Data Processing Agreement

This Data Processing Agreement ("DPA") is between the Customer identified in the accepted Passiro account or order and Passiro ApS, registration number 46722248, of Gammel Kongevej 60, 1850 Frederiksberg C, Denmark ("Passiro"). Privacy contact: privacy@passiro.com or our contact form. Customer data-protection contact: the designated contact recorded in the account or order.

1. Scope, roles and priority

1.1 This DPA forms part of the agreement governing the Customer's use of Passiro (the "Main Agreement"). It applies to all plans, including Free, Pro, Business and Enterprise, and any related service to the extent Passiro processes personal data on the Customer's behalf ("Customer Personal Data").

1.2 The Customer is the controller and Passiro is the processor, unless the Customer itself acts as processor for an identified controller, in which case Passiro is a sub-processor. In that case, the Customer confirms that it has authority to appoint Passiro and communicate lawful instructions from the controller. References to the Customer's obligations and instructions will be read accordingly.

1.3 The DPA does not govern information for which Passiro determines its own purposes as an independent controller, such as its own account administration, invoicing, security of its systems and the Service Data described in section 7 of the Terms and Conditions. Those activities are explained in the Privacy Policy.

1.4 Terms such as personal data, processing, controller, processor and personal data breach have the meanings given by the GDPR. Applicable Data Protection Law includes the GDPR and other data-protection legislation applicable to the processing. This DPA prevails over conflicting commercial terms on processing matters, except that liability is governed by section 10. Mandatory transfer clauses prevail where their terms require this.

2. Processing and instructions

2.1 The subject matter, purposes, operations, duration, data categories and data subjects are specified in Annex 1. Processing is limited to delivering, securing and supporting the agreed Service under the Customer's documented instructions. The Main Agreement, this DPA with its annexes, and the Customer's configuration and use of the Service are the Customer's complete documented instructions. Additional instructions require Passiro's written agreement and may be charged where they go beyond the standard functionality of the Service.

2.2 Passiro will not use Customer Personal Data for its own advertising or sell it. The Customer instructs Passiro to anonymise and aggregate Customer Personal Data and to extract technical, non-personal information from scan results and service operation, such as cookie and storage names, domains, scripts and vendor identities, so that Passiro can use the resulting non-personal data as Service Data under section 7 of the Terms and Conditions, including to train and improve Passiro's own classification models. Passiro will not use Customer Personal Data to train general-purpose AI models. Personal data must be excluded or irreversibly anonymised before any such further use.

2.3 Passiro will process Customer Personal Data only on documented instructions, including in relation to transfers, unless applicable Union or Member State law requires otherwise. Where that exception applies, Passiro will inform the Customer before processing unless the law prohibits this on important grounds of public interest. Requests under other jurisdictions will be assessed against applicable Data Protection Law and transfer safeguards.

2.4 Passiro will immediately inform the Customer if, in its opinion, an instruction infringes applicable Data Protection Law, and may suspend the affected processing, without liability, until the Customer confirms or changes the instruction.

2.5 The Customer is responsible for lawful instructions, appropriate legal bases, required transparency, its collection of data, the accuracy of its configuration and authorising website scanning. This does not diminish Passiro's own obligations.

3. Confidentiality and security

3.1 Passiro will ensure that authorised personnel are bound by confidentiality obligations and access Customer Personal Data only as necessary for their duties. Access must be reviewed and removed when no longer needed.

3.2 Passiro will implement appropriate technical and organisational measures under GDPR Article 32, taking account of the risks and the nature of processing. The concrete measures are recorded in Annex 2. Passiro may update the measures at any time, provided the overall level of protection is not materially reduced. The Customer has assessed the measures in Annex 2 and considers them appropriate for its processing.

4. Sub-processors

4.1 The Customer gives general written authorisation for Passiro to engage sub-processors, including those listed in Annex 3 and on the current list referred to there. Passiro will provide at least 14 days' advance notice of any intended addition or replacement by updating that list and emailing the Customer's account contact, identifying the provider, function and relevant locations. Passiro may replace a sub-processor without advance notice where urgently necessary for security, continuity or legal reasons and will then inform the Customer without undue delay.

