Free whiteglove setup from a ConsentStack Concierge

Data Processing Agreement

Last updated:

In Plain Language

Before the legal text, here's what this agreement means:

  • We process consent data on your behalf. When visitors interact with your consent banner, we record their choices for you. You decide what to collect and how to use it, and we follow your instructions.
  • We don't store IP addresses or directly identifiable information about your visitors. Consent records are pseudonymous. Visitor identifiers are hashed before they are stored, page addresses are stored without their query strings, and location is stored only as a country and a state or region.
  • Some processing happens before a visitor makes a choice. To run the banner we count visitors with a hashed identifier for each billing period, and we detect the trackers on your pages so they can be blocked. Section 6 and Annex 3 list exactly what this involves.
  • We can't track visitors across your site and other customers' sites. Each visitor identifier is created on your site and means nothing outside it.
  • Your data is yours. You can export your consent logs, delete a single visitor's records, and delete a site, workspace or account, which deletes its data straight away. If a plan change would shorten how long your logs are kept, your old retention period stays in place for 30 more days so you can export first.
  • We use a small number of sub-processors to provide the service. They're listed on our Sub-processor List page. We'll notify you 30 days before adding a new one.
  • If something goes wrong, we'll tell you fast. We commit to notifying you of any data breach within 72 hours.
  • Your consent data is stored in the United States. Cloudflare's network handles your visitors' requests close to where they are and briefly holds consent records before they reach our US database. If your visitors are in the European Economic Area, the United Kingdom, or Switzerland, the transfer is covered by the Standard Contractual Clauses in Section 13.
  • We only learn from your data in aggregated, de-identified form. We may use statistics that identify no visitor and no customer to improve ConsentStack, including to train models. We never train on identifiable visitor data.
  • We'll give you notice before material changes. At least 30 days, by email and in your dashboard.

1. Definitions

In this Data Processing Agreement ("DPA"), the following terms have the meanings set out below. Capitalized terms not defined here have the meanings given in the Terms of Service ("Agreement").

"Controller" means the entity that determines the purposes and means of the processing of Personal Data. In this DPA, that is the Customer.

"Processor" means the entity that processes Personal Data on behalf of the Controller. In this DPA, that is ConsentStack LLC ("ConsentStack").

"Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"), as defined in applicable Data Protection Laws.

"Consent Data" means Personal Data processed by ConsentStack in the course of providing the Service, including: hashed visitor identifiers; consent choices and the events that record them; timestamps; page URLs, stored without their query strings or fragments; browser, operating system and device type, derived from the user agent; country and region (for example, a US state); banner, configuration and Global Privacy Control details; for consent imported from a previous consent platform, that platform's consent identifier and record; tracker detection data; and the hashed visitor identifiers used to count visitors. Annex 3 lists every category.

"Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including: (a) the EU General Data Protection Regulation 2016/679 ("GDPR"); (b) the UK General Data Protection Regulation and UK Data Protection Act 2018 ("UK GDPR"); (c) the Swiss Federal Act on Data Protection ("FADP"); (d) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"); and (e) any other applicable US state privacy laws, in each case as amended, superseded, or replaced from time to time.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates. In the context of this DPA, that means mainly the End Users who visit the Customer's websites, and also the people named in content the Customer provides (Annex 3).

"End User" means a visitor to a website on which the Customer has installed the Service, whether or not the visitor interacts with the consent banner.

"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure by transmission, erasure, or destruction.

"Retention Hold" has the meaning given in Section 11.2.

"Sub-processor" means any third party engaged by ConsentStack to process Personal Data on behalf of the Customer.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, as may be amended or replaced.

"Service" means the ConsentStack consent management platform as described in the Agreement.

"Technical and Organizational Measures" or "TOMs" means the security measures described in Annex 1 to this DPA.

2. Scope and Duration

2.1 This DPA applies to all Processing of Personal Data by ConsentStack on behalf of the Customer in connection with the provision of the Service.

2.2 The subject matter, nature, purpose, and duration of Processing, the categories of Personal Data, and the categories of Data Subjects are described in Annex 3 (Processing Description).

2.3 This DPA is effective for the duration of the Agreement. Upon termination of the Agreement, Section 11 (Data Deletion and Return) applies.

2.4 This DPA is incorporated into and forms part of the Agreement. In the event of any conflict between this DPA and the Agreement with respect to the Processing of Personal Data, this DPA will prevail. Where a HIPAA Business Associate Agreement is in effect for a site, it governs protected health information for that site.

3. Roles and Responsibilities

3.1 The Customer is the Controller of End User Personal Data. ConsentStack is the Processor.

3.2 The Customer is responsible for ensuring that it has a lawful basis for the collection of Personal Data from End Users, including the Processing described in Section 6.4 that takes place before an End User makes a consent choice, and that the processing instructions given to ConsentStack comply with applicable Data Protection Laws.

3.3 ConsentStack is responsible for processing Personal Data only in accordance with the Customer's documented instructions and applicable Data Protection Laws.

3.4 ConsentStack processes account, billing, usage, support and marketing information about the Customer and its Authorized Users as a controller, under its Privacy Policy. That processing is outside this DPA.

