect to the processing of Personal Data by Uxify on behalf of the Controller in connection with the Service. It is effective as of the date the parties execute the applicable agreement or the Controller first uses the Service, whichever is earlier.
The terms of this DPA are incorporated into and supplement the Terms of Service. In the event of any conflict between this DPA and the Terms of Service with respect to data protection obligations, this DPA shall prevail.
2. Definitions
In this Agreement, the following terms have the meanings set out below. Capitalised terms not defined herein have the meanings given in Applicable Data Protection Law.
"Applicable Data Protection Law"
means all laws and regulations applicable to the processing of Personal Data under this Agreement, including without limitation: (i) the EU General Data Protection Regulation 2016/679 ("GDPR"); (ii) the UK General Data Protection Regulation as defined by the UK Data Protection Act 2018 ("UK GDPR"); (iii) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act 2020 (together, "CCPA/CPRA"); and (iv) any other applicable national or regional data protection laws, in each case as amended, replaced, or supplemented from time to time.
"Controller"
means the entity that determines the purposes and means of the processing of Personal Data — being the Customer in the context of this Agreement.
"Data Breach"
means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed under this Agreement.
"Data Subject"
means an identified or identifiable natural person whose Personal Data is processed.
"EEA"
means the European Economic Area.
"Personal Data"
means any information relating to an identified or identifiable natural person collected or processed through the Service on behalf of the Controller, including but not limited to account information, browsing behaviour, session data, device identifiers, IP addresses, and interaction data as further described in Annex I.
"Processing"
means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction (and "Process", "Processes" and "Processed" shall be construed accordingly).
"Processor"
means the entity that processes Personal Data on behalf of the Controller — being UXIFY (CY) LIMITED in the context of this Agreement.
"Restricted Transfer"
means a transfer of Personal Data to a third country or international organisation not recognised as providing adequate protection under Applicable Data Protection Law.
"Service"
means the real user monitoring, UX analytics, competitive intelligence, Navigation AI, and conversion optimisation platform provided by Uxify under the Terms of Service.
"Services Agreement"
means the Terms of Service, Order Form, or other agreement between the parties governing the Controller's use of the Service.
"Standard Contractual Clauses" or "SCCs"
means the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, adopted by the European Commission in Decision (EU) 2021/914 of 4 June 2021, as set out in Annex IV.
"Sub-processor"
means any third party engaged by the Processor to process Personal Data on behalf of the Controller in connection with the Service.
"UK Addendum"
means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018.
3. Details of Processing
3.1 Subject matter
The Processor shall process Personal Data on behalf of the Controller for the purpose of providing the Service as described in the Services Agreement and in Annex I to this Agreement.
3.2 Duration
The Processor shall process Personal Data for the duration of the Services Agreement, unless otherwise agreed in writing or required by Applicable Data Protection Law. Upon termination or expiry of the Services Agreement, the Processor shall, at the Controller's election, delete or return all Personal Data in accordance with Clause 4.8 of this Agreement.
3.3 Nature and purpose
The Processor processes Personal Data solely for the following purposes:
Providing, maintaining, and improving the Service;
Enabling real user monitoring (RUM), session analytics, user journey analysis, funnel analysis, and behavioural analytics for the Controller;
Enabling Navigation AI features and conversion optimisation functions;
Generating performance, engagement, and business metric reports for the Controller;
Enabling competitive intelligence and benchmarking features using anonymised, aggregated data that cannot be linked to any individual user or specific website;
Ensuring the security, stability, and integrity of the Service;
Complying with legal obligations applicable to the Processor.
The Processor shall not process Personal Data for any purpose beyond those set out above without the prior written consent of the Controller, except where required by Applicable Data Protection Law.
3.4 Types of personal data and categories of data subjects
The types of Personal Data processed and categories of Data Subjects are set out in Annex I to this Agreement.
4. Obligations of the Processor
4.1 General
The Processor shall:
Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by Applicable Data Protection Law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law on grounds of public interest;
Immediately inform the Controller if, in the Processor's opinion, an instruction infringes Applicable Data Protection Law;
Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
Take all appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Clause 4.3 and Annex II;
Respect the conditions referred to in Clauses 4.4 and 4.5 for engaging another processor;
Assist the Controller to ensure compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (security, data breach notification, data protection impact assessment, and prior consultation), taking into account the nature of processing and information available to the Processor;
At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of processing services, and delete existing copies unless Applicable Data Protection Law requires storage of the Personal Data;
Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Clause and allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.
4.2 Confidentiality
The Processor shall ensure that access to Personal Data is limited to those employees, agents, and contractors who need access in order to provide the Service, and that all such persons are subject to written obligations of confidentiality no less protective than those set out in this Agreement. The obligations of confidentiality survive termination of this Agreement.
4.3 Security
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against Data Breaches. Such measures are described in Annex II and shall include, at a minimum:
Pseudonymisation and encryption of Personal Data where appropriate;
Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
Restoring the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
4.4 Sub-processing
4.4.1 General authorisation
The Controller provides general authorisation to the Processor to engage Sub-processors, subject to the conditions set out in this Clause 4.4. The Processor's current list of approved Sub-processors is set out in Annex III.
4.4.2 Changes to Sub-processors
The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) days in advance (where reasonably practicable) by updating Annex III or by providing written notice. The Controller may object in writing to the engagement of a new or replacement Sub-processor within fourteen (14) days of receipt of notice, provided that such objection is based on reasonable grounds relating to data protection. If the parties cannot resolve such objection, the Controller may terminate the applicable Services Agreement on reasonable written notice without penalty as its sole and exclusive remedy.
4.4.3 Sub-processor obligations
Where the Processor engages a Sub-processor, the Processor shall impose data protection obligations on that Sub-processor by way of a written contract that provides at least the same level of protection for Personal Data as this Agreement and that meets the requirements of Article 28 of the GDPR. The Processor shall remain fully liable to the Controller for the performance of Sub-processor obligations.
4.5 Data subject rights
The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subjects' rights under Applicable Data Protection Law, including:
Right of access (Article 15 GDPR);
Right to rectification (Article 16 GDPR);
Right to erasure (Article 17 GDPR);
Right to restriction of processing (Article 18 GDPR);
Right to data portability (Article 20 GDPR);
Right to object (Article 21 GDPR).
The Processor shall promptly notify the Controller, and in any event within five (5) business days, if it receives a request from a Data Subject exercising their rights under Applicable Data Protection Law, and shall not respond to any such request except on the documented instructions of the Controller or as required by Applicable Data Protection Law.
4.6 Data breach notification
The Processor shall notify the Controller without undue delay, and in any event within forty-eight (48) hours of becoming aware of a Data Breach affecting Personal Data processed under this Agreement. Such notification shall include, to the extent then known:
A description of the nature of the Data Breach, including where possible the categories and approximate number of Data Subjects and records concerned;
The name and contact details of the data protection officer or other contact point from whom more information can be obtained;
A description of the likely consequences of the Data Breach;
A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its possible adverse effects.
Where the Processor cannot provide all information in the initial notification, it shall provide the information in phases without undue further delay. The Processor shall provide all reasonable assistance to the Controller in complying with any applicable obligation to notify Data Breaches to Supervisory Authorities or affected Data Subjects.
4.7 Data protection impact assessment and prior consultation
The Processor shall provide the Controller with reasonable assistance in carrying out data protection impact assessments ("DPIAs") and prior consultations with Supervisory Authorities where required under Applicable Data Protection Law, taking into account the nature of the processing and the information available to the Processor.
4.8 Deletion and return of personal data
Upon termination or expiry of the Services Agreement, or upon the written request of the Controller, the Processor shall, at the Controller's election:
Securely delete or destroy all Personal Data (including copies and backups) within sixty (60) days; or
Return all Personal Data to the Controller in a commonly used machine-readable format within thirty (30) days.
The Processor shall provide the Controller with written certification of deletion upon request. Nothing in this Clause shall require the Processor to delete Personal Data to the extent that Applicable Data Protection Law requires its retention, in which case the Processor shall inform the Controller and shall isolate and protect such Personal Data from any further processing except as required by law.
4.9 Audit rights
The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this Agreement. The Processor shall permit the Controller (or a mandated third-party auditor bound by confidentiality obligations) to conduct audits, including inspections, on reasonable notice of no less than thirty (30) calendar days, during normal business hours, and no more than once per calendar year, except where a Supervisory Authority requires more frequent audits or where the Controller reasonably suspects a material breach of this Agreement.
As an alternative to an on-site audit, the Processor may provide relevant third-party audit reports, certifications (e.g., ISO 27001, SOC 2), or other documentation demonstrating compliance, which the Controller may accept in its reasonable discretion. The Controller shall bear the costs of any audit, unless the audit reveals a material breach of this Agreement.
5. Obligations of the controller
The Controller represents, warrants, and agrees that:
It has a valid legal basis under Applicable Data Protection Law for processing Personal Data through the Service, including obtaining valid consents from Data Subjects where required;
It has provided and will continue to provide all necessary notices and disclosures to Data Subjects as required by Applicable Data Protection Law, including information about the use of Uxify as a data processor;
All Personal Data provided to or collected through the Service has been collected lawfully and in compliance with Applicable Data Protection Law;
Its instructions to the Processor shall at all times comply with Applicable Data Protection Law;
It is solely responsible for configuring the Service, including any cookie consent mechanisms, data minimisation settings, and IP anonymisation features made available by the Processor;
It shall not instruct the Processor to process Special Category Data or data relating to children without prior written agreement and implementation of appropriate additional safeguards;
It shall promptly inform the Processor of any changes to its legal basis for processing or any regulatory restrictions applicable to Personal Data processed through the Service;
It shall cooperate with the Processor in good faith to give effect to both parties' obligations under Applicable Data Protection Law.
6. International data transfers
6.1 Transfers within the EEA
Where Personal Data is processed within the EEA, no additional transfer mechanism is required beyond compliance with the GDPR.
6.2 Restricted transfers
Where the Processor or any Sub-processor processes Personal Data outside the EEA (or outside the UK for UK GDPR purposes) and such transfer constitutes a Restricted Transfer, the parties agree that:
The SCCs set out in Annex IV shall apply and are incorporated into this Agreement by reference, with Module Two (Controller to Processor) applying as between the Controller and the Processor;
For transfers subject to UK GDPR, the UK Addendum shall also apply and is incorporated by reference;
Where a Sub-processor is located in a third country, the Processor shall ensure that an appropriate transfer mechanism is in place before transferring Personal Data to such Sub-processor, including back-to-back SCCs where applicable.
6.3 Adequacy decisions
To the extent that a Restricted Transfer is covered by an adequacy decision issued by the European Commission or the UK Government, the parties may rely on such adequacy decision in lieu of the SCCs or UK Addendum for that specific transfer.
6.4 Supplementary measures
Where required by Applicable Data Protection Law or following a transfer impact assessment, the parties shall implement appropriate supplementary technical and organisational measures to ensure an essentially equivalent level of protection to that guaranteed within the EEA or UK, as applicable. The Processor shall cooperate with the Controller in conducting any necessary transfer impact assessment.