4.2 The Customer may object in writing within the notice period on reasonable grounds relating to data protection. The parties will work in good faith to resolve the objection. If no reasonable solution is found before the proposed appointment takes effect, the Customer's sole remedy is to terminate the affected service before that date. For paid subscriptions, Passiro will refund prepaid fees for the unused affected service. If the Customer does not object within the notice period, the sub-processor is deemed accepted.

4.3 Passiro will bind each sub-processor to written obligations that provide substantially the same data-protection protection required by this DPA for its processing, including appropriate security and assistance. Passiro remains liable to the Customer for performance of the sub-processor's obligations as required by GDPR Article 28(4), subject to section 10.

5. Locations and transfers

5.1 Processing locations depend on the sub-processors engaged and are described per provider in Annex 3, including storage, backups and relevant remote access. The Customer instructs Passiro to transfer Customer Personal Data to the sub-processors and locations authorised under section 4, including outside the EEA, provided that a transfer mechanism under GDPR Chapter V applies.

5.2 Where a transfer to a sub-processor relies on standard contractual clauses, Passiro will enter into the applicable clauses with that sub-processor. Where the Customer is established outside the EEA and is not itself subject to the GDPR, module four (processor to controller) of the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 is incorporated into this DPA for Passiro's transfers of Customer Personal Data to the Customer, with Danish law and the Danish courts chosen where the clauses allow a choice. Applicable UK or other transfer requirements are addressed in section 11.

6. Requests and assistance

6.1 Taking account of the nature of processing, Passiro will assist the Customer through appropriate technical and organisational measures in responding to requests to exercise data-subject rights. Requests received directly by Passiro concerning Customer Personal Data will be forwarded without undue delay. Passiro will not decide the response independently unless law requires it.

6.2 Taking account of the information available to it, Passiro will assist the Customer with its obligations concerning security, breach notification, data protection impact assessments and prior consultation under GDPR Articles 32–36.

6.3 Assistance available through the standard functions of the Service is included in the Service. Other assistance under this section 6 and under section 8 is charged at Passiro's hourly rates in force from time to time, except assistance required because of Passiro's breach of this DPA, which will not be charged.

7. Personal data breaches

7.1 Passiro will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. An initial notification will be provided even if the investigation is incomplete; further details will follow as available.

7.2 The notification will describe, to the extent known, the nature of the breach, affected data and data subjects and their approximate numbers, likely consequences, measures taken or proposed and a contact for follow-up. Passiro will contain and investigate the breach, cooperate with the Customer and document relevant facts and remedial steps. A notification is not an admission of fault or liability.

7.3 The Customer determines notifications to authorities and data subjects for processing under its control. This does not prevent Passiro from making disclosures independently required by law, with coordination and prior notice where permitted.

8. Demonstrating compliance and audits

8.1 Passiro will make available the information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the Customer or its mandated independent auditor.

8.2 Passiro will meet its obligations under section 8.1 primarily by providing written information, answers to reasonable questionnaires and the certifications or assurance reports available from Passiro and its sub-processors. An audit going beyond this may be requested only where that documentation does not provide adequate evidence, where a supervisory authority requires it, or following a confirmed personal data breach affecting Customer Personal Data. Such an audit requires at least 30 days' written notice, takes place during business hours, is conducted remotely where possible and is subject to confidentiality and measures to protect other customers' data. Audits of sub-processors are subject to the sub-processors' own terms.

8.3 Audits going beyond review of documentation and assurance reports are limited to one per twelve-month period, unless a supervisory authority requires otherwise. The Customer bears its own audit costs and pays for Passiro's time at Passiro's hourly rates in force from time to time, together with reasonable expenses, unless the audit reveals a material breach of this DPA by Passiro. An auditor mandated by the Customer must be independent, bound by confidentiality and not a competitor of Passiro.

9. Return, deletion and duration

9.1 This DPA takes effect with electronic acceptance or signature of the Main Agreement and remains effective while Passiro processes Customer Personal Data, including residual backups.

9.2 At the end of the relevant processing service, the Customer may choose return or deletion of Customer Personal Data. The Customer exercises its choice of return by exporting the data through the export functions of the Service before the end of the service or within any export period under the Main Agreement. Passiro will then delete its remaining copies according to Annex 1 unless retention is required by Union or Member State law. If the Customer does not export the data, the standing instruction is deletion according to Annex 1.

