Data Processing Addendum (DPA)

WHEREAS:

(A) Customer acts as a Controller (or as a Processor acting on behalf of a third-party Controller) of Company Personal Data.

(B) Customer wishes to subcontract certain Services—including autonomous website optimization, neural machine translation, copy and split-URL A/B testing, bot detection and ad click fraud recovery, server-side Conversion API (CAPI) governance, and conversational AI features—to Processor, which imply the Processing of Company Personal Data.

(C) The Parties seek to implement a data processing agreement that complies with applicable Data Protection Laws (including the GDPR, UK GDPR, Swiss FADP, CCPA/CPRA, and US state privacy regulations).

(D) The Parties wish to lay down their respective rights and obligations regarding the protection, confidentiality, security, and international transfer of Company Personal Data.

1. Definitions and Interpretation

Unless otherwise defined herein, capitalized terms used in this DPA shall have the meanings set forth below:

• “AI Features” means the artificial intelligence, neural machine translation, natural language processing, semantic rewriting, customer support chat, real-time voice streaming, and automated CRO capabilities provided by Processor pursuant to the Principal Agreement.
• “Applicable Data Protection Laws” means all worldwide laws, directives, regulations, and binding regulatory guidance relating to privacy, data security, cybersecurity, and the Processing of Personal Data, including: (a) European Data Protection Laws; (b) UK Data Protection Laws; (c) Swiss Data Protection Laws; and (d) US Data Protection Laws, each as amended, superseded, or replaced from time to time.
• “Company Personal Data” (or “Customer Personal Data”) means any Personal Data provided by or on behalf of Company to Processor, or collected and Processed by Processor on behalf of Company, via the Seatext snippet, client runtimes, CDN loaders, edge networks, APIs, webhooks, or customer dashboard in connection with the Principal Agreement.
• “Data Privacy Framework” (or “DPF”) means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework, as recognized by the European Commission, the UK Information Commissioner, and the Swiss Federal Administration.
• “European Data Protection Laws” means Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), Directive 2002/58/EC (“ePrivacy Directive”), and any national implementing or supplementary legislation across EU/EEA Member States.
• “FADP” means the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing ordinances.
• “Protected Area” means: (i) in the case of EU Personal Data, the member states of the European Economic Area (EEA) and any territory recognized as adequate by the European Commission under Article 45 GDPR; (ii) in the case of UK Personal Data, the United Kingdom and any territory recognized under UK adequacy regulations; or (iii) in the case of Swiss Personal Data, Switzerland and any country recognized as adequate by the Swiss Federal Council.
• “Services” means the autonomous conversion rate optimization (CRO), multi-language neural website translation (125+ languages), copy and split-URL A/B testing, ad click fraud detection & recovery (BotGuard and BotRefund), server-side Conversion API (CAPI) signal management and firewalling, web chat, and voice AI agent services provided by Processor pursuant to the Principal Agreement.
• “Standard Contractual Clauses” (or “EU SCCs”) means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, adopted under European Commission Implementing Decision (EU) 2021/914, specifically implementing Module Two (Controller to Processor).
• “Subprocessor” means any third party appointed by or on behalf of Processor to Process Company Personal Data on behalf of Company in connection with the Services.
• “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner's Office under Section 119A of the UK Data Protection Act 2018.
• “UK GDPR” means the GDPR as incorporated into United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018.
• “US Data Protection Laws” means all applicable United States federal and state privacy, data protection, and consumer privacy laws, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Texas Data Privacy and Security Act (“TDPSA”), and any binding regulations promulgated thereunder.

The terms “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, and “Supervisory Authority” shall have the meanings given in the GDPR and UK GDPR. Cognate terms under US Data Protection Laws (such as “Business”, “Service Provider”, “Consumer”, “Sell”, and “Share”) shall be construed accordingly.

2. Processing of Company Personal Data

2.1 Roles of the Parties. The Parties acknowledge and agree that with respect to Company Personal Data, Company is the Controller (or a Processor acting on behalf of a third-party Controller), and Processor is a Processor or Subprocessor acting strictly on behalf of and under the instructions of Company.