7. CCPA/CPRA provisions
7.1 Service provider designation
To the extent Applicable Data Protection Law includes the CCPA/CPRA, the Processor is a "Service Provider" as defined under the CCPA/CPRA and shall process Personal Information (as defined under the CCPA/CPRA) only:
For the business purpose of providing the Service as set out in this Agreement and the Services Agreement;
As otherwise permitted by the CCPA/CPRA for Service Providers.
7.2 Prohibited uses
The Processor shall not:
Sell or Share (as those terms are defined under the CCPA/CPRA) Personal Information processed under this Agreement;
Retain, use, or disclose Personal Information for any commercial purpose other than providing the Service;
Retain, use, or disclose Personal Information outside the direct business relationship with the Controller;
Combine Personal Information received under this Agreement with Personal Information received from or collected in connection with another business, except as permitted by the CCPA/CPRA.
7.3 Consumer rights assistance
The Processor shall assist the Controller in responding to verifiable consumer requests to exercise rights under the CCPA/CPRA, including rights of access, deletion, correction, and opt-out of Sale or Sharing, in accordance with Clause 4.5 of this Agreement.
7.4 Certification
The Processor certifies that it understands the restrictions in this Clause 7 and will comply with them. Uxify does not sell users' personal information.
8. Liability
8.1 Each party shall be liable to Data Subjects and, where applicable, to Supervisory Authorities for damage caused by processing that infringes Applicable Data Protection Law, in accordance with the allocation of responsibility set out therein.
8.2 As between the parties, each party's liability under this Agreement shall be subject to the limitations and exclusions set out in the Services Agreement. The parties agree that any limitation of liability in the Services Agreement shall apply to this DPA and the SCCs to the maximum extent permitted by Applicable Data Protection Law.
8.3 To the extent any limitation of liability is inconsistent with the obligations imposed on processors under the GDPR (including Articles 82 and 83), the applicable GDPR provisions shall prevail to the extent required by law.
9. Term and termination
9.1 This Agreement shall commence on the effective date of the Services Agreement and shall continue for so long as the Processor processes Personal Data on behalf of the Controller.
9.2 This Agreement shall automatically terminate upon termination or expiry of the Services Agreement, subject to any obligations that by their nature survive termination (including Clauses 4.2, 4.8, 6, and 8).
9.3 Either party may terminate this Agreement with immediate effect by written notice if the other party commits a material breach of this Agreement that is incapable of remedy, or that is not remedied within thirty (30) days of receipt of written notice specifying the breach and requiring remedy.
10. Governing law and jurisdiction
10.1 This Agreement and any non-contractual obligations arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Republic of Cyprus, without regard to its conflict of law provisions.
10.2 The parties irrevocably submit to the exclusive jurisdiction of the courts of the Republic of Cyprus to settle any dispute arising out of or in connection with this Agreement.
10.3 The foregoing is without prejudice to the mandatory provisions of Applicable Data Protection Law and the jurisdiction of competent Supervisory Authorities.
10.4 For the purposes of the SCCs, the governing law and choice of forum clauses within the SCCs shall apply in addition to, and shall not be affected by, this Clause 10.
11. General provisions
11.1 Entire Agreement. This Agreement (together with the Services Agreement and the Annexes) constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and representations with respect thereto.
11.2 Amendments. This Agreement may only be modified by a written instrument signed by authorised representatives of both parties, except that Annex III (Sub-processor list) may be updated unilaterally by the Processor subject to the notification requirements in Clause 4.4.
11.3 Severability. If any provision of this Agreement is held invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.
11.4 Waiver. No failure or delay by a party to exercise any right or remedy under this Agreement shall constitute a waiver of that right or remedy.
11.5 Notices. Notices under this Agreement shall be in writing and sent by email or registered post to the addresses specified in the Services Agreement or as otherwise notified in writing by either party.
11.6 Counterparts. This Agreement may be executed in counterparts and by electronic signature, each of which shall be deemed an original and together shall constitute one agreement.
11.7 Precedence. In the event of any conflict or inconsistency between the documents forming the agreement between the parties, the order of precedence shall be: (i) this DPA; (ii) the SCCs (if applicable); (iii) the Services Agreement; (iv) any order forms or statements of work.
ANNEX I
Details of Processing Activities
A. List of parties
Role | Data Controller |
Entity | As identified in the Services Agreement |
Address | As identified in the Services Agreement |
Contact / DPO | As designated by the Controller |
Role | Data Processor |
Entity | UXIFY (CY) LIMITED |
Registration | HE 485277 (Cyprus) |
Address | Nafpliou 15, Floor 2, 3025 Limassol, Cyprus |
Data Protection Contact |
B. Categories of data subjects
Category | Description |
|---|---|
End Users / Visitors | Natural persons who visit or interact with the Controller's website(s) or digital properties instrumented with the Uxify tracking script. |
Registered Customers | Natural persons who register for or use the Uxify platform directly (account holders), including name, email address, and website URL. |
Identified End Users (if configured) | Authenticated users of the Controller's platform where the Controller configures user identification within the Service. |
C. Categories of personal data
Category | Examples |
|---|---|
Account Data | Name / username, email address, hashed password, website URL (provided by registered Customers). |
Network Identifiers | IP address (full or truncated), network operator data, visitor country derived from IP. |
Device & Browser Data | Browser type and version, operating system, screen resolution, device form factor (desktop / tablet / mobile), language preference, referring site. |
Behavioural / Interaction Data | Page URLs visited, referrer URLs, clicks, scrolls, mouse movements, rage clicks, navigation paths, session duration, time on page, date and time of access. |
Performance Metrics (RUM) | Largest Contentful Paint (LCP), First Input Delay (FID), Cumulative Layout Shift (CLS), time-to-interaction, connection type, and other Core Web Vitals. |
Session Data | Pseudonymous session identifiers, timestamps, session replay data (if enabled by Controller). |
Conversion & Funnel Data | Goal completions, funnel step data, form interactions (field-level, excluding the content of sensitive fields). |
Special Category Data: Uxify does not intentionally collect or process Special Category Data as defined in Article 9 GDPR or Personal Data relating to criminal convictions or offences. The Controller is responsible for configuring the Service to prevent the transmission of Special Category Data. Uxify does not collect information from anyone under the age of 13 and does not address the Service to children.
D. Purposes and legal bases
Purpose | Legal Basis (GDPR) |
|---|---|
Providing real user monitoring, session analytics, and UX reports | Performance of contract / legitimate interests |
Navigation AI and conversion optimisation | Legitimate interests / consent (where applicable) |
Anonymised benchmarking and industry reports | Legitimate interests (data is fully anonymised) |
Account management and customer communications | Performance of contract |
Service security, fraud prevention, and abuse detection | Legitimate interests / legal obligation |
Compliance with legal obligations | Legal obligation |
e. Retention periods
Data Type | Retention Period |
|---|---|
Raw session and event data | 13 months from collection (configurable by Controller) |
Account and customer data | For the duration of the account; up to 6 years after account closure or as required by law |
Aggregated analytics reports | 36 months (or duration of Services Agreement) |
IP addresses (full) | Not retained beyond session processing (anonymised/truncated after use) |
Backup copies | Deleted within 90 days of primary deletion |
Security logs | 12 months |
F. Frequency and nature of transfers
Frequency: Continuous, as Personal Data is generated by visitors to the Controller's digital properties in real time.
Nature: Collection, recording, organisation, structuring, storage, retrieval, analysis, aggregation, visualisation, and transmission to the Controller.
ANNEX II
Technical and Organisational Security Measures
Uxify implements and maintains the following technical and organisational measures to protect Personal Data:
A. Access controls
Role-based access control (RBAC) limiting access to Personal Data to authorised personnel on a need-to-know basis.
Multi-factor authentication (MFA) required for access to production systems containing Personal Data.
Privileged access management with just-in-time access provisioning for administrative tasks.
Regular review and revocation of access rights upon role changes or employment termination.
Audit logging of all access to Personal Data and systems.
B. Data encryption
All Personal Data transmitted over public networks is encrypted using TLS 1.2 or higher.
Personal Data stored at rest is encrypted using AES-256 or equivalent standards.
Database encryption at the storage layer.
Encryption keys managed using dedicated key management systems with strict access controls.
C. Pseudonymisation and anonymisation
IP addresses are truncated or anonymised during ingest where configured by the Controller.
Session identifiers are pseudonymous and do not directly identify natural persons.
Data used for industry benchmarking is fully anonymised and cannot be linked to any individual user or specific website.
D. Network and infrastructure security
Firewalls and intrusion detection/prevention systems protecting production environments.
Network segmentation separating production, staging, and development environments.
Regular vulnerability scanning and penetration testing conducted at least annually by qualified third parties.
Patch management programme ensuring timely application of security updates.
DDoS mitigation measures via Cloudflare.
E. Physical security
Personal Data is processed in data centres operated by cloud providers (see Annex III) that maintain industry-standard physical security controls including biometric access, CCTV surveillance, and 24/7 on-site security.
Cloud infrastructure providers maintain SOC 2 Type II and ISO 27001 certifications for their data centres.
F. Incident response and business continuity
Documented incident response plan with defined roles, responsibilities, and escalation procedures.
Regular backups with tested restore procedures.
Business continuity and disaster recovery plans tested at least annually.
Defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
G. Personnel security
Background checks conducted on employees with access to Personal Data (subject to applicable employment law).
Mandatory data protection and security training for all employees upon onboarding and annually thereafter.
Confidentiality agreements with all employees and contractors.
Disciplinary procedures for security policy violations.
H. Data minimisation and retentions
Data minimisation principles applied in the design of the Service.
Automated deletion processes aligned with retention periods specified in Annex I.
Configurable data collection settings enabling Controllers to minimise collection at source.
Payment card data is never stored by Uxify; all payment processing is handled by PCI-DSS compliant third parties.
I. Security governance
Designated data protection contact responsible for overseeing compliance with data protection obligations.
Regular internal security audits and risk assessments.
Vendor security assessment programme for Sub-processors.
Security policies reviewed and updated at least annually.
ANNEX III
List of Approved Sub-processors
The following Sub-processors are approved to process Personal Data in connection with the Service. Uxify shall maintain and update this list in accordance with Clause 4.4 of the Agreement.
Sub-processor | Country | Purpose | Transfer Safeguard |
|---|---|---|---|
Amazon Web Services (AWS) | USA / EU | Cloud infrastructure and data storage | SCCs / AWS DPA |
DigitalOcean | USA / EU | Cloud infrastructure and hosting | SCCs / DigitalOcean DPA |
Google Cloud Platform | USA / EU | Cloud infrastructure and data processing | SCCs / Google DPA |
Google (Workspace & Analytics) | USA / EU | Productivity tools, analytics | SCCs / Google DPA |
Cloudflare | USA / Global | CDN, DDoS protection, network security | SCCs / Cloudflare DPA |
OpenAI | USA | AI-powered product features | SCCs / OpenAI DPA |
Anthropic (Claude) | USA | AI-powered product features | SCCs / Anthropic DPA |
Intercom | USA | Customer support and in-app messaging | SCCs / Intercom DPA |
Stripe | USA / EU | Payment processing (billing data only) | SCCs / Stripe DPA |
Sendgrid (Twilio) | USA | Transactional and marketing email delivery | SCCs / Twilio DPA |
Slack | USA | Internal team communications | SCCs / Slack DPA |
Folk app | France (EU) | CRM and contact management | GDPR compliant (EU entity) |
For each Sub-processor, Uxify has entered or will enter into a written data processing agreement imposing obligations at least equivalent to those imposed on Uxify under this DPA. The current version of this list is maintained at uxify.com/legal.
