Privacy notice · Terms of service · Data processing agreement · Sub-processors · Cookies · Acceptable use policy
Data processing agreement
Draft
This data processing agreement ("DPA") forms part of the terms of service between Wiztastic ("Processor", "we") and the customer ("Controller", "you"). It applies whenever we process personal data on your behalf through Wiztastic, and meets Article 28 of the UK GDPR. It takes effect when you accept the terms and lasts as long as we process personal data for you.
1. Definitions
Words such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where it applies to you, the EU GDPR.
2. Roles and instructions
- You are the controller and we are the processor of the personal data described in Annex 1.
- We process it only on your documented instructions. These terms, your settings in Wiztastic and your use of its features are your instructions. We'll tell you if we think an instruction breaks data protection law.
- You are responsible for the lawfulness of the processing, including having a lawful basis, giving visitors the information they're entitled to, and obtaining any consent needed for cookies or device storage.
3. Our obligations
- Confidentiality. Everyone we authorise to process the data is bound by confidentiality.
- Security. We take the technical and organisational measures in Annex 2.
- Sub-processors. You give general authorisation for us to use the sub-processors on our sub-processors page. We'll give at least 30 days' notice of a new one by updating that page and emailing account owners. If you object on reasonable data-protection grounds and we can't resolve it, you may end the affected service and we'll refund any prepaid fees for the remainder. We impose the same data-protection obligations on each sub-processor and remain responsible for them.
- Data subjects' rights. The dashboard lets you find, export and delete data, including all the data from an IP address and individual recordings. Where you need more, we'll help with reasonable requests. If a data subject contacts us directly, we'll pass the request to you.
- Assistance. We'll give reasonable help with your security obligations, breach notifications, data protection impact assessments and consultations with the ICO, taking into account the information available to us.
- Breaches. We'll tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations, and keep you updated.
- Deletion. When the service ends we'll delete your personal data within 90 days, after giving you 30 days to export it, unless the law requires us to keep it. Backups are overwritten within three months.
- Audits. We'll make available the information reasonably needed to show we meet this DPA, and allow audits by you or an auditor you appoint, on 30 days' notice, during business hours, at your cost, no more than once a year unless there has been a breach or a regulator requires it.
4. International transfers
Data is stored in the United Kingdom. Where a sub-processor processes it outside the UK, we make sure the transfer is covered by UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
5. Liability and order of precedence
Liability under this DPA is subject to the limits in the terms, except where data protection law doesn't allow it. If this DPA and the terms conflict about personal data, this DPA wins.
Annex 1: Details of processing
| Subject matter and duration | Providing Wiztastic to you, for as long as you use it, plus the deletion period in section 3.7 |
|---|
| Nature and purpose | Collecting, storing, analysing and displaying how visitors use your websites; replaying recordings; live chat; alerts and reports; support |
| Data subjects | Visitors to your websites; people who chat with you; your users you identify to us; your team members |
| Personal data | Online identifiers (a daily one-way visitor code, or a first-party ID if you turn it on); IP address (only if you turn on storage) and approximate location; device and browser details; pages viewed, referrers and campaign tags; clicks, scrolling, form-field timings (never typed values) and site searches; session recordings with form inputs masked; chat messages and any details visitors give in chat; user IDs and traits you send |
| Special category data | None. You must not send any |
| Retention | As set by your plan and settings, after which data is deleted automatically, or sooner if you delete it |
Annex 2: Security measures
- Encryption in transit (TLS) for the tracking script, data collection and dashboard.
- Servers in the UK, with access limited to named staff who use two-step sign-in; operator access to a customer account is logged and visible to that customer.
- The app runs with a database login that can read and write data but cannot change the database's structure; administrative logins are kept separately.
- Passwords hashed with Argon2; optional two-step sign-in for all users; automatic blocking of repeated failed sign-ins; rate limiting.
- Recordings mask form input in the visitor's browser; password and card fields are never captured.
- Role-based team access, which can be limited to particular sites, with an activity log for account admins.
- Nightly backups, checked when made and kept on the server for up to three months.
- Monitoring and alerting for errors, unusual sign-in activity and storage limits.