9.3 Return will be in a commonly used, machine-readable format. Active-system deletion and backup retention follow Annex 1. Residual backup data will remain protected, inaccessible for ordinary use and deleted on the fixed cycle specified there. If restored for disaster recovery, relevant deletion instructions will be reapplied.

9.4 Where law requires retention, Passiro will identify the requirement to the Customer unless prohibited, isolate the retained data and limit further processing to that requirement. Passiro will confirm completion of deletion on request.

9.5 A downgrade to Free does not end this DPA for processing that continues. If a particular feature is discontinued on downgrade, its data is deleted according to Annex 1 unless the Customer exports it first.

10. Liability and other terms

10.1 The limitations and exclusions of liability in the Main Agreement apply to all claims between the parties under or in connection with this DPA, including recourse claims under GDPR Article 82(5), to the extent permitted by applicable law. This does not restrict data-subject rights under GDPR Article 82 or bind supervisory authorities.

10.2 Passiro may update this DPA and its annexes, including the measures in Annex 2 and the sub-processor list under section 4, by giving notice as set out in the Main Agreement, provided the DPA continues to meet GDPR Article 28. A change that alters the purposes for which Passiro processes Customer Personal Data requires the Customer's documented agreement or instruction, which may be given through configuration or selection of features. Electronic acceptance is intended to create a binding written agreement, and the accepted version and completed annexes will be available to both parties.

11. Additional jurisdiction terms

11.1 US state privacy laws. Where a US state privacy law, including the California Consumer Privacy Act as amended ("CCPA"), applies to Customer Personal Data, Passiro acts as the Customer's service provider or processor. Passiro will process that data only for the specific business purposes and services described in the Main Agreement and this DPA, will not sell or share it, will not retain, use or disclose it outside the direct business relationship with the Customer, will not combine it with personal information from other sources except as that law permits, and will notify the Customer if it can no longer meet these obligations. The Customer may take the reasonable and appropriate steps set out in sections 6 and 8 to help ensure that Passiro uses the data consistently with the Customer's obligations and to stop and remediate unauthorised use.

11.2 UK data protection. Where the UK GDPR applies, references in this DPA to the GDPR, supervisory authorities and international-transfer requirements will be read to include the corresponding UK requirements where relevant. Transfers from the United Kingdom to Passiro in Denmark may rely on applicable UK adequacy arrangements while they remain in force. If a restricted UK transfer requires another safeguard, the parties will use the applicable UK International Data Transfer Agreement, UK Addendum to the EU Standard Contractual Clauses or another lawful mechanism, as appropriate.

11.3 Other jurisdictions. Where another mandatory privacy or data-protection law applies to the processing and requires additional processor terms, the parties will cooperate in good faith to apply or execute the reasonably necessary jurisdiction-specific terms. Nothing in this paragraph requires Passiro to accept obligations unrelated to the Service or to laws that do not apply to the relevant processing.

Annex 1 Processing specification and instructions

Subject matter: Consent management and the specific related services selected by the Customer, across all plan levels.

Purpose: Implement the Customer's consent choices, document those choices, supply configured scans, reports and declarations, provide necessary support and operation of those functions, and anonymise and aggregate data as instructed in section 2.2.

Operations: As applicable to the selected services: collection, transmission, recording, hosting, retrieval, display, export, restriction, anonymisation, aggregation and deletion.

Banner delivery and consent records

Data subjects: Visitors to Customer websites.

Data categories: A random consent identifier stored in the visitor's browser, consent choices and changes, timestamps, the relevant banner and configuration version, site identifier, the website's host name, language, the applicable consent rules, approximate location at country and region level, browser privacy signals such as Global Privacy Control, and applicable consent-framework strings and states. Only information needed to deliver, apply and demonstrate consent choices is processed. Full IP addresses and full browser identifiers are not stored as part of the consent proof; where a value derived from them is needed to demonstrate a choice, it is pseudonymised with secrets that are rotated and destroyed regularly. Page addresses beyond the host name and the content of other cookies are not recorded. Network data is processed only transiently to deliver the banner and determine approximate location.