ANNEX IV
Standard Contractual Clauses
Module Two: Controller to Processor — EU Commission Decision (EU) 2021/914
The Standard Contractual Clauses set out in this Annex IV are the clauses adopted by the European Commission in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
The parties agree that Module Two (Transfer controller to processor) of the SCCs applies to any Restricted Transfer from the Controller (as data exporter) to the Processor (as data importer) under this Agreement. The SCCs are incorporated by reference and supplemented as set out in the completion table below.
Completion of the SCCs (Module Two)
SCC Provision | Selection / Completion |
|---|---|
Clause 7 — Docking clause | Not applicable. |
Clause 9(a) — Sub-processors | Option 2 — General written authorisation. The Controller provides general authorisation to engage Sub-processors listed in Annex III, subject to the notification requirements in Clause 4.4 of this DPA. Minimum notice period: 30 days. |
Clause 11(a) — Redress | The optional redress mechanism is not included. |
Clause 13(a) — Supervisory authority | The competent supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus (for EU GDPR transfers). For UK GDPR transfers, the Information Commissioner's Office (ICO) applies. |
Clause 17 — Governing law | The SCCs shall be governed by the law of the Republic of Cyprus. |
Clause 18(b) — Choice of forum | The courts of the Republic of Cyprus. |
Annex I (to SCCs) | As set out in Annex I of this DPA. |
Annex II (to SCCs) | As set out in Annex II of this DPA (Technical and Organisational Measures). |
Annex III (to SCCs) | As set out in Annex III of this DPA (Sub-processor list). |
UK international data transfer addendum
For transfers subject to the UK GDPR, the parties agree to the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018, as follows:
Table 1 — Parties | As set out in Annex I of this DPA. |
Table 2 — Selected SCCs | EU Commission SCCs (Module Two) as set out in this Annex IV. |
Table 3 — Appendix information | As set out in Annexes I, II, and III of this DPA. |
Table 4 — Ending the Addendum | Either party may end the UK Addendum in accordance with its terms. |
Key obligations under Module Two
The parties acknowledge and agree to the following key obligations incorporated by reference from Module Two of the SCCs:
Clause 8 - Data Protection Safeguards
The data importer (Uxify) shall process personal data only on documented instructions from the data exporter (Customer).
The data importer shall inform the data exporter immediately if it is unable to comply with the SCCs.
The data importer shall process personal data in accordance with the technical and organisational measures in Annex II.
Clause 9 - Use of Sub-processors
The data importer has the data exporter's general authorisation to engage sub-processors listed in Annex III.
The data importer shall notify the data exporter of any intended changes to sub-processors at least 30 days in advance.
The data importer shall impose equivalent data protection obligations on all sub-processors by written contract.
Clause 10 - Data subject rights
The data importer shall promptly notify the data exporter of any request received directly from a data subject and shall not respond without the data exporter's authorisation.
Clause 15 - Obligations in case of access by public authorities
The data importer shall notify the data exporter of any legally binding request for disclosure of personal data by a public authority, unless prohibited by law.
The data importer shall review the legality of any such request and challenge it if permitted by law.
Clause 16 - Non-compliance and suspension
The data importer shall inform the data exporter if it is unable to comply with the SCCs for whatever reason.
The data exporter shall be entitled to suspend personal data transfers if non-compliance presents a substantial risk to data subjects.
The full text of the Standard Contractual Clauses (EU Commission Implementing Decision (EU) 2021/914) is available at eur-lex.europa.eu. The Controller acknowledges that it has had the opportunity to review and is bound by the full text of the SCCs as published by the European Commission.
Data Processing Agreement
1. Preamble
This Data Processing Agreement ("DPA" or "Agreement"), together with all Annexes hereto, forms part of the agreement between UXIFY (CY) LIMITED ("Uxify" or "Processor") and the Customer identified in the applicable Order Form, Terms of Service, or other agreement executed between the parties ("Controller") for the provision of Uxify's real user monitoring, UX analytics, and website optimisation platform (the "Service").
This DPA reflects the parties' agreement with respect to the processing of Personal Data by Uxify on behalf of the Controller in connection with the Service. It is effective as of the date the parties execute the applicable agreement or the Controller first uses the Service, whichever is earlier.
The terms of this DPA are incorporated into and supplement the Terms of Service. In the event of any conflict between this DPA and the Terms of Service with respect to data protection obligations, this DPA shall prevail.
2. Definitions
In this Agreement, the following terms have the meanings set out below. Capitalised terms not defined herein have the meanings given in Applicable Data Protection Law.
"Applicable Data Protection Law"
means all laws and regulations applicable to the processing of Personal Data under this Agreement, including without limitation: (i) the EU General Data Protection Regulation 2016/679 ("GDPR"); (ii) the UK General Data Protection Regulation as defined by the UK Data Protection Act 2018 ("UK GDPR"); (iii) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act 2020 (together, "CCPA/CPRA"); and (iv) any other applicable national or regional data protection laws, in each case as amended, replaced, or supplemented from time to time.
"Controller"
means the entity that determines the purposes and means of the processing of Personal Data — being the Customer in the context of this Agreement.
"Data Breach"
means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed under this Agreement.
"Data Subject"
means an identified or identifiable natural person whose Personal Data is processed.
"EEA"
means the European Economic Area.
"Personal Data"
means any information relating to an identified or identifiable natural person collected or processed through the Service on behalf of the Controller, including but not limited to account information, browsing behaviour, session data, device identifiers, IP addresses, and interaction data as further described in Annex I.
"Processing"
means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction (and "Process", "Processes" and "Processed" shall be construed accordingly).
"Processor"
means the entity that processes Personal Data on behalf of the Controller — being UXIFY (CY) LIMITED in the context of this Agreement.
"Restricted Transfer"
means a transfer of Personal Data to a third country or international organisation not recognised as providing adequate protection under Applicable Data Protection Law.
"Service"
means the real user monitoring, UX analytics, competitive intelligence, Navigation AI, and conversion optimisation platform provided by Uxify under the Terms of Service.
"Services Agreement"
means the Terms of Service, Order Form, or other agreement between the parties governing the Controller's use of the Service.
"Standard Contractual Clauses" or "SCCs"
means the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, adopted by the European Commission in Decision (EU) 2021/914 of 4 June 2021, as set out in Annex IV.
"Sub-processor"
means any third party engaged by the Processor to process Personal Data on behalf of the Controller in connection with the Service.
"UK Addendum"
means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018.
3. Details of Processing
3.1 Subject matter
The Processor shall process Personal Data on behalf of the Controller for the purpose of providing the Service as described in the Services Agreement and in Annex I to this Agreement.
3.2 Duration
The Processor shall process Personal Data for the duration of the Services Agreement, unless otherwise agreed in writing or required by Applicable Data Protection Law. Upon termination or expiry of the Services Agreement, the Processor shall, at the Controller's election, delete or return all Personal Data in accordance with Clause 4.8 of this Agreement.
3.3 Nature and purpose
The Processor processes Personal Data solely for the following purposes:
Providing, maintaining, and improving the Service;
Enabling real user monitoring (RUM), session analytics, user journey analysis, funnel analysis, and behavioural analytics for the Controller;
Enabling Navigation AI features and conversion optimisation functions;
Generating performance, engagement, and business metric reports for the Controller;
Enabling competitive intelligence and benchmarking features using anonymised, aggregated data that cannot be linked to any individual user or specific website;
Ensuring the security, stability, and integrity of the Service;
Complying with legal obligations applicable to the Processor.
The Processor shall not process Personal Data for any purpose beyond those set out above without the prior written consent of the Controller, except where required by Applicable Data Protection Law.
3.4 Types of personal data and categories of data subjects
The types of Personal Data processed and categories of Data Subjects are set out in Annex I to this Agreement.
4. Obligations of the Processor
4.1 General
The Processor shall:
Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by Applicable Data Protection Law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law on grounds of public interest;
Immediately inform the Controller if, in the Processor's opinion, an instruction infringes Applicable Data Protection Law;
Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
Take all appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Clause 4.3 and Annex II;
Respect the conditions referred to in Clauses 4.4 and 4.5 for engaging another processor;
Assist the Controller to ensure compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (security, data breach notification, data protection impact assessment, and prior consultation), taking into account the nature of processing and information available to the Processor;
At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of processing services, and delete existing copies unless Applicable Data Protection Law requires storage of the Personal Data;
Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Clause and allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.
4.2 Confidentiality
The Processor shall ensure that access to Personal Data is limited to those employees, agents, and contractors who need access in order to provide the Service, and that all such persons are subject to written obligations of confidentiality no less protective than those set out in this Agreement. The obligations of confidentiality survive termination of this Agreement.
4.3 Security
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against Data Breaches. Such measures are described in Annex II and shall include, at a minimum:
Pseudonymisation and encryption of Personal Data where appropriate;
Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
Restoring the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
4.4 Sub-processing
4.4.1 General authorisation
The Controller provides general authorisation to the Processor to engage Sub-processors, subject to the conditions set out in this Clause 4.4. The Processor's current list of approved Sub-processors is set out in Annex III.
4.4.2 Changes to Sub-processors
The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) days in advance (where reasonably practicable) by updating Annex III or by providing written notice. The Controller may object in writing to the engagement of a new or replacement Sub-processor within fourteen (14) days of receipt of notice, provided that such objection is based on reasonable grounds relating to data protection. If the parties cannot resolve such objection, the Controller may terminate the applicable Services Agreement on reasonable written notice without penalty as its sole and exclusive remedy.
4.4.3 Sub-processor obligations
Where the Processor engages a Sub-processor, the Processor shall impose data protection obligations on that Sub-processor by way of a written contract that provides at least the same level of protection for Personal Data as this Agreement and that meets the requirements of Article 28 of the GDPR. The Processor shall remain fully liable to the Controller for the performance of Sub-processor obligations.
4.5 Data subject rights
The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subjects' rights under Applicable Data Protection Law, including:
Right of access (Article 15 GDPR);
Right to rectification (Article 16 GDPR);
Right to erasure (Article 17 GDPR);
Right to restriction of processing (Article 18 GDPR);
Right to data portability (Article 20 GDPR);
Right to object (Article 21 GDPR).
The Processor shall promptly notify the Controller, and in any event within five (5) business days, if it receives a request from a Data Subject exercising their rights under Applicable Data Protection Law, and shall not respond to any such request except on the documented instructions of the Controller or as required by Applicable Data Protection Law.
4.6 Data breach notification
The Processor shall notify the Controller without undue delay, and in any event within forty-eight (48) hours of becoming aware of a Data Breach affecting Personal Data processed under this Agreement. Such notification shall include, to the extent then known:
A description of the nature of the Data Breach, including where possible the categories and approximate number of Data Subjects and records concerned;
The name and contact details of the data protection officer or other contact point from whom more information can be obtained;
A description of the likely consequences of the Data Breach;
A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its possible adverse effects.
