Legal
Data Processing Agreement
Version 1.1 · Effective: 22 Sep 2026
This Data Processing Agreement ("DPA") forms part of the agreement between you ("Controller", "Customer") and White Label Consultancy AS, operating as Pritect Beacon ("Processor", "we", "us"), for the provision of consent management services as described in the Terms of Service.
This DPA applies where and only to the extent that we process Personal Data on your behalf in the course of providing the Pritect Beacon service, and such processing is subject to the European Union ("EU"), European Economic Area ("EEA"), United Kingdom ("UK"), or Swiss data protection laws.
1. Definitions
- Personal Data: any information relating to an identified or identifiable natural person that is processed by us on your behalf under this DPA.
- Processing: any operation performed on Personal Data, including collection, storage, retrieval, and deletion.
- Data Subject: the individual to whom the Personal Data relates (typically your website visitors).
- Sub-processor: any third party engaged by us to process Personal Data on your behalf.
- Standard Contractual Clauses (SCCs): the contractual clauses approved by the European Commission for international data transfers.
2. Scope of Processing
| Subject matter | Consent management, cookie scanning, consent record storage, and compliance reporting. |
| Duration | For the duration of the service agreement, plus any legally required retention periods. |
| Nature & purpose | Collecting, storing, and providing access to end-user consent decisions for the Customer's website(s). |
| Categories of data | Consent decisions, pseudonymised session IDs, IP addresses pseudonymised with a keyed HMAC, country of origin, user agent strings, page URLs, consent timestamps. The IP address itself is not stored. |
| Data subjects | End users who visit the Customer's website(s) where the Pritect Beacon script is deployed. |
3. Obligations of the Processor
We shall:
- Process Personal Data only on your documented instructions, unless required by applicable law.
- Ensure that all persons authorised to process Personal Data are bound by obligations of confidentiality.
- Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of data in transit (TLS) and at rest, pseudonymisation (keyed HMAC of IP addresses), access controls, and regular security testing.
- Assist you in fulfilling your obligations to respond to Data Subject requests (access, erasure, portability) through the data subject request features described in section 8.
- Assist you in ensuring compliance with breach notification obligations. We will notify you of any Personal Data breach without undue delay and no later than 72 hours after becoming aware of it.
- At the end of the service agreement, make Personal Data available for export and delete it as described in section 6, unless retention is required by applicable law.
- Make available all information necessary to demonstrate compliance and allow for audits and inspections.
4. Sub-processors
You provide general authorisation for us to engage sub-processors. We will inform you of any intended addition or replacement of a sub-processor at least 30 days in advance, giving you the opportunity to object. Our current sub-processors are listed below. This is the same register our Privacy Policy uses:
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage and edge functions | Account data, consent records (pseudonymised session ID, keyed HMAC of the IP address, country, user agent, page URL, decisions), data subject requests | EU (Ireland, eu-west-1); provider headquartered in the USA | EU Standard Contractual Clauses |
| Vercel Inc. | Hosting of the Beacon website, dashboard and API routes | Account data and request metadata (IP address, user agent) of dashboard users and website visitors | USA, with a global edge network | EU Standard Contractual Clauses |
| Fly.io, Inc. | Cookie scanner: loads the customer's website in a headless browser | URLs of the customer's pages and the cookies, storage and scripts observed on them. No visitor data | Germany (Frankfurt, EU) | EU Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring for the Beacon website and dashboard | Error reports with browser, page URL and request metadata of dashboard users | USA | EU Standard Contractual Clauses |
| Kloudend, Inc. (ipapi.co) | Country lookup for jurisdiction detection, used only when the CDN supplies no country header | The visitor's IP address, for that single request. Nothing is stored | USA | Under review; not yet covered by a signed agreement |
| Mistral AI SAS | AI classification of detected cookies and trackers, and remediation guidance | Cookie, script and tracker names and domains found by scans, and the scanned domain name. No visitor data | France (EU) | Not applicable (EEA) |
| Stripe, Inc. | Payment processing and invoicing | Billing contact and payment details of customers. No consent data | USA | EU Standard Contractual Clauses |
| Resend, Inc. | Transactional email delivery | Email addresses and message content of dashboard users and of people who submit a data subject request | USA | EU Standard Contractual Clauses |
5. International Data Transfers
Where Personal Data is transferred outside the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place, including:
- EU Standard Contractual Clauses (Module 3: Processor to Processor) as approved by Commission Implementing Decision (EU) 2021/914, entered into with each sub-processor that processes Personal Data outside the EEA.
- UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as applicable.
- Swiss Federal Data Protection Act (nFADPA) compliant transfer mechanisms.
The transfer mechanism that applies to each sub-processor is stated in the register in section 4.
6. Data Retention
Consent records are retained for 5 years from the date of collection so that you can demonstrate that consent was given (Article 7(1) GDPR) for as long as it may be questioned by a supervisory authority or the Data Subject, and are then deleted automatically by a daily job. Each deletion run is logged. Before that point, you can erase the consent records of an individual Data Subject through a verified erasure request in the data subject request workflow (section 8). Scan results and cookie declarations are retained for the duration of the service agreement.
Upon termination, you have 30 days to export your consent records and other data. After that period we delete the remaining Customer Data and Consent Records of the terminated account on your written instruction to privacy@pritect.ai. Consent records that are not deleted earlier are in any event deleted when they reach the end of the 5-year retention period.
7. Security Measures
We implement the following technical and organisational measures:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- IP address pseudonymisation with a keyed HMAC (HMAC-SHA256 under a server-side secret) before storage; the IP address itself is never stored
- Consent record integrity verification via keyed HMAC-SHA256 integrity values
- Row-Level Security (RLS) ensuring strict tenant data isolation
- Role-based access control (owner, admin, member, viewer)
- Monthly partitioned consent tables for data lifecycle management
- Rate limiting on public API endpoints
- Regular access reviews and principle of least privilege
8. Data Subject Rights
We provide tools to assist you in responding to Data Subject requests, including:
- Right of access: Consent records can be exported via the Reports section.
- Right to erasure: for a verified erasure request that carries the visitor's consent ID, an owner or admin can erase that visitor's consent records from the request. The erasure is recorded in the request's audit log.
- Right to data portability: CSV export of all consent records.
- Right to withdraw consent: End users can withdraw consent via the preference center at any time.
9. Breach Notification
In the event of a Personal Data breach, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include the nature of the breach, categories and approximate number of affected data subjects, likely consequences, and measures taken or proposed to address the breach.
10. Audit Rights
You may audit our compliance with this DPA by: (a) requesting our most recent security certifications or audit reports; (b) conducting a remote audit with reasonable advance notice (at least 30 days); or (c) engaging a qualified third-party auditor bound by confidentiality obligations.
11. Governing Law
This DPA shall be governed by the laws of Norway. Any disputes arising from this DPA shall be submitted to the exclusive jurisdiction of the courts of Oslo, Norway.
12. Contact
For questions about this DPA or to exercise your rights, contact us at: privacy@pritect.ai