2.2 Customer Instructions. Processor shall Process Company Personal Data solely on Company’s documented instructions, including as set forth in the Principal Agreement, this DPA, Company’s configuration of settings in the customer portal (`login.seatext.com`), and any applicable Statement of Work, unless Processing is otherwise required by applicable mandatory laws to which Processor is subject. In such circumstances, Processor shall inform Company of that legal requirement prior to Processing, unless prohibited on important grounds of public interest.

2.3 Compliance with Laws & Notification. Processor shall comply with all Applicable Data Protection Laws in its Processing of Company Personal Data. Processor shall immediately notify Company in writing if, in Processor’s reasonable opinion, an instruction given by Company infringes Applicable Data Protection Laws.

2.5 Threat Intelligence & Fraud Prevention Carve-Out. Notwithstanding anything to the contrary in this Agreement, Processor may generate and use De-identified Data, aggregated security metrics, malicious IP/subnet reputation lists, and automated crawler signatures across customer sessions strictly to the extent necessary to detect security incidents, protect against fraudulent or illegal activity, and maintain system integrity, as permitted under Applicable Data Protection Laws (including CCPA regulation 11 CCR § 7050(a)(3) and GDPR Recital 49).

2.6 Customer Obligations. Company represents and warrants that: (a) it has obtained and will maintain all required legal bases, notices, authorizations, and consents (including complying with ePrivacy cookie consent standards for telemetry cookies, local storage tokens, and browser attribute checks) necessary under Applicable Data Protection Laws for Processor to lawfully Process Company Personal Data; and (b) Company’s instructions comply with Applicable Data Protection Laws.

2.7 US State Privacy Law Commitments (CCPA / CPRA). Processor acknowledges and agrees that it acts solely as a Service Provider under the CCPA/CPRA and analogous US Data Protection Laws. Processor certifies and covenants that:

• Processor shall not “sell” or “share” Company Personal Data;
• Processor shall not retain, use, or disclose Company Personal Data for any purpose other than the specific business purposes specified in the Principal Agreement and this DPA, or as otherwise permitted by the CCPA for security and fraud prevention;
• Processor shall not retain, use, or disclose Company Personal Data outside the direct business relationship between Company and Processor;
• Processor shall not combine Company Personal Data with personal information received from, or on behalf of, any other person or third party, except as permitted by the CCPA and implementing regulations for security, fraud defense, and system integrity; and
• Processor certifies that it understands the contractual restrictions in this Section 2.7 and will comply with them.

3. Processor Personnel & Confidentiality

Processor shall ensure that any employee, contractor, agent, or representative who has access to Company Personal Data is subject to strict, enforceable confidentiality obligations (whether by contract or professional statutory duties), has undergone appropriate background screening in accordance with industry standards, and has received comprehensive data protection, confidentiality, and security awareness training.

4. Technical and Organizational Security Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall implement and maintain appropriate technical and organizational measures (TOMs) designed to ensure a level of security appropriate to that risk, including the measures specified in Annex II (Technical and Organizational Measures) to this DPA.

5. Subprocessors

5.1 General Authorization. Company grants Processor general written authorization to engage the Subprocessors listed in Annex III (Authorized Subprocessors) to Process Company Personal Data in connection with the Services.

5.2 Subprocessor Agreements. Processor shall enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective of Company Personal Data than those imposed on Processor under this DPA. Where a Subprocessor fails to fulfill its data protection obligations, Processor shall remain fully liable to Company for the performance of that Subprocessor’s obligations.

5.3 Notification of Subprocessor Changes. Processor shall provide Company with at least thirty (30) days’ advance written notice of any intended appointment of a new Subprocessor or replacement of an existing Subprocessor (via email notification to Company’s administrative email or via an announcement in the customer dashboard). Processor maintains a current list of all active Subprocessors accessible to Company.