Where the Processor cannot provide all information in the initial notification, it shall provide the information in phases without undue further delay. The Processor shall provide all reasonable assistance to the Controller in complying with any applicable obligation to notify Data Breaches to Supervisory Authorities or affected Data Subjects.
4.7 Data protection impact assessment and prior consultation
The Processor shall provide the Controller with reasonable assistance in carrying out data protection impact assessments ("DPIAs") and prior consultations with Supervisory Authorities where required under Applicable Data Protection Law, taking into account the nature of the processing and the information available to the Processor.
4.8 Deletion and return of personal data
Upon termination or expiry of the Services Agreement, or upon the written request of the Controller, the Processor shall, at the Controller's election:
Securely delete or destroy all Personal Data (including copies and backups) within sixty (60) days; or
Return all Personal Data to the Controller in a commonly used machine-readable format within thirty (30) days.
The Processor shall provide the Controller with written certification of deletion upon request. Nothing in this Clause shall require the Processor to delete Personal Data to the extent that Applicable Data Protection Law requires its retention, in which case the Processor shall inform the Controller and shall isolate and protect such Personal Data from any further processing except as required by law.
4.9 Audit rights
The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this Agreement. The Processor shall permit the Controller (or a mandated third-party auditor bound by confidentiality obligations) to conduct audits, including inspections, on reasonable notice of no less than thirty (30) calendar days, during normal business hours, and no more than once per calendar year, except where a Supervisory Authority requires more frequent audits or where the Controller reasonably suspects a material breach of this Agreement.
As an alternative to an on-site audit, the Processor may provide relevant third-party audit reports, certifications (e.g., ISO 27001, SOC 2), or other documentation demonstrating compliance, which the Controller may accept in its reasonable discretion. The Controller shall bear the costs of any audit, unless the audit reveals a material breach of this Agreement.
5. Obligations of the controller
The Controller represents, warrants, and agrees that:
It has a valid legal basis under Applicable Data Protection Law for processing Personal Data through the Service, including obtaining valid consents from Data Subjects where required;
It has provided and will continue to provide all necessary notices and disclosures to Data Subjects as required by Applicable Data Protection Law, including information about the use of Uxify as a data processor;
All Personal Data provided to or collected through the Service has been collected lawfully and in compliance with Applicable Data Protection Law;
Its instructions to the Processor shall at all times comply with Applicable Data Protection Law;
It is solely responsible for configuring the Service, including any cookie consent mechanisms, data minimisation settings, and IP anonymisation features made available by the Processor;
It shall not instruct the Processor to process Special Category Data or data relating to children without prior written agreement and implementation of appropriate additional safeguards;
It shall promptly inform the Processor of any changes to its legal basis for processing or any regulatory restrictions applicable to Personal Data processed through the Service;
It shall cooperate with the Processor in good faith to give effect to both parties' obligations under Applicable Data Protection Law.
6. International data transfers
6.1 Transfers within the EEA
Where Personal Data is processed within the EEA, no additional transfer mechanism is required beyond compliance with the GDPR.
6.2 Restricted transfers
Where the Processor or any Sub-processor processes Personal Data outside the EEA (or outside the UK for UK GDPR purposes) and such transfer constitutes a Restricted Transfer, the parties agree that:
The SCCs set out in Annex IV shall apply and are incorporated into this Agreement by reference, with Module Two (Controller to Processor) applying as between the Controller and the Processor;
For transfers subject to UK GDPR, the UK Addendum shall also apply and is incorporated by reference;
Where a Sub-processor is located in a third country, the Processor shall ensure that an appropriate transfer mechanism is in place before transferring Personal Data to such Sub-processor, including back-to-back SCCs where applicable.
6.3 Adequacy decisions
To the extent that a Restricted Transfer is covered by an adequacy decision issued by the European Commission or the UK Government, the parties may rely on such adequacy decision in lieu of the SCCs or UK Addendum for that specific transfer.
6.4 Supplementary measures
Where required by Applicable Data Protection Law or following a transfer impact assessment, the parties shall implement appropriate supplementary technical and organisational measures to ensure an essentially equivalent level of protection to that guaranteed within the EEA or UK, as applicable. The Processor shall cooperate with the Controller in conducting any necessary transfer impact assessment.
7. CCPA/CPRA provisions
7.1 Service provider designation
To the extent Applicable Data Protection Law includes the CCPA/CPRA, the Processor is a "Service Provider" as defined under the CCPA/CPRA and shall process Personal Information (as defined under the CCPA/CPRA) only:
For the business purpose of providing the Service as set out in this Agreement and the Services Agreement;
As otherwise permitted by the CCPA/CPRA for Service Providers.
7.2 Prohibited uses
The Processor shall not:
Sell or Share (as those terms are defined under the CCPA/CPRA) Personal Information processed under this Agreement;
Retain, use, or disclose Personal Information for any commercial purpose other than providing the Service;
Retain, use, or disclose Personal Information outside the direct business relationship with the Controller;
Combine Personal Information received under this Agreement with Personal Information received from or collected in connection with another business, except as permitted by the CCPA/CPRA.
7.3 Consumer rights assistance
The Processor shall assist the Controller in responding to verifiable consumer requests to exercise rights under the CCPA/CPRA, including rights of access, deletion, correction, and opt-out of Sale or Sharing, in accordance with Clause 4.5 of this Agreement.
7.4 Certification
The Processor certifies that it understands the restrictions in this Clause 7 and will comply with them. Uxify does not sell users' personal information.
8. Liability
8.1 Each party shall be liable to Data Subjects and, where applicable, to Supervisory Authorities for damage caused by processing that infringes Applicable Data Protection Law, in accordance with the allocation of responsibility set out therein.
8.2 As between the parties, each party's liability under this Agreement shall be subject to the limitations and exclusions set out in the Services Agreement. The parties agree that any limitation of liability in the Services Agreement shall apply to this DPA and the SCCs to the maximum extent permitted by Applicable Data Protection Law.
8.3 To the extent any limitation of liability is inconsistent with the obligations imposed on processors under the GDPR (including Articles 82 and 83), the applicable GDPR provisions shall prevail to the extent required by law.
9. Term and termination
9.1 This Agreement shall commence on the effective date of the Services Agreement and shall continue for so long as the Processor processes Personal Data on behalf of the Controller.
9.2 This Agreement shall automatically terminate upon termination or expiry of the Services Agreement, subject to any obligations that by their nature survive termination (including Clauses 4.2, 4.8, 6, and 8).
9.3 Either party may terminate this Agreement with immediate effect by written notice if the other party commits a material breach of this Agreement that is incapable of remedy, or that is not remedied within thirty (30) days of receipt of written notice specifying the breach and requiring remedy.
10. Governing law and jurisdiction
10.1 This Agreement and any non-contractual obligations arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Republic of Cyprus, without regard to its conflict of law provisions.
10.2 The parties irrevocably submit to the exclusive jurisdiction of the courts of the Republic of Cyprus to settle any dispute arising out of or in connection with this Agreement.
10.3 The foregoing is without prejudice to the mandatory provisions of Applicable Data Protection Law and the jurisdiction of competent Supervisory Authorities.
10.4 For the purposes of the SCCs, the governing law and choice of forum clauses within the SCCs shall apply in addition to, and shall not be affected by, this Clause 10.
11. General provisions
11.1 Entire Agreement. This Agreement (together with the Services Agreement and the Annexes) constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and representations with respect thereto.
11.2 Amendments. This Agreement may only be modified by a written instrument signed by authorised representatives of both parties, except that Annex III (Sub-processor list) may be updated unilaterally by the Processor subject to the notification requirements in Clause 4.4.
11.3 Severability. If any provision of this Agreement is held invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.
11.4 Waiver. No failure or delay by a party to exercise any right or remedy under this Agreement shall constitute a waiver of that right or remedy.
11.5 Notices. Notices under this Agreement shall be in writing and sent by email or registered post to the addresses specified in the Services Agreement or as otherwise notified in writing by either party.
11.6 Counterparts. This Agreement may be executed in counterparts and by electronic signature, each of which shall be deemed an original and together shall constitute one agreement.
11.7 Precedence. In the event of any conflict or inconsistency between the documents forming the agreement between the parties, the order of precedence shall be: (i) this DPA; (ii) the SCCs (if applicable); (iii) the Services Agreement; (iv) any order forms or statements of work.
ANNEX I
Details of Processing Activities
A. List of parties
Role | Data Controller |
Entity | As identified in the Services Agreement |
Address | As identified in the Services Agreement |
Contact / DPO | As designated by the Controller |
Role | Data Processor |
Entity | UXIFY (CY) LIMITED |
Registration | HE 485277 (Cyprus) |
Address | Nafpliou 15, Floor 2, 3025 Limassol, Cyprus |
Data Protection Contact |
B. Categories of data subjects
Category | Description |
|---|---|
End Users / Visitors | Natural persons who visit or interact with the Controller's website(s) or digital properties instrumented with the Uxify tracking script. |
Registered Customers | Natural persons who register for or use the Uxify platform directly (account holders), including name, email address, and website URL. |
Identified End Users (if configured) | Authenticated users of the Controller's platform where the Controller configures user identification within the Service. |
C. Categories of personal data
Category | Examples |
|---|---|
Account Data | Name / username, email address, hashed password, website URL (provided by registered Customers). |
Network Identifiers | IP address (full or truncated), network operator data, visitor country derived from IP. |
Device & Browser Data | Browser type and version, operating system, screen resolution, device form factor (desktop / tablet / mobile), language preference, referring site. |
Behavioural / Interaction Data | Page URLs visited, referrer URLs, clicks, scrolls, mouse movements, rage clicks, navigation paths, session duration, time on page, date and time of access. |
Performance Metrics (RUM) | Largest Contentful Paint (LCP), First Input Delay (FID), Cumulative Layout Shift (CLS), time-to-interaction, connection type, and other Core Web Vitals. |
Session Data | Pseudonymous session identifiers, timestamps, session replay data (if enabled by Controller). |
Conversion & Funnel Data | Goal completions, funnel step data, form interactions (field-level, excluding the content of sensitive fields). |
Special Category Data: Uxify does not intentionally collect or process Special Category Data as defined in Article 9 GDPR or Personal Data relating to criminal convictions or offences. The Controller is responsible for configuring the Service to prevent the transmission of Special Category Data. Uxify does not collect information from anyone under the age of 13 and does not address the Service to children.
D. Purposes and legal bases
Purpose | Legal Basis (GDPR) |
|---|---|
Providing real user monitoring, session analytics, and UX reports | Performance of contract / legitimate interests |
Navigation AI and conversion optimisation | Legitimate interests / consent (where applicable) |
Anonymised benchmarking and industry reports | Legitimate interests (data is fully anonymised) |
Account management and customer communications | Performance of contract |
Service security, fraud prevention, and abuse detection | Legitimate interests / legal obligation |
Compliance with legal obligations | Legal obligation |
e. Retention periods
Data Type | Retention Period |
|---|---|
Raw session and event data | 13 months from collection (configurable by Controller) |
Account and customer data | For the duration of the account; up to 6 years after account closure or as required by law |
Aggregated analytics reports | 36 months (or duration of Services Agreement) |
IP addresses (full) | Not retained beyond session processing (anonymised/truncated after use) |
Backup copies | Deleted within 90 days of primary deletion |
Security logs | 12 months |
F. Frequency and nature of transfers
Frequency: Continuous, as Personal Data is generated by visitors to the Controller's digital properties in real time.
