When you install Cookiesh on your website, your visitors’ consent choices are personal data. You decide why that data is collected, so you are the controller. Cookiesh processes it on your behalf, so we are your processor. Article 28 of the GDPR requires a contract between the two of us, and our Data Processing Agreement (DPA) is that contract.
This page summarizes the DPA in plain language. The full agreement prevails if the two ever differ.
How the DPA applies
The DPA is part of our Terms of Service and applies automatically to every Cookiesh account, including the free plan. You do not need to sign anything for it to be in force.
If your procurement process needs a countersigned copy, email privacy@cookiesh.eu with your company’s legal name and address, and we will send one for e-signature. On Enterprise plans we can also negotiate a custom DPA or work from your own template.
What we process
| Details | |
|---|---|
| Subject matter | Providing the Cookiesh consent management service |
| Data subjects | Visitors to your websites and apps; your users who sign in to the dashboard |
| Personal data | Pseudonymous consent ID, timestamp, consent choices per category, banner and policy version, approximate region (country or state), truncated user agent and, if you use identify(), a salted hash of your user ID |
| Not processed | Raw IP addresses are not stored. We do not process special categories of personal data. |
| Purpose | Recording, storing and proving consent, and making consent available to your website |
| Duration | For as long as you use Cookiesh, plus the retention period you configure for consent records |
Our obligations as processor
Under the DPA, Cookiesh:
- processes personal data only on your documented instructions, which are given by the Terms, the DPA and your configuration of the service;
- makes sure everyone with access to the data is bound by confidentiality;
- applies the technical and organizational security measures described on our security page;
- helps you respond to requests from data subjects, for example by exporting or deleting the consent records linked to a consent ID or user ID;
- helps you with data protection impact assessments and consultations with supervisory authorities, where they relate to our service;
- notifies you of a personal data breach affecting your data without undue delay, and no later than 48 hours after becoming aware of it;
- deletes or returns your data when the agreement ends, at your choice, unless the law requires us to keep it;
- makes available the information you need to demonstrate compliance, and allows audits as described below.
Sub-processors
You give us general authorization to use the sub-processors listed on our sub-processors page. We bind each one to data protection terms at least as protective as the DPA, and we remain responsible for their work.
We notify customers at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will work with you to find a solution. If we cannot find one, you may terminate the affected service and receive a refund of any prepaid fees for it.
International transfers
Consent records are stored in the European Union. When a sub-processor accesses personal data from outside the European Economic Area, the transfer is covered by an adequacy decision, such as the EU-US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses (Modules 2 and 3). For transfers from the United Kingdom and Switzerland, the DPA includes the UK International Data Transfer Addendum and the Swiss amendments to the clauses.
Audits
We answer reasonable security questionnaires and provide summaries of our security policies and third-party test results on request. If that information is not enough to show compliance, or a supervisory authority requires it, you may conduct an audit once a year, with 30 days’ notice and under confidentiality. On-site audits are available on Enterprise plans.
US privacy laws
For customers subject to the CCPA/CPRA and similar US state laws, the DPA includes service provider terms. Cookiesh will not sell or share personal information, will not use it for any purpose other than providing the service, and will not combine it with personal information from other sources, except as those laws permit.
Contact
For a signed DPA or any question about it, email privacy@cookiesh.eu.