Retention instruction: Consent records are retained for the consent-history period of the Customer's current plan, as shown on the pricing page: 13 months on Free, 24 months on Pro, 36 months on Business, and the period agreed in the order on Enterprise, or 36 months where none is agreed. Each period runs from the time the individual record is created. The period is actual retention, not only dashboard access: each record is deleted or irreversibly anonymised within 30 days after its period ends, and an active account does not extend it. Any shorter retention setting expressly supported by the Service and selected by the Customer applies instead. The consent identifier in the visitor's browser expires after 12 months unless the visitor makes a new choice. Changes to a plan's retention period follow the Main Agreement, and a downgrade follows the instructions below.

Technical delivery logs

Data subjects: Website visitors and relevant Customer users.

Data categories: Limited request and error metadata necessary to deliver and protect the Service, such as time, requested resource, response status and browser type. IP addresses and other identifiers are minimised, are kept only where needed for security and are never reused for visitor profiling or advertising. Aggregated delivery statistics contain no IP addresses or browser identifiers.

Retention instruction: No more than 30 days from collection. Where particular entries are required to investigate an identified security incident, only the necessary entries are isolated and access to them is restricted. They are deleted when that investigation and any justified follow-up are complete, and no later than 12 months after isolation unless they are needed for a legal claim.

Website scanning and reports

Data subjects: People whose personal data may appear in scanned material.

Data categories: URLs of scanned pages without query strings, the names, providers, purposes and lifetimes of cookies and similar technologies, the third-party services a page contacts, technical page metadata needed for the selected service, and screenshots of the scanned website and its consent banner. Personal data incidentally present in page content, URL parameters or screenshots is excluded or minimised wherever possible: cookie values, query-string values and contact details found on pages are not retained, and raw page content is not retained merely because it was accessible to the scanner.

Retention instruction: Raw scan material is deleted as soon as the relevant result has been extracted, and in any event within 30 days after the scan. The current scan results, declaration data and screenshots are kept while the website remains in the Customer's account. Earlier scan results are retained for 24 months from the scan on every plan. All scan data for a website is deleted or irreversibly anonymised within 30 days after the website or the account is removed. Discontinued features follow the downgrade instructions below.

Customer-configured public declarations

Data subjects: Contact persons identified by the Customer.

Data categories: The business details and declaration configuration supplied by the Customer for publication, such as company name, logo and links to the Customer's own privacy and cookie notices, together with the relevant cookie and tracker information.

Retention instruction: Until removed by the Customer or the relevant feature ends. Removed declarations are deleted from active storage, and cached copies under Passiro's control are invalidated, within 7 days.

Support requiring access to Customer content

Data subjects: Relevant visitors, users or people appearing in Customer content.

Data categories: Only the consent records, scan information, configuration or messages necessary for the authorised support task. Access is limited to authorised personnel, is time-limited and logged, and is used only for the task's requirements.

Retention instruction: Temporary copies or attachments containing Customer Personal Data are deleted when no longer needed, and no later than 30 days after the support issue is resolved. Passiro's own administrative support correspondence is covered separately by its Privacy Policy.

Sensitive data: The Service is not intended for special-category data or criminal-offence data. The Customer must not intentionally submit it without a separate documented arrangement. Incidental inclusion in scanned content remains protected under this DPA; access must be restricted and the content filtered or deleted as soon as practicable.

Duration: During the agreed activity and the defined return/deletion process. No trial expiry applies. A Free account continues until it is closed under the Main Agreement, and individual records follow their retention periods.

Termination schedule: For paid subscriptions, export is available for 30 days after termination. For the Free plan, export is available until closure, as stated in the Main Agreement. Active data is deleted or irreversibly anonymised by the end of the applicable period, or earlier on the Customer's instruction under section 9. Residual backups are erased within no more than 90 days after active deletion. Until expiry, backup data remains protected, is unavailable for ordinary operational use and is restored only where necessary for recovery; any applicable deletion instruction is reapplied after restoration. Legal retention is limited as stated in section 9.

Feature downgrade instructions: A downgrade does not terminate this DPA. Data needed for continuing features remains subject to the new plan's retention limits. From the effective downgrade date, the Customer has 30 days to export existing history exceeding the new plan's limit and data relating solely to discontinued features, unless the Customer instructs earlier deletion. During that period, such data is retained only for export and necessary protection, rather than continued delivery of the discontinued feature. At the end of the period it is deleted or irreversibly anonymised in active systems; residual backups follow the backup cycle above. No new excess history is accumulated under the former plan.