Nature: Collection, recording, organisation, structuring, storage, retrieval, analysis, aggregation, visualisation, and transmission to the Controller.
ANNEX II
Technical and Organisational Security Measures
Uxify implements and maintains the following technical and organisational measures to protect Personal Data:
A. Access controls
Role-based access control (RBAC) limiting access to Personal Data to authorised personnel on a need-to-know basis.
Multi-factor authentication (MFA) required for access to production systems containing Personal Data.
Privileged access management with just-in-time access provisioning for administrative tasks.
Regular review and revocation of access rights upon role changes or employment termination.
Audit logging of all access to Personal Data and systems.
B. Data encryption
All Personal Data transmitted over public networks is encrypted using TLS 1.2 or higher.
Personal Data stored at rest is encrypted using AES-256 or equivalent standards.
Database encryption at the storage layer.
Encryption keys managed using dedicated key management systems with strict access controls.
C. Pseudonymisation and anonymisation
IP addresses are truncated or anonymised during ingest where configured by the Controller.
Session identifiers are pseudonymous and do not directly identify natural persons.
Data used for industry benchmarking is fully anonymised and cannot be linked to any individual user or specific website.
D. Network and infrastructure security
Firewalls and intrusion detection/prevention systems protecting production environments.
Network segmentation separating production, staging, and development environments.
Regular vulnerability scanning and penetration testing conducted at least annually by qualified third parties.
Patch management programme ensuring timely application of security updates.
DDoS mitigation measures via Cloudflare.
E. Physical security
Personal Data is processed in data centres operated by cloud providers (see Annex III) that maintain industry-standard physical security controls including biometric access, CCTV surveillance, and 24/7 on-site security.
Cloud infrastructure providers maintain SOC 2 Type II and ISO 27001 certifications for their data centres.
F. Incident response and business continuity
Documented incident response plan with defined roles, responsibilities, and escalation procedures.
Regular backups with tested restore procedures.
Business continuity and disaster recovery plans tested at least annually.
Defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
G. Personnel security
Background checks conducted on employees with access to Personal Data (subject to applicable employment law).
Mandatory data protection and security training for all employees upon onboarding and annually thereafter.
Confidentiality agreements with all employees and contractors.
Disciplinary procedures for security policy violations.
H. Data minimisation and retentions
Data minimisation principles applied in the design of the Service.
Automated deletion processes aligned with retention periods specified in Annex I.
Configurable data collection settings enabling Controllers to minimise collection at source.
Payment card data is never stored by Uxify; all payment processing is handled by PCI-DSS compliant third parties.
I. Security governance
Designated data protection contact responsible for overseeing compliance with data protection obligations.
Regular internal security audits and risk assessments.
Vendor security assessment programme for Sub-processors.
Security policies reviewed and updated at least annually.
ANNEX III
List of Approved Sub-processors
The following Sub-processors are approved to process Personal Data in connection with the Service. Uxify shall maintain and update this list in accordance with Clause 4.4 of the Agreement.
Sub-processor | Country | Purpose | Transfer Safeguard |
|---|---|---|---|
Amazon Web Services (AWS) | USA / EU | Cloud infrastructure and data storage | SCCs / AWS DPA |
DigitalOcean | USA / EU | Cloud infrastructure and hosting | SCCs / DigitalOcean DPA |
Google Cloud Platform | USA / EU | Cloud infrastructure and data processing | SCCs / Google DPA |
Google (Workspace & Analytics) | USA / EU | Productivity tools, analytics | SCCs / Google DPA |
Cloudflare | USA / Global | CDN, DDoS protection, network security | SCCs / Cloudflare DPA |
OpenAI | USA | AI-powered product features | SCCs / OpenAI DPA |
Anthropic (Claude) | USA | AI-powered product features | SCCs / Anthropic DPA |
Intercom | USA | Customer support and in-app messaging | SCCs / Intercom DPA |
Stripe | USA / EU | Payment processing (billing data only) | SCCs / Stripe DPA |
Sendgrid (Twilio) | USA | Transactional and marketing email delivery | SCCs / Twilio DPA |
Slack | USA | Internal team communications | SCCs / Slack DPA |
Folk app | France (EU) | CRM and contact management | GDPR compliant (EU entity) |
For each Sub-processor, Uxify has entered or will enter into a written data processing agreement imposing obligations at least equivalent to those imposed on Uxify under this DPA. The current version of this list is maintained at uxify.com/legal.
ANNEX IV
Standard Contractual Clauses
Module Two: Controller to Processor — EU Commission Decision (EU) 2021/914
The Standard Contractual Clauses set out in this Annex IV are the clauses adopted by the European Commission in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
The parties agree that Module Two (Transfer controller to processor) of the SCCs applies to any Restricted Transfer from the Controller (as data exporter) to the Processor (as data importer) under this Agreement. The SCCs are incorporated by reference and supplemented as set out in the completion table below.
Completion of the SCCs (Module Two)
SCC Provision | Selection / Completion |
|---|---|
Clause 7 — Docking clause | Not applicable. |
Clause 9(a) — Sub-processors | Option 2 — General written authorisation. The Controller provides general authorisation to engage Sub-processors listed in Annex III, subject to the notification requirements in Clause 4.4 of this DPA. Minimum notice period: 30 days. |
Clause 11(a) — Redress | The optional redress mechanism is not included. |
Clause 13(a) — Supervisory authority | The competent supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus (for EU GDPR transfers). For UK GDPR transfers, the Information Commissioner's Office (ICO) applies. |
Clause 17 — Governing law | The SCCs shall be governed by the law of the Republic of Cyprus. |
Clause 18(b) — Choice of forum | The courts of the Republic of Cyprus. |
Annex I (to SCCs) | As set out in Annex I of this DPA. |
Annex II (to SCCs) | As set out in Annex II of this DPA (Technical and Organisational Measures). |
Annex III (to SCCs) | As set out in Annex III of this DPA (Sub-processor list). |
UK international data transfer addendum
For transfers subject to the UK GDPR, the parties agree to the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018, as follows:
Table 1 — Parties | As set out in Annex I of this DPA. |
Table 2 — Selected SCCs | EU Commission SCCs (Module Two) as set out in this Annex IV. |
Table 3 — Appendix information | As set out in Annexes I, II, and III of this DPA. |
Table 4 — Ending the Addendum | Either party may end the UK Addendum in accordance with its terms. |
Key obligations under Module Two
The parties acknowledge and agree to the following key obligations incorporated by reference from Module Two of the SCCs:
Clause 8 - Data Protection Safeguards
The data importer (Uxify) shall process personal data only on documented instructions from the data exporter (Customer).
The data importer shall inform the data exporter immediately if it is unable to comply with the SCCs.
The data importer shall process personal data in accordance with the technical and organisational measures in Annex II.
Clause 9 - Use of Sub-processors
The data importer has the data exporter's general authorisation to engage sub-processors listed in Annex III.
The data importer shall notify the data exporter of any intended changes to sub-processors at least 30 days in advance.
The data importer shall impose equivalent data protection obligations on all sub-processors by written contract.
Clause 10 - Data subject rights
The data importer shall promptly notify the data exporter of any request received directly from a data subject and shall not respond without the data exporter's authorisation.
Clause 15 - Obligations in case of access by public authorities
The data importer shall notify the data exporter of any legally binding request for disclosure of personal data by a public authority, unless prohibited by law.
The data importer shall review the legality of any such request and challenge it if permitted by law.
Clause 16 - Non-compliance and suspension
The data importer shall inform the data exporter if it is unable to comply with the SCCs for whatever reason.
The data exporter shall be entitled to suspend personal data transfers if non-compliance presents a substantial risk to data subjects.
The full text of the Standard Contractual Clauses (EU Commission Implementing Decision (EU) 2021/914) is available at eur-lex.europa.eu. The Controller acknowledges that it has had the opportunity to review and is bound by the full text of the SCCs as published by the European Commission.
Data Processing Agreement
1. Preamble
This Data Processing Agreement ("DPA" or "Agreement"), together with all Annexes hereto, forms part of the agreement between UXIFY (CY) LIMITED ("Uxify" or "Processor") and the Customer identified in the applicable Order Form, Terms of Service, or other agreement executed between the parties ("Controller") for the provision of Uxify's real user monitoring, UX analytics, and website optimisation platform (the "Service").
This DPA reflects the parties' agreement with respect to the processing of Personal Data by Uxify on behalf of the Controller in connection with the Service. It is effective as of the date the parties execute the applicable agreement or the Controller first uses the Service, whichever is earlier.
The terms of this DPA are incorporated into and supplement the Terms of Service. In the event of any conflict between this DPA and the Terms of Service with respect to data protection obligations, this DPA shall prevail.
2. Definitions
In this Agreement, the following terms have the meanings set out below. Capitalised terms not defined herein have the meanings given in Applicable Data Protection Law.
"Applicable Data Protection Law"
means all laws and regulations applicable to the processing of Personal Data under this Agreement, including without limitation: (i) the EU General Data Protection Regulation 2016/679 ("GDPR"); (ii) the UK General Data Protection Regulation as defined by the UK Data Protection Act 2018 ("UK GDPR"); (iii) the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act 2020 (together, "CCPA/CPRA"); and (iv) any other applicable national or regional data protection laws, in each case as amended, replaced, or supplemented from time to time.
"Controller"
means the entity that determines the purposes and means of the processing of Personal Data — being the Customer in the context of this Agreement.
"Data Breach"
means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed under this Agreement.
"Data Subject"
means an identified or identifiable natural person whose Personal Data is processed.
"EEA"
means the European Economic Area.
"Personal Data"
means any information relating to an identified or identifiable natural person collected or processed through the Service on behalf of the Controller, including but not limited to account information, browsing behaviour, session data, device identifiers, IP addresses, and interaction data as further described in Annex I.
"Processing"
means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction (and "Process", "Processes" and "Processed" shall be construed accordingly).
"Processor"
means the entity that processes Personal Data on behalf of the Controller — being UXIFY (CY) LIMITED in the context of this Agreement.
"Restricted Transfer"
means a transfer of Personal Data to a third country or international organisation not recognised as providing adequate protection under Applicable Data Protection Law.
"Service"
means the real user monitoring, UX analytics, competitive intelligence, Navigation AI, and conversion optimisation platform provided by Uxify under the Terms of Service.
"Services Agreement"
means the Terms of Service, Order Form, or other agreement between the parties governing the Controller's use of the Service.
"Standard Contractual Clauses" or "SCCs"
means the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, adopted by the European Commission in Decision (EU) 2021/914 of 4 June 2021, as set out in Annex IV.
"Sub-processor"
means any third party engaged by the Processor to process Personal Data on behalf of the Controller in connection with the Service.
"UK Addendum"
means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018.
3. Details of Processing
3.1 Subject matter
The Processor shall process Personal Data on behalf of the Controller for the purpose of providing the Service as described in the Services Agreement and in Annex I to this Agreement.