5.4 Objection Mechanism. Company may object to Processor’s appointment of a new Subprocessor on reasonable, documented data protection grounds by notifying Processor in writing within fourteen (14) days of receiving Processor’s notice. In such case, Processor shall use reasonable efforts to address Company’s objection by: (a) configuring the Services to avoid using that Subprocessor for Company Personal Data; or (b) taking corrective security steps requested by Company. If neither option is commercially or technically feasible within thirty (30) days of Processor’s receipt of the objection, Company may terminate the affected Services without penalty upon written notice, receiving a prorated refund of any prepaid, unearned fees.

6. Data Subject Rights and Regulatory Assistance

6.1 Assisting with Requests. Taking into account the nature of the Processing, Processor shall assist Company by implementing appropriate technical and organizational measures, insofar as feasible, for the fulfillment of Company’s obligations to respond to Data Subject requests under Applicable Data Protection Laws (including requests for access, rectification, erasure, portability, restriction of processing, and objection).

6.2 Direct Inquiries. If Processor receives a request directly from a Data Subject concerning Company Personal Data, Processor shall promptly notify Company in writing (within three (3) business days) and shall instruct the Data Subject to submit their request directly to Company. Processor shall not respond directly to the Data Subject without Company’s documented authorization, except to acknowledge receipt or as required by law.

6.3 Regulatory Consultations & DPIAs. Processor shall provide reasonable assistance and information to Company (taking into account the nature of Processing and information available to Processor) in connection with Company’s performance of Data Protection Impact Assessments (DPIAs), Transfer Impact Assessments (TIAs), and prior consultations with Supervisory Authorities pursuant to Articles 35 and 36 of the GDPR/UK GDPR.

7. Personal Data Breach Notification & Incident Management

7.1 Notification SLA. Processor shall notify Company in writing without undue delay and in any event within forty-eight (48) hours after confirming a Personal Data Breach affecting Company Personal Data.

7.2 Information Provided. The notification shall provide Company with information available to Processor to assist Company in meeting its statutory reporting duties under Applicable Data Protection Laws, including:

• A description of the nature of the incident, including the categories and approximate number of Data Subjects and records affected;
• The contact details of Processor’s data protection or security contact;
• The likely consequences of the incident; and
• A description of the containment, mitigation, and remediation measures taken or planned by Processor.

7.3 No Admission of Fault. Notification of a Personal Data Breach under this Section 7 shall not be construed as an admission of fault, liability, or negligence by Processor.

7.4 Remediation. Processor shall take commercially reasonable steps to contain and remediate the Personal Data Breach, and shall reasonably cooperate with Company in communicating with regulatory authorities and affected Data Subjects.

8. Audits and Compliance Verification

8.1 Compliance Demonstrations. Processor shall make available to Company information reasonably necessary to demonstrate compliance with this DPA, including completing standard industry security questionnaires (e.g., CAIQ or SIG Lite format) and providing executive summaries of independent security assessments where available.

8.2 Audits & Inspections. If the documentation provided under Section 8.1 is insufficient to confirm compliance, Processor shall allow for and contribute to reasonable audits, including inspections of Processor’s operating procedures, conducted by Company or an independent, certified third-party auditor designated by Company (and reasonably acceptable to Processor). Such audits shall occur: (a) no more than once in any twelve (12) month period, unless required by a competent Supervisory Authority or following a confirmed Personal Data Breach caused by Processor; (b) upon at least thirty (30) days’ prior written notice; (c) during normal business hours without disrupting Processor’s business operations; (d) subject to customary confidentiality obligations; (e) the auditor must not be a direct or indirect competitor of Processor; and (f) Company shall bear all costs of the audit unless the audit reveals a material, uncured breach of this DPA by Processor.

9. Deletion or Return of Company Personal Data

9.1 Return or Deletion upon Termination. Within thirty (30) days following the termination or expiration of the Principal Agreement, Processor shall, at Company’s written election, delete or securely return all active Company Personal Data in its production systems and databases, subject to Sections 9.2 and 9.3.

9.2 Operational Retention Windows. Standard operational session and click telemetry logs are retained for ninety (90) days on a rolling basis. Ad fraud and invalid traffic dispute records are retained for up to one hundred eighty (180) days to support Ad Platform audit filing cycles, after which they are purged or converted into De-identified Data.