Annex 2 Technical and organisational measures

Access

Access to Customer Personal Data is restricted to authorised personnel with a work-related need, using individual accounts and least-privilege permissions. All administrative and privileged access requires multi-factor authentication. Access is approved by Passiro's management, reviewed at least every six months and revoked without undue delay when no longer required. Access to a Customer's account for support is time-limited, used only for the authorised task and logged with the person who used it.

Separation

Customer organisations and their data are logically separated. Server-side authorisation verifies the relevant account, website and permissions before data is accessed or changed. Public endpoints serve only information the Customer has chosen to publish. Cross-account access is covered by automated tests and reviewed after material changes.

Transmission and storage

Customer Personal Data is protected by encryption during transmission over public networks and at rest in databases, object storage and backups. Passwords, where managed by Passiro, are stored only using an adaptive one-way password-hashing method. Credentials and secrets are kept out of source code, and access to them and to encryption keys is restricted to authorised administrators.

Minimisation

The Service limits processing to data needed for the instructed functions. Full IP addresses and full browser identifiers are excluded from consent proof, and pseudonymised values are derived with regularly rotated secrets. Technical logs have separate access and retention controls. Unnecessary URL parameters, cookie values and raw scan content are excluded, redacted or promptly deleted. Anonymisation and aggregation follow section 2.2 and must not leave information from which an individual can reasonably be identified.

Monitoring

Administrative sign-ins, support access to Customer accounts, configuration changes, security events and failures are logged. Access to logs is restricted to authorised personnel, logs are protected against unauthorised alteration, and the availability of the Service is monitored continuously. Alerts are reviewed and escalated. Logs follow the applicable retention schedule in Annex 1.

Vulnerabilities

Operating systems and software dependencies are kept up to date through a documented update process, with security updates applied automatically where possible and dependencies reviewed at least monthly. Reported vulnerabilities are assessed by risk and remediated according to severity, with critical issues addressed within 7 days and high-severity issues within 30 days. Security testing is performed at least annually and after material changes.

Availability and recovery

Databases are backed up at least daily. Backups are encrypted, stored in a separate location within the EEA, access to them is restricted, and they expire according to Annex 1. Restoration is tested at least quarterly and the result is documented. Any contractual recovery or availability targets apply only where separately agreed.

Incidents

A documented incident-response process covers detection, escalation, containment, investigation, recovery and Customer notification in accordance with section 7. Passiro's management owns the process. Affected Customers are notified by email to the account contact. Relevant evidence and actions are recorded and access to them is restricted.

People and suppliers

Personnel authorised to process Customer Personal Data are bound by confidentiality obligations before access is granted and receive security and data-protection training at onboarding and at least annually. Sub-processors undergo due diligence before engagement and are reviewed at least annually, and they are engaged under written data-protection obligations consistent with this DPA.

Deletion

Retention and deletion procedures cover active systems, exports, temporary support copies, caches and backups. Deletion or irreversible anonymisation is performed automatically according to Annex 1, including on downgrade, termination and removal of a website or account, and failures are monitored. Data restored from backup remains subject to previous deletion instructions, which are recorded and reapplied before restored data returns to ordinary use.

Review

Passiro's management reviews the effectiveness of these measures at least annually and following material changes or significant incidents. Findings and corrective actions are documented.

Any Enterprise-specific security or service-level commitments must be separately attached and identified. This annex does not give every plan an Enterprise SLA.

Annex 3 Approved sub-processors and locations

Passiro hosts the application, its databases and website scanning on servers it operates itself in Denmark. No third-party hosting provider has access to them. The following sub-processors process Customer Personal Data:

A billing provider processing Passiro's own commercial data is not a sub-processor of website visitor data and is described in the Privacy Policy.

Register and changes: This annex is the current versioned list of approved sub-processors and is published at passiro.com/dpa#annex-3. Changes are recorded with the DPA version and date at the top of this page. Passiro gives the Customer direct written notice of any intended addition or replacement in accordance with section 4, including its objection procedure; updating this page alone does not replace that notice. The recipient is the Customer's designated account/data-protection contact.