3.2 Duration
The Processor shall process Personal Data for the duration of the Services Agreement, unless otherwise agreed in writing or required by Applicable Data Protection Law. Upon termination or expiry of the Services Agreement, the Processor shall, at the Controller's election, delete or return all Personal Data in accordance with Clause 4.8 of this Agreement.
3.3 Nature and purpose
The Processor processes Personal Data solely for the following purposes:
Providing, maintaining, and improving the Service;
Enabling real user monitoring (RUM), session analytics, user journey analysis, funnel analysis, and behavioural analytics for the Controller;
Enabling Navigation AI features and conversion optimisation functions;
Generating performance, engagement, and business metric reports for the Controller;
Enabling competitive intelligence and benchmarking features using anonymised, aggregated data that cannot be linked to any individual user or specific website;
Ensuring the security, stability, and integrity of the Service;
Complying with legal obligations applicable to the Processor.
The Processor shall not process Personal Data for any purpose beyond those set out above without the prior written consent of the Controller, except where required by Applicable Data Protection Law.
3.4 Types of personal data and categories of data subjects
The types of Personal Data processed and categories of Data Subjects are set out in Annex I to this Agreement.
4. Obligations of the Processor
4.1 General
The Processor shall:
Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by Applicable Data Protection Law; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law on grounds of public interest;
Immediately inform the Controller if, in the Processor's opinion, an instruction infringes Applicable Data Protection Law;
Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
Take all appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Clause 4.3 and Annex II;
Respect the conditions referred to in Clauses 4.4 and 4.5 for engaging another processor;
Assist the Controller to ensure compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (security, data breach notification, data protection impact assessment, and prior consultation), taking into account the nature of processing and information available to the Processor;
At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of processing services, and delete existing copies unless Applicable Data Protection Law requires storage of the Personal Data;
Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Clause and allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.
4.2 Confidentiality
The Processor shall ensure that access to Personal Data is limited to those employees, agents, and contractors who need access in order to provide the Service, and that all such persons are subject to written obligations of confidentiality no less protective than those set out in this Agreement. The obligations of confidentiality survive termination of this Agreement.
4.3 Security
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against Data Breaches. Such measures are described in Annex II and shall include, at a minimum:
Pseudonymisation and encryption of Personal Data where appropriate;
Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
Restoring the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
4.4 Sub-processing
4.4.1 General authorisation
The Controller provides general authorisation to the Processor to engage Sub-processors, subject to the conditions set out in this Clause 4.4. The Processor's current list of approved Sub-processors is set out in Annex III.
4.4.2 Changes to Sub-processors
The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) days in advance (where reasonably practicable) by updating Annex III or by providing written notice. The Controller may object in writing to the engagement of a new or replacement Sub-processor within fourteen (14) days of receipt of notice, provided that such objection is based on reasonable grounds relating to data protection. If the parties cannot resolve such objection, the Controller may terminate the applicable Services Agreement on reasonable written notice without penalty as its sole and exclusive remedy.
4.4.3 Sub-processor obligations
Where the Processor engages a Sub-processor, the Processor shall impose data protection obligations on that Sub-processor by way of a written contract that provides at least the same level of protection for Personal Data as this Agreement and that meets the requirements of Article 28 of the GDPR. The Processor shall remain fully liable to the Controller for the performance of Sub-processor obligations.
4.5 Data subject rights
The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures for the fulfilment of the Controller's obligation to respond to requests for exercising Data Subjects' rights under Applicable Data Protection Law, including:
Right of access (Article 15 GDPR);
Right to rectification (Article 16 GDPR);
Right to erasure (Article 17 GDPR);
Right to restriction of processing (Article 18 GDPR);
Right to data portability (Article 20 GDPR);
Right to object (Article 21 GDPR).
The Processor shall promptly notify the Controller, and in any event within five (5) business days, if it receives a request from a Data Subject exercising their rights under Applicable Data Protection Law, and shall not respond to any such request except on the documented instructions of the Controller or as required by Applicable Data Protection Law.
4.6 Data breach notification
The Processor shall notify the Controller without undue delay, and in any event within forty-eight (48) hours of becoming aware of a Data Breach affecting Personal Data processed under this Agreement. Such notification shall include, to the extent then known:
A description of the nature of the Data Breach, including where possible the categories and approximate number of Data Subjects and records concerned;
The name and contact details of the data protection officer or other contact point from whom more information can be obtained;
A description of the likely consequences of the Data Breach;
A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its possible adverse effects.
Where the Processor cannot provide all information in the initial notification, it shall provide the information in phases without undue further delay. The Processor shall provide all reasonable assistance to the Controller in complying with any applicable obligation to notify Data Breaches to Supervisory Authorities or affected Data Subjects.
4.7 Data protection impact assessment and prior consultation
The Processor shall provide the Controller with reasonable assistance in carrying out data protection impact assessments ("DPIAs") and prior consultations with Supervisory Authorities where required under Applicable Data Protection Law, taking into account the nature of the processing and the information available to the Processor.
4.8 Deletion and return of personal data
Upon termination or expiry of the Services Agreement, or upon the written request of the Controller, the Processor shall, at the Controller's election:
Securely delete or destroy all Personal Data (including copies and backups) within sixty (60) days; or
Return all Personal Data to the Controller in a commonly used machine-readable format within thirty (30) days.
The Processor shall provide the Controller with written certification of deletion upon request. Nothing in this Clause shall require the Processor to delete Personal Data to the extent that Applicable Data Protection Law requires its retention, in which case the Processor shall inform the Controller and shall isolate and protect such Personal Data from any further processing except as required by law.
4.9 Audit rights
The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this Agreement. The Processor shall permit the Controller (or a mandated third-party auditor bound by confidentiality obligations) to conduct audits, including inspections, on reasonable notice of no less than thirty (30) calendar days, during normal business hours, and no more than once per calendar year, except where a Supervisory Authority requires more frequent audits or where the Controller reasonably suspects a material breach of this Agreement.
As an alternative to an on-site audit, the Processor may provide relevant third-party audit reports, certifications (e.g., ISO 27001, SOC 2), or other documentation demonstrating compliance, which the Controller may accept in its reasonable discretion. The Controller shall bear the costs of any audit, unless the audit reveals a material breach of this Agreement.
5. Obligations of the controller
The Controller represents, warrants, and agrees that:
It has a valid legal basis under Applicable Data Protection Law for processing Personal Data through the Service, including obtaining valid consents from Data Subjects where required;
It has provided and will continue to provide all necessary notices and disclosures to Data Subjects as required by Applicable Data Protection Law, including information about the use of Uxify as a data processor;
All Personal Data provided to or collected through the Service has been collected lawfully and in compliance with Applicable Data Protection Law;
Its instructions to the Processor shall at all times comply with Applicable Data Protection Law;
It is solely responsible for configuring the Service, including any cookie consent mechanisms, data minimisation settings, and IP anonymisation features made available by the Processor;
It shall not instruct the Processor to process Special Category Data or data relating to children without prior written agreement and implementation of appropriate additional safeguards;
It shall promptly inform the Processor of any changes to its legal basis for processing or any regulatory restrictions applicable to Personal Data processed through the Service;
It shall cooperate with the Processor in good faith to give effect to both parties' obligations under Applicable Data Protection Law.
6. International data transfers
6.1 Transfers within the EEA
Where Personal Data is processed within the EEA, no additional transfer mechanism is required beyond compliance with the GDPR.
6.2 Restricted transfers
Where the Processor or any Sub-processor processes Personal Data outside the EEA (or outside the UK for UK GDPR purposes) and such transfer constitutes a Restricted Transfer, the parties agree that:
The SCCs set out in Annex IV shall apply and are incorporated into this Agreement by reference, with Module Two (Controller to Processor) applying as between the Controller and the Processor;
For transfers subject to UK GDPR, the UK Addendum shall also apply and is incorporated by reference;
Where a Sub-processor is located in a third country, the Processor shall ensure that an appropriate transfer mechanism is in place before transferring Personal Data to such Sub-processor, including back-to-back SCCs where applicable.
6.3 Adequacy decisions
To the extent that a Restricted Transfer is covered by an adequacy decision issued by the European Commission or the UK Government, the parties may rely on such adequacy decision in lieu of the SCCs or UK Addendum for that specific transfer.
6.4 Supplementary measures
Where required by Applicable Data Protection Law or following a transfer impact assessment, the parties shall implement appropriate supplementary technical and organisational measures to ensure an essentially equivalent level of protection to that guaranteed within the EEA or UK, as applicable. The Processor shall cooperate with the Controller in conducting any necessary transfer impact assessment.
7. CCPA/CPRA provisions
7.1 Service provider designation
To the extent Applicable Data Protection Law includes the CCPA/CPRA, the Processor is a "Service Provider" as defined under the CCPA/CPRA and shall process Personal Information (as defined under the CCPA/CPRA) only:
For the business purpose of providing the Service as set out in this Agreement and the Services Agreement;
As otherwise permitted by the CCPA/CPRA for Service Providers.
7.2 Prohibited uses
The Processor shall not:
Sell or Share (as those terms are defined under the CCPA/CPRA) Personal Information processed under this Agreement;
Retain, use, or disclose Personal Information for any commercial purpose other than providing the Service;
Retain, use, or disclose Personal Information outside the direct business relationship with the Controller;
Combine Personal Information received under this Agreement with Personal Information received from or collected in connection with another business, except as permitted by the CCPA/CPRA.
7.3 Consumer rights assistance
The Processor shall assist the Controller in responding to verifiable consumer requests to exercise rights under the CCPA/CPRA, including rights of access, deletion, correction, and opt-out of Sale or Sharing, in accordance with Clause 4.5 of this Agreement.
7.4 Certification
The Processor certifies that it understands the restrictions in this Clause 7 and will comply with them. Uxify does not sell users' personal information.
8. Liability
8.1 Each party shall be liable to Data Subjects and, where applicable, to Supervisory Authorities for damage caused by processing that infringes Applicable Data Protection Law, in accordance with the allocation of responsibility set out therein.
8.2 As between the parties, each party's liability under this Agreement shall be subject to the limitations and exclusions set out in the Services Agreement. The parties agree that any limitation of liability in the Services Agreement shall apply to this DPA and the SCCs to the maximum extent permitted by Applicable Data Protection Law.
8.3 To the extent any limitation of liability is inconsistent with the obligations imposed on processors under the GDPR (including Articles 82 and 83), the applicable GDPR provisions shall prevail to the extent required by law.
9. Term and termination
9.1 This Agreement shall commence on the effective date of the Services Agreement and shall continue for so long as the Processor processes Personal Data on behalf of the Controller.
9.2 This Agreement shall automatically terminate upon termination or expiry of the Services Agreement, subject to any obligations that by their nature survive termination (including Clauses 4.2, 4.8, 6, and 8).
9.3 Either party may terminate this Agreement with immediate effect by written notice if the other party commits a material breach of this Agreement that is incapable of remedy, or that is not remedied within thirty (30) days of receipt of written notice specifying the breach and requiring remedy.
10. Governing law and jurisdiction
10.1 This Agreement and any non-contractual obligations arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Republic of Cyprus, without regard to its conflict of law provisions.
10.2 The parties irrevocably submit to the exclusive jurisdiction of the courts of the Republic of Cyprus to settle any dispute arising out of or in connection with this Agreement.