9.3 Statutory Retention & Backup Archives. Processor may retain Company Personal Data solely to the extent and for the duration required by applicable statutory law, or within cyclical, encrypted system backup archives. Such backup archives shall remain protected under Annex II and will be automatically overwritten and purged in accordance with Processor’s routine backup rotation schedule (not to exceed ninety (90) days).

9.4 Written Certification. Upon Company’s written request, an authorized officer of Processor shall confirm in writing that active Company Personal Data has been deleted in accordance with this Section 9.

10. Data Locations & International Cross-Border Transfers

10.1 Processing Locations. Company acknowledges and agrees that Company Personal Data may be Processed and stored in the United States and globally across edge points of presence operated by Processor’s authorized Subprocessors (including Oracle Cloud Infrastructure, MongoDB Atlas, Cloudflare, and Fastly) as specified in Annex III.

10.2 Data Privacy Framework. To the extent Processor or its US-based Subprocessors participate in the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. DPF, transfers of Company Personal Data from the Protected Area to the United States shall be safeguarded under the DPF.

10.3 Standard Contractual Clauses (EU SCCs). For transfers of Company Personal Data subject to European Data Protection Laws from the Protected Area to countries outside the Protected Area that do not benefit from an adequacy decision, the Parties hereby incorporate by reference the EU Standard Contractual Clauses (Module Two: Controller-to-Processor, and Module Three: Processor-to-Processor), as if set forth in full:

• Module Two applies where Company is a Controller of Company Personal Data.
• Module Three applies where Company is a Processor acting on behalf of a third-party Controller.
• Clause 7 (Docking clause): The optional docking clause shall apply;
• Clause 9(a) (Subprocessors): Option 2 (General written authorization) shall apply, with a notice period of thirty (30) days as set forth in Section 5.3;
• Clause 11 (Redress): The optional redress language is not selected;
• Clause 13 (Supervisory Authority): Where Company is established in an EU Member State, the competent supervisory authority shall be the supervisory authority of that Member State. Where Company is not established in an EU Member State, the competent authority shall be the Data Protection Commission of Ireland (DPC);
• Clause 17 (Governing Law): The clauses shall be governed by the laws of Ireland;
• Clause 18 (Choice of forum and jurisdiction): The courts of Ireland shall have exclusive jurisdiction; and
• Annexes: Annexes I, II, and III of this DPA shall serve as Annexes I, II, and III to the EU Standard Contractual Clauses.

10.4 UK International Data Transfer Addendum. For transfers of Company Personal Data subject to UK Data Protection Laws, the UK Addendum is incorporated by reference: (a) Table 1 details are set out in Annex I; (b) Table 2 references the EU SCCs as completed in Section 10.3; (c) Table 3 appendix information is set out in Annexes I, II, and III; and (d) Table 4 provides that either party may end the Addendum as set out in Section 19 of the UK Addendum.

10.5 Swiss Data Transfers. For transfers subject to the Swiss FADP, the EU SCCs apply with the following amendments: (a) references to the GDPR are construed as references to the FADP; (b) references to the EU or Member States are construed as Switzerland; (c) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC); and (d) Data Subjects in Switzerland may bring actions before the competent courts in Switzerland.

10.6 Precedence. In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

11. Limitation of Liability

Each Party’s entire liability arising out of or related to this DPA (including the Standard Contractual Clauses) shall be subject to the limitations, exclusions, and caps on liability set forth in the Principal Agreement. Nothing in this DPA shall be construed as creating an uncapped liability or waiving any limitation of liability in the Principal Agreement, except to the extent strictly prohibited by Applicable Data Protection Laws or Clause 12 of the Standard Contractual Clauses.

12. General Provisions

12.1 Term and Survival. This DPA shall enter into effect on the Effective Date and remain in effect until the termination or expiration of the Principal Agreement and the completion of all deletion obligations under Section 9. Sections 1, 2.5, 9, 11, and 12 shall survive termination.

12.2 Amendments for Changes in Law. If any variation is needed to maintain compliance with Applicable Data Protection Laws, the Parties agree to cooperate in good faith to amend this DPA.

12.3 Severability. If any provision of this DPA is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of the remaining provisions shall not in any way be affected or impaired.

