Draft: this document has not yet been reviewed by a lawyer. Do not rely on it until it has.

Data processing agreement

Last updated: 25 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and Hitechies Enterprise Solutions BV ("Processor") and applies whenever the Processor processes personal data on the Controller's behalf through Optwise. It is intended to meet the requirements of Article 28 of the GDPR.

1. Subject matter and duration

The Processor stores and makes available records of website visitors' consent choices for the Controller's websites, for as long as the Controller has an account, and then deletes them as set out in section 9.

2. Nature and purpose

Receiving, storing, protecting, displaying and exporting consent records, so the Controller can demonstrate consent (GDPR Art. 7(1)) and manage visitors' preferences.

3. Data and data subjects

Data subjects: visitors to the Controller's websites.
Personal data: random consent ID, consent choices and categories, timestamp, policy version, language, page URL, browser user-agent, country, IP address truncated to /24 (IPv4) or /48 (IPv6).
Special categories: none intended. The Controller must not configure the Service to collect them.

4. Processor's obligations

Process personal data only on the Controller's documented instructions, which are these terms and the Controller's settings in the dashboard, unless EU or Member State law requires otherwise, in which case the Processor informs the Controller first unless the law prohibits it.
Ensure that people authorised to process the data are bound by confidentiality.
Implement the technical and organisational measures in Annex 1.
Assist the Controller, as far as possible, in responding to data subjects' requests, notably by providing lookup by consent ID and export of records.
Assist the Controller with security, breach notification, impact assessments and prior consultation, taking into account the nature of processing and the information available.
Notify the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller's data.
Make available the information needed to demonstrate compliance with this DPA and allow for audits, including inspections, by the Controller or an auditor it mandates, on reasonable notice, no more than once a year unless a breach or authority requires otherwise.

5. Sub-processors

The Controller gives general authorisation for the sub-processors listed on the sub-processors page. The Processor will give at least 30 days' notice of any new sub-processor by email; the Controller may object on reasonable data protection grounds and, if no solution is found, terminate the affected service. The Processor imposes data protection obligations on each sub-processor equivalent to this DPA and remains liable for them.

6. International transfers

Personal data is stored in the EU. Any transfer outside the EEA takes place only under an adequacy decision or the EU Standard Contractual Clauses (Commission Decision 2021/914).

7. Controller's obligations

The Controller is responsible for the lawfulness of processing, for its privacy and cookie notices, for the configuration of the Service on its websites, and for the retention period it chooses.

8. Liability

Liability is governed by the Terms of Service, subject to Article 82 GDPR.

9. Deletion and return

The Controller can export consent records at any time. When the Controller deletes a website or its account, the related records are deleted from the live database at once and from backups within 35 days, unless EU or Member State law requires storage.

Annex 1 — Technical and organisational measures

Encryption in transit (TLS 1.2 or higher) for all connections.
Database stored in the EU (Cloudflare EU jurisdiction), in data centres with physical access control.
Data minimisation: IP addresses are truncated before storage; no full IP is kept with consent records.
Integrity: consent records are hash-chained per website so any later change or deletion can be detected.
Access control: customer data is separated by account; administrative access is limited to named staff using strong authentication.
Passwords stored with scrypt; sessions expire after 30 days; login attempts are rate-limited.
Encrypted point-in-time backups of the database for 30 days, with periodic restore tests.
Security updates applied promptly; dependencies kept to a minimum.