10.3 The foregoing is without prejudice to the mandatory provisions of Applicable Data Protection Law and the jurisdiction of competent Supervisory Authorities.
10.4 For the purposes of the SCCs, the governing law and choice of forum clauses within the SCCs shall apply in addition to, and shall not be affected by, this Clause 10.
11. General provisions
11.1 Entire Agreement. This Agreement (together with the Services Agreement and the Annexes) constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and representations with respect thereto.
11.2 Amendments. This Agreement may only be modified by a written instrument signed by authorised representatives of both parties, except that Annex III (Sub-processor list) may be updated unilaterally by the Processor subject to the notification requirements in Clause 4.4.
11.3 Severability. If any provision of this Agreement is held invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.
11.4 Waiver. No failure or delay by a party to exercise any right or remedy under this Agreement shall constitute a waiver of that right or remedy.
11.5 Notices. Notices under this Agreement shall be in writing and sent by email or registered post to the addresses specified in the Services Agreement or as otherwise notified in writing by either party.
11.6 Counterparts. This Agreement may be executed in counterparts and by electronic signature, each of which shall be deemed an original and together shall constitute one agreement.
11.7 Precedence. In the event of any conflict or inconsistency between the documents forming the agreement between the parties, the order of precedence shall be: (i) this DPA; (ii) the SCCs (if applicable); (iii) the Services Agreement; (iv) any order forms or statements of work.
ANNEX I
Details of Processing Activities
A. List of parties
Role | Data Controller |
Entity | As identified in the Services Agreement |
Address | As identified in the Services Agreement |
Contact / DPO | As designated by the Controller |
Role | Data Processor |
Entity | UXIFY (CY) LIMITED |
Registration | HE 485277 (Cyprus) |
Address | Nafpliou 15, Floor 2, 3025 Limassol, Cyprus |
Data Protection Contact |
B. Categories of data subjects
Category | Description |
|---|---|
End Users / Visitors | Natural persons who visit or interact with the Controller's website(s) or digital properties instrumented with the Uxify tracking script. |
Registered Customers | Natural persons who register for or use the Uxify platform directly (account holders), including name, email address, and website URL. |
Identified End Users (if configured) | Authenticated users of the Controller's platform where the Controller configures user identification within the Service. |
C. Categories of personal data
Category | Examples |
|---|---|
Account Data | Name / username, email address, hashed password, website URL (provided by registered Customers). |
Network Identifiers | IP address (full or truncated), network operator data, visitor country derived from IP. |
Device & Browser Data | Browser type and version, operating system, screen resolution, device form factor (desktop / tablet / mobile), language preference, referring site. |
Behavioural / Interaction Data | Page URLs visited, referrer URLs, clicks, scrolls, mouse movements, rage clicks, navigation paths, session duration, time on page, date and time of access. |
Performance Metrics (RUM) | Largest Contentful Paint (LCP), First Input Delay (FID), Cumulative Layout Shift (CLS), time-to-interaction, connection type, and other Core Web Vitals. |
Session Data | Pseudonymous session identifiers, timestamps, session replay data (if enabled by Controller). |
Conversion & Funnel Data | Goal completions, funnel step data, form interactions (field-level, excluding the content of sensitive fields). |
Special Category Data: Uxify does not intentionally collect or process Special Category Data as defined in Article 9 GDPR or Personal Data relating to criminal convictions or offences. The Controller is responsible for configuring the Service to prevent the transmission of Special Category Data. Uxify does not collect information from anyone under the age of 13 and does not address the Service to children.
D. Purposes and legal bases
Purpose | Legal Basis (GDPR) |
|---|---|
Providing real user monitoring, session analytics, and UX reports | Performance of contract / legitimate interests |
Navigation AI and conversion optimisation | Legitimate interests / consent (where applicable) |
Anonymised benchmarking and industry reports | Legitimate interests (data is fully anonymised) |
Account management and customer communications | Performance of contract |
Service security, fraud prevention, and abuse detection | Legitimate interests / legal obligation |
Compliance with legal obligations | Legal obligation |
e. Retention periods
Data Type | Retention Period |
|---|---|
Raw session and event data | 13 months from collection (configurable by Controller) |
Account and customer data | For the duration of the account; up to 6 years after account closure or as required by law |
Aggregated analytics reports | 36 months (or duration of Services Agreement) |
IP addresses (full) | Not retained beyond session processing (anonymised/truncated after use) |
Backup copies | Deleted within 90 days of primary deletion |
Security logs | 12 months |
F. Frequency and nature of transfers
Frequency: Continuous, as Personal Data is generated by visitors to the Controller's digital properties in real time.
Nature: Collection, recording, organisation, structuring, storage, retrieval, analysis, aggregation, visualisation, and transmission to the Controller.
ANNEX II
Technical and Organisational Security Measures
Uxify implements and maintains the following technical and organisational measures to protect Personal Data:
A. Access controls
Role-based access control (RBAC) limiting access to Personal Data to authorised personnel on a need-to-know basis.
Multi-factor authentication (MFA) required for access to production systems containing Personal Data.
Privileged access management with just-in-time access provisioning for administrative tasks.
Regular review and revocation of access rights upon role changes or employment termination.
Audit logging of all access to Personal Data and systems.
B. Data encryption
All Personal Data transmitted over public networks is encrypted using TLS 1.2 or higher.
Personal Data stored at rest is encrypted using AES-256 or equivalent standards.
Database encryption at the storage layer.
Encryption keys managed using dedicated key management systems with strict access controls.
C. Pseudonymisation and anonymisation
IP addresses are truncated or anonymised during ingest where configured by the Controller.
Session identifiers are pseudonymous and do not directly identify natural persons.
Data used for industry benchmarking is fully anonymised and cannot be linked to any individual user or specific website.
D. Network and infrastructure security
Firewalls and intrusion detection/prevention systems protecting production environments.
Network segmentation separating production, staging, and development environments.
Regular vulnerability scanning and penetration testing conducted at least annually by qualified third parties.
Patch management programme ensuring timely application of security updates.
DDoS mitigation measures via Cloudflare.
E. Physical security
Personal Data is processed in data centres operated by cloud providers (see Annex III) that maintain industry-standard physical security controls including biometric access, CCTV surveillance, and 24/7 on-site security.
Cloud infrastructure providers maintain SOC 2 Type II and ISO 27001 certifications for their data centres.
F. Incident response and business continuity
Documented incident response plan with defined roles, responsibilities, and escalation procedures.
Regular backups with tested restore procedures.
Business continuity and disaster recovery plans tested at least annually.
Defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
G. Personnel security
Background checks conducted on employees with access to Personal Data (subject to applicable employment law).
Mandatory data protection and security training for all employees upon onboarding and annually thereafter.
Confidentiality agreements with all employees and contractors.
Disciplinary procedures for security policy violations.
H. Data minimisation and retentions
Data minimisation principles applied in the design of the Service.
Automated deletion processes aligned with retention periods specified in Annex I.
Configurable data collection settings enabling Controllers to minimise collection at source.
Payment card data is never stored by Uxify; all payment processing is handled by PCI-DSS compliant third parties.
I. Security governance
Designated data protection contact responsible for overseeing compliance with data protection obligations.
Regular internal security audits and risk assessments.
Vendor security assessment programme for Sub-processors.
Security policies reviewed and updated at least annually.
ANNEX III
List of Approved Sub-processors
The following Sub-processors are approved to process Personal Data in connection with the Service. Uxify shall maintain and update this list in accordance with Clause 4.4 of the Agreement.
Sub-processor | Country | Purpose | Transfer Safeguard |
|---|---|---|---|
Amazon Web Services (AWS) | USA / EU | Cloud infrastructure and data storage | SCCs / AWS DPA |
DigitalOcean | USA / EU | Cloud infrastructure and hosting | SCCs / DigitalOcean DPA |
Google Cloud Platform | USA / EU | Cloud infrastructure and data processing | SCCs / Google DPA |
Google (Workspace & Analytics) | USA / EU | Productivity tools, analytics | SCCs / Google DPA |
Cloudflare | USA / Global | CDN, DDoS protection, network security | SCCs / Cloudflare DPA |
OpenAI | USA | AI-powered product features | SCCs / OpenAI DPA |
Anthropic (Claude) | USA | AI-powered product features | SCCs / Anthropic DPA |
Intercom | USA | Customer support and in-app messaging | SCCs / Intercom DPA |
Stripe | USA / EU | Payment processing (billing data only) | SCCs / Stripe DPA |
Sendgrid (Twilio) | USA | Transactional and marketing email delivery | SCCs / Twilio DPA |
Slack | USA | Internal team communications | SCCs / Slack DPA |
Folk app | France (EU) | CRM and contact management | GDPR compliant (EU entity) |
For each Sub-processor, Uxify has entered or will enter into a written data processing agreement imposing obligations at least equivalent to those imposed on Uxify under this DPA. The current version of this list is maintained at uxify.com/legal.
ANNEX IV
Standard Contractual Clauses
Module Two: Controller to Processor — EU Commission Decision (EU) 2021/914
The Standard Contractual Clauses set out in this Annex IV are the clauses adopted by the European Commission in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.
The parties agree that Module Two (Transfer controller to processor) of the SCCs applies to any Restricted Transfer from the Controller (as data exporter) to the Processor (as data importer) under this Agreement. The SCCs are incorporated by reference and supplemented as set out in the completion table below.
Completion of the SCCs (Module Two)
SCC Provision | Selection / Completion |
|---|---|
Clause 7 — Docking clause | Not applicable. |
Clause 9(a) — Sub-processors | Option 2 — General written authorisation. The Controller provides general authorisation to engage Sub-processors listed in Annex III, subject to the notification requirements in Clause 4.4 of this DPA. Minimum notice period: 30 days. |
Clause 11(a) — Redress | The optional redress mechanism is not included. |
Clause 13(a) — Supervisory authority | The competent supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus (for EU GDPR transfers). For UK GDPR transfers, the Information Commissioner's Office (ICO) applies. |
Clause 17 — Governing law | The SCCs shall be governed by the law of the Republic of Cyprus. |
Clause 18(b) — Choice of forum | The courts of the Republic of Cyprus. |
Annex I (to SCCs) | As set out in Annex I of this DPA. |
Annex II (to SCCs) | As set out in Annex II of this DPA (Technical and Organisational Measures). |
Annex III (to SCCs) | As set out in Annex III of this DPA (Sub-processor list). |
UK international data transfer addendum
For transfers subject to the UK GDPR, the parties agree to the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018, as follows:
Table 1 — Parties | As set out in Annex I of this DPA. |
Table 2 — Selected SCCs | EU Commission SCCs (Module Two) as set out in this Annex IV. |
Table 3 — Appendix information | As set out in Annexes I, II, and III of this DPA. |
Table 4 — Ending the Addendum | Either party may end the UK Addendum in accordance with its terms. |
Key obligations under Module Two
The parties acknowledge and agree to the following key obligations incorporated by reference from Module Two of the SCCs:
Clause 8 - Data Protection Safeguards
The data importer (Uxify) shall process personal data only on documented instructions from the data exporter (Customer).
The data importer shall inform the data exporter immediately if it is unable to comply with the SCCs.
The data importer shall process personal data in accordance with the technical and organisational measures in Annex II.