12.4 Counterparts. This DPA may be executed in counterparts, including electronically, each of which shall be deemed an original and all of which together shall constitute one agreement.

Execution & Countersignature

IN WITNESS WHEREOF, the Parties have caused this Data Processing Addendum to be executed by their duly authorized representatives with effect from the Effective Date.

ANNEX I — Details of Processing & Transfer

This Annex I forms part of the DPA and represents the description of Processing and transfer operations required under GDPR Article 28(3) and the Standard Contractual Clauses.

A. LIST OF PARTIES

B. DESCRIPTION OF PROCESSING AND TRANSFER

• Categories of Data Subjects: Customer’s website and digital application visitors, end consumers, prospective leads, customer personnel and administrative users of the dashboard, and end users submitting inquiries via customer chat or web forms.
• Categories of Personal Data:
  • Network & Device Identifiers: IP addresses (pseudonymized at edge), HTTP request headers, browser type and version, operating system, device screen resolution, language preferences, approximate geographic location (country, region, city derived from IP), and timestamp.
  • Session Telemetry & Interaction Signals: Pseudonymous cookie IDs, local session storage tokens (`visitorId`, `aggregationVisitorId`), click coordinates, scroll velocity, hover activity, reading depth, page URLs, referring domain, UTM campaign parameters, and ad click identifiers (`gclid`, `fbclid`, `wbraid`, `gbraid`, `msclkid`, `rdt_cid`).
  • Ad Fraud & Bot Inspection Signals: Hardware entropy attributes (Canvas fingerprint hash, WebGL render profile, AudioContext oscillation, font availability enumeration, TouchEvent vs MouseEvent mechanics) collected solely to distinguish automated bots from genuine human visitors.
  • Customer Inquiries & Submitted Text: Customer website DOM content for neural translation and rewriting; text messages submitted by end users in website sales chat; voice audio data (where Gemini Live voice agent is explicitly enabled); lead contact details (email, phone, company name) voluntarily submitted by visitors.
  • Attribution & Conversion Values: Transaction timestamps, order ID, gross merchandise value, currency, and conversion event names sent via client snippet or server-side Conversion API (CAPI).
• Special Categories of Data (Sensitive Personal Data): STRICTLY NONE. Customer shall not transmit or configure the Services to collect special categories of personal data (as defined in GDPR Article 9), including health information, racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data for identification, sexual orientation, or payment card account data.
• Frequency of Transfer: Continuous, real-time basis as end users navigate and interact with Customer’s digital properties.
• Nature and Purpose of Processing: Processor Processes Company Personal Data strictly to provide, maintain, optimize, and support the Services pursuant to the Principal Agreement, including:
  1. Real-time neural machine translation across 125+ languages with zero layout shift;
  2. Autonomous copy variant A/B testing and 0ms split-URL experimentation;
  3. Visitor source intent matching and dynamic landing page copy personalization;
  4. Multi-layer ad click fraud detection, bot filtering, and generation of invalid click refund claim packets for Google, Meta, and Reddit ads;
  5. Server-side Conversion API (CAPI) signal governance, POAS margin routing, and bot quarantine buffering; and
  6. Conversational AI sales chat and real-time voice streaming assistants.
• Retention Period: Company Personal Data is retained for the duration of the Principal Agreement, subject to Section 9 (Deletion). Rolling interaction logs and bot forensic packets are retained for ninety (90) to one hundred eighty (180) days to support ad network audit filing windows, after which telemetry is aggregated or purged.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority for the purposes of Clause 13 of the EU SCCs shall be the Data Protection Commission of Ireland (DPC), or where Customer is established in another EU Member State, the supervisory authority of that Member State.

ANNEX II — Technical and Organizational Measures (TOMs)

Processor implements and maintains the administrative, physical, technical, and operational security safeguards described below to protect Company Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

ANNEX III — Authorized Subprocessors

Customer provides general written authorization for the engagement of the following Subprocessors pursuant to Section 5 of this DPA:

For customer-specific questions regarding this DPA, Subprocessor updates, or data subject requests, please contact Seatext’s privacy and security office at [email protected].