Hopwall: Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Trendiing Ltd (company 14895321), a company registered in England and Wales, trading as Hopwall (the "Processor"), and the agency that uses the Service (the "Controller").
1. Scope and roles
1.1 This DPA covers the personal data in link-visitor analytics: data recorded when people visit link pages served on the Controller's domains.
1.2 For that data the Controller is the controller and the Processor is its processor under UK GDPR and the Data Protection Act 2018. For agency account data (sign-in, billing, audit log) the Processor is an independent controller; that data is covered by the Privacy Notice, not this DPA.
2. Details of processing
- Subject matter and purpose: serving the Controller's link pages and showing the Controller click analytics for its creators and domains.
- Duration: the term of the Service, plus the return and deletion period in clause 7.
- Data subjects: people who visit the Controller's link pages.
- Personal data: page step and time; platform or app; device type; country; network number (ASN) and operator name; the first 80 characters of the referring address; Instagram app version. No IP addresses, cookies or visitor identifiers are stored.
- Special category data: none is intended. [Solicitor to consider: whether visiting a link to an adult-content creator's page could reveal information about a person's sex life, and what follows if so.]
3. Processor obligations
3.1 The Processor will process the data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's use of the portal settings.
3.2 The Processor will ensure that anyone authorised to process the data is bound by confidentiality.
3.3 The Processor will implement appropriate technical and organisational measures, including: encryption in transit (TLS 1.2 or higher, HSTS); per-agency separation of analytics, enforced in every query and re-checked on every result row; hashed storage of sign-in links, sessions and recovery codes; optional two-step sign-in; rate limiting and bot checks on sign-in; CSRF protection and a strict content security policy on the portal; and an agency-visible audit log.
3.4 The Processor will assist the Controller, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations on security, breach notification and impact assessments.
3.5 The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the data.
4. Sub-processors
4.1 The Controller authorises these sub-processors: Cloudflare, Inc. (hosting, edge delivery, analytics storage). [Solicitor to confirm the list and each provider's transfer terms.]
4.2 The Processor will give the Controller at least 30 days' notice of a new sub-processor by email, during which the Controller may object and, if the objection cannot be resolved, terminate the Service.
4.3 The Processor will impose data protection terms on each sub-processor that are no less protective than this DPA, and remains liable for its sub-processors.
5. International transfers
Where data is transferred outside the UK, the Processor will ensure an appropriate safeguard is in place, such as the UK International Data Transfer Addendum or an adequacy regulation. [Solicitor to confirm.]
6. Audits
The Processor will make available the information reasonably necessary to demonstrate compliance with this DPA and will allow for audits by the Controller or its auditor, on reasonable notice, no more than once a year unless required by a regulator or after a breach.
7. Return and deletion
At the end of the Service, or when the Controller deletes its account in the portal, the Processor will delete the Controller's link configuration at once and will delete or anonymise its analytics data within [solicitor/commercial to confirm: period], unless law requires retention. Before deletion the Controller can export its analytics from the portal.
8. General
This DPA is governed by the law of England and Wales. If it conflicts with the Terms, this DPA prevails for the processing of personal data.
Trendiing Ltd (company 14895321), trading as Hopwall.