Clause 9 - Use of Sub-processors
The data importer has the data exporter's general authorisation to engage sub-processors listed in Annex III.
The data importer shall notify the data exporter of any intended changes to sub-processors at least 30 days in advance.
The data importer shall impose equivalent data protection obligations on all sub-processors by written contract.
Clause 10 - Data subject rights
The data importer shall promptly notify the data exporter of any request received directly from a data subject and shall not respond without the data exporter's authorisation.
Clause 15 - Obligations in case of access by public authorities
The data importer shall notify the data exporter of any legally binding request for disclosure of personal data by a public authority, unless prohibited by law.
The data importer shall review the legality of any such request and challenge it if permitted by law.
Clause 16 - Non-compliance and suspension
The data importer shall inform the data exporter if it is unable to comply with the SCCs for whatever reason.
The data exporter shall be entitled to suspend personal data transfers if non-compliance presents a substantial risk to data subjects.
The full text of the Standard Contractual Clauses (EU Commission Implementing Decision (EU) 2021/914) is available at eur-lex.europa.eu. The Controller acknowledges that it has had the opportunity to review and is bound by the full text of the SCCs as published by the European Commission.
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 623 200" xmlns="http://www.w3.org/2000/svg"><g d="M 192.12 158.811 C 182.595 158.811 174.136 156.9 166.744 153.079 C 159.493 149.115 153.807 143.737 149.684 136.943 C 145.561 130.007 143.5 122.081 143.5 113.163 L 143.5 53.291 L 176.126 53.291 L 176.126 112.739 C 176.126 116.277 176.695 119.321 177.832 121.868 C 179.112 124.416 180.96 126.398 183.377 127.813 C 185.794 129.229 188.708 129.936 192.12 129.936 C 196.953 129.936 200.792 128.45 203.635 125.478 C 206.478 122.364 207.9 118.117 207.9 112.739 L 207.9 53.291 L 240.526 53.291 L 240.526 112.951 C 240.526 122.01 238.465 130.007 234.342 136.943 C 230.22 143.737 224.533 149.115 217.283 153.079 C 210.032 156.9 201.645 158.811 192.12 158.811 Z M 325.198 156.476 L 300.248 116.348 L 293.211 111.89 L 252.481 53.29 L 290.652 53.29 L 313.896 90.87 L 320.72 95.117 L 362.942 156.476 Z M 250.562 156.476 L 292.998 96.391 L 311.55 117.197 L 286.174 156.476 Z M 320.507 111.677 L 301.954 90.871 L 325.411 53.291 L 360.81 53.291 Z M 375.339 156.476 L 375.339 53.291 L 407.965 53.291 L 407.965 156.476 Z M 391.759 39.066 C 386.641 39.066 382.376 37.367 378.964 33.97 C 375.694 30.432 374.059 26.185 374.059 21.231 C 374.059 16.136 375.694 11.89 378.964 8.493 C 382.376 5.096 386.641 3.397 391.759 3.397 C 396.877 3.397 401.07 5.096 404.34 8.493 C 407.61 11.89 409.245 16.136 409.245 21.231 C 409.245 26.185 407.61 30.431 404.34 33.971 C 401.07 37.367 396.877 39.066 391.759 39.066 Z M 444.162 156.476 L 444.162 44.374 C 444.162 36.023 446.01 28.521 449.706 21.868 C 453.545 15.074 458.876 9.766 465.7 5.945 C 472.524 1.982 480.627 0 490.01 0 C 497.118 0 503.302 1.203 508.562 3.61 C 513.964 5.874 518.656 9.059 522.636 13.163 L 502.165 33.546 C 500.773 32.15 499.101 31.065 497.26 30.361 C 495.554 29.511 493.493 29.087 491.076 29.087 C 486.669 29.087 483.186 30.361 480.627 32.909 C 478.068 35.456 476.789 38.924 476.789 43.312 L 476.789 156.476 Z M 421.345 80.892 L 421.345 53.29 L 506.643 53.29 L 506.643 80.89 L 421.345 80.89 Z M 553.515 156.9 L 510.866 53.29 L 546.052 53.29 L 573.134 135.456 L 560.126 135.456 L 587.848 53.291 L 623.033 53.291 L 578.678 156.9 Z M 526.86 200 L 557.993 133.121 L 578.678 156.9 L 560.339 200 Z M 0 68.944 C 0 60.139 7.154 53 15.98 53 C 24.804 53 31.959 60.138 31.959 68.943 L 31.959 112.637 C 31.959 121.442 39.113 128.58 47.938 128.58 C 56.763 128.58 63.917 121.442 63.917 112.637 L 63.917 68.944 C 63.917 60.139 71.071 53.001 79.897 53.001 C 88.721 53.001 95.875 60.139 95.875 68.944 L 95.875 109.095 C 95.875 135.51 74.413 156.923 47.938 156.923 C 21.462 156.923 0 135.51 0 109.095 Z M 0 68.943 C 0 60.138 7.154 53 15.979 53 C 24.804 53 31.958 60.138 31.958 68.943 C 31.958 77.748 24.804 84.886 15.979 84.886 C 7.154 84.886 0 77.748 0 68.943 Z M 64 68.943 C 64 60.138 71.154 53 79.979 53 C 88.804 53 95.958 60.138 95.958 68.943 C 95.958 77.748 88.804 84.886 79.979 84.886 C 71.154 84.886 64 77.748 64 68.943 Z M 34.5 142.671 C 34.5 134.844 40.859 128.5 48.704 128.5 C 56.548 128.5 62.907 134.844 62.907 142.671 C 62.907 150.497 56.548 156.842 48.704 156.842 C 40.859 156.842 34.5 150.497 34.5 142.671 Z" fill="transparent" height="200.00000219726564px" id="SUzGAp3Sa" width="623.032997314453px"><path d="M 48.62 158.811 C 39.095 158.811 30.636 156.9 23.244 153.079 C 15.993 149.115 10.307 143.737 6.184 136.943 C 2.061 130.007 0 122.081 0 113.163 L 0 53.291 L 32.626 53.291 L 32.626 112.739 C 32.626 116.277 33.195 119.321 34.332 121.868 C 35.612 124.416 37.46 126.398 39.877 127.813 C 42.294 129.229 45.208 129.936 48.62 129.936 C 53.453 129.936 57.292 128.45 60.135 125.478 C 62.978 122.364 64.4 118.117 64.4 112.739 L 64.4 53.291 L 97.026 53.291 L 97.026 112.951 C 97.026 122.01 94.965 130.007 90.842 136.943 C 86.72 143.737 81.033 149.115 73.783 153.079 C 66.532 156.9 58.145 158.811 48.62 158.811 Z M 181.698 156.476 L 156.748 116.348 L 149.711 111.89 L 108.981 53.29 L 147.152 53.29 L 170.396 90.87 L 177.22 95.117 L 219.442 156.476 Z M 107.062 156.476 L 149.498 96.391 L 168.05 117.197 L 142.674 156.476 Z M 177.007 111.677 L 158.454 90.871 L 181.911 53.291 L 217.31 53.291 Z M 231.839 156.476 L 231.839 53.291 L 264.465 53.291 L 264.465 156.476 Z M 248.259 39.066 C 243.141 39.066 238.876 37.367 235.464 33.97 C 232.194 30.432 230.559 26.185 230.559 21.231 C 230.559 16.136 232.194 11.89 235.464 8.493 C 238.876 5.096 243.141 3.397 248.259 3.397 C 253.377 3.397 257.57 5.096 260.84 8.493 C 264.11 11.89 265.745 16.136 265.745 21.231 C 265.745 26.185 264.11 30.431 260.84 33.971 C 257.57 37.367 253.377 39.066 248.259 39.066 Z M 300.662 156.476 L 300.662 44.374 C 300.662 36.023 302.51 28.521 306.206 21.868 C 310.045 15.074 315.376 9.766 322.2 5.945 C 329.024 1.982 337.127 0 346.51 0 C 353.618 0 359.802 1.203 365.062 3.61 C 370.464 5.874 375.156 9.059 379.136 13.163 L 358.665 33.546 C 357.273 32.15 355.601 31.065 353.76 30.361 C 352.054 29.511 349.993 29.087 347.576 29.087 C 343.169 29.087 339.686 30.361 337.127 32.909 C 334.568 35.456 333.289 38.924 333.289 43.312 L 333.289 156.476 Z M 277.845 80.892 L 277.845 53.29 L 363.143 53.29 L 363.143 80.89 L 277.845 80.89 Z M 410.015 156.9 L 367.366 53.29 L 402.552 53.29 L 429.634 135.456 L 416.626 135.456 L 444.348 53.291 L 479.533 53.291 L 435.178 156.9 Z M 383.36 200 L 414.493 133.121 L 435.178 156.9 L 416.839 200 Z" fill="rgb(255, 255, 255)" height="200.00000219726564px" id="j9Mmwfnw8" transform="translate(143.5 0)" width="479.5329973144531px"/><path d="M 0 15.944 C 0 7.139 7.154 0 15.98 0 C 24.804 0 31.959 7.138 31.959 15.943 L 31.959 59.637 C 31.959 68.442 39.113 75.58 47.938 75.58 C 56.763 75.58 63.917 68.442 63.917 59.637 L 63.917 15.944 C 63.917 7.139 71.071 0.001 79.897 0.001 C 88.721 0.001 95.875 7.139 95.875 15.944 L 95.875 56.095 C 95.875 82.51 74.413 103.923 47.938 103.923 C 21.462 103.923 0 82.51 0 56.095 Z" fill="rgb(59, 63, 91)" height="103.923px" id="KJCDMITFE" transform="translate(0 53)" width="95.875px"/><path d="M 0 15.943 C 0 7.138 7.154 0 15.979 0 C 24.804 0 31.958 7.138 31.958 15.943 C 31.958 24.748 24.804 31.886 15.979 31.886 C 7.154 31.886 0 24.748 0 15.943 Z" fill="rgb(252, 200, 0)" height="31.885999999999996px" id="q2K9EYOvZ" transform="translate(0 53)" width="31.95799999999963px"/><path d="M 0 15.943 C 0 7.138 7.154 0 15.979 0 C 24.804 0 31.958 7.138 31.958 15.943 C 31.958 24.748 24.804 31.886 15.979 31.886 C 7.154 31.886 0 24.748 0 15.943 Z" fill="rgb(63, 184, 126)" height="31.885999999999996px" id="bBya7XCj7" transform="translate(64 53)" width="31.95799999999963px"/><path d="M 0 14.171 C 0 6.344 6.359 0 14.204 0 C 22.048 0 28.407 6.344 28.407 14.171 C 28.407 21.997 22.048 28.342 14.204 28.342 C 6.359 28.342 0 21.997 0 14.171 Z" fill="rgb(229, 0, 106)" height="28.341999999999985px" id="WNzwBFOi7" transform="translate(34.5 128.5)" width="28.407000000000153px"/></g></svg>)
© 2026 UXIFY. U.S. registered trademark. All rights reserved.
© 2026 UXIFY. U.S. registered trademark. All rights reserved.
© 2026 UXIFY. U.S. registered trademark. All rights reserved.
© 2026 UXIFY. U.S. registered trademark. All rights reserved.