4. Processing Instructions

4.1 ConsentStack will process Personal Data only on the documented instructions of the Customer, unless required to do so by applicable law to which ConsentStack is subject. In such a case, ConsentStack will inform the Customer of that legal requirement before Processing, unless prohibited by law from doing so.

4.2 The Customer's instructions for Processing are determined by:

  • (a) This DPA and its Annexes;
  • (b) The Agreement;
  • (c) The Customer's configuration of the Service through the ConsentStack dashboard (including consent categories, regions, banner settings, domain configuration, and consent import from a previous consent platform); and
  • (d) Any additional written instructions agreed upon by the parties.

4.3 If ConsentStack believes that an instruction from the Customer infringes Data Protection Laws, ConsentStack will promptly inform the Customer and may suspend execution of the instruction until the Customer confirms, amends, or withdraws it.

4.4 Aggregated and de-identified data. The Customer instructs ConsentStack to aggregate and de-identify Consent Data so that it no longer identifies, and cannot reasonably be linked to, any End User or the Customer. ConsentStack may use the resulting data to operate, secure, improve and develop its services, including to train machine learning models, and for research and industry benchmarking that does not identify the Customer. ConsentStack will (a) take reasonable measures to ensure the data cannot be associated with an End User or household; (b) publicly commit to keep and use the data only in de-identified form and not attempt to re-identify it; and (c) contractually require anyone who receives the data to meet the same commitments. ConsentStack will not use Consent Data that identifies or could reasonably be linked to an End User to train any model.

5. Confidentiality

5.1 ConsentStack will ensure that all persons authorized to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2 ConsentStack will ensure that access to Personal Data is limited to those personnel who require access to perform the obligations under this DPA.

5.3 The confidentiality obligations in this Section survive the termination of this DPA.

6. Security Measures

6.1 ConsentStack will implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage. These measures are described in Annex 1 (Technical and Organizational Measures).

6.2 ConsentStack will regularly test, assess, and evaluate the effectiveness of its security measures and may update them from time to time. Any updates will not materially reduce the overall level of protection.

6.3 ConsentStack implements privacy-by-design principles in its Processing of Consent Data, including:

  • (a) Pseudonymization: The visitor identifier is a random value that the ConsentStack script creates in the End User's browser. Our servers hash it with SHA-256 as soon as they receive it, before it is buffered or stored, and discard the original. ConsentStack does not store the original identifier and cannot reverse the hash.
  • (b) No IP address retention: IP addresses are used transiently by our infrastructure provider for network routing and to work out the End User's country and region, and are not stored in Consent Data. Only the derived country and region (for example, a US state) are retained.
  • (c) No cross-site tracking: Visitor identifiers are created separately on each Customer's site and are never reused, correlated, or shared across different Customers. ConsentStack cannot identify or track End Users across multiple Customers' websites.
  • (d) URL minimization: Page URLs, and the page addresses recorded with detected cookies, are stored without their query strings or fragments (the parts after "?" or "#"), which can carry form contents, search terms or identifiers.
  • (e) Data minimization: Consent records contain only the data necessary to provide proof of consent and consent analytics. No names, email addresses, or other directly identifiable information is collected from End Users. The user agent is used to work out browser, operating system and device type, and is not itself stored.

6.4 Processing before a consent choice. Some Processing has to happen before an End User makes a consent choice, because it is how the Service shows the right banner, blocks trackers and measures usage. On every page load, before any choice:

  • (a) the End User's IP address is used transiently to determine the country and region whose rules apply, and is not stored;
  • (b) the ConsentStack script creates the random visitor identifier and keeps it in the browser's local storage on the Customer's site;
  • (c) the hashed visitor identifier is recorded once for each billing period to count the site's unique visitors, which sets plan usage and limits (Annex 3, "Visitor counting"); and
  • (d) the script reports the trackers it detects on the page: the names of cookies and storage items, the addresses of third-party scripts, the page they were seen on, and, for scripts, the hashed visitor identifier (Annex 3, "Tracker detection").

These records do not contain the End User's consent choice, IP address or any directly identifying information.

7. Sub-processors

7.1 The Customer provides general authorization for ConsentStack to engage the Sub-processors listed on the Sub-processor List page.

7.2 ConsentStack will notify the Customer at least 30 days before engaging any new Sub-processor or replacing an existing one, by email to the Customer's billing email address and by updating the Sub-processor List.

7.3 The Customer may object to a new Sub-processor by notifying ConsentStack in writing within 30 days of receiving notice. If the Customer objects on reasonable grounds related to data protection, the parties will discuss the objection in good faith. If the parties cannot resolve the objection within 30 days, the Customer may terminate the Agreement by providing written notice, and ConsentStack will refund any prepaid fees covering the remainder of the subscription term.

7.4 If the Customer does not object within 30 days of receiving notice, the Customer is deemed to have accepted the new Sub-processor.

7.5 ConsentStack will:

  • (a) Impose data protection obligations on each Sub-processor that are no less protective than those in this DPA;
  • (b) Remain fully liable to the Customer for the performance of each Sub-processor's obligations; and
  • (c) Conduct appropriate due diligence on each Sub-processor's data protection practices before engagement and on an ongoing basis.

7.6 For the avoidance of doubt, ancillary services that do not involve the Processing of Personal Data on behalf of the Customer (such as telecommunications providers, postal services, and general business tools that do not access Consent Data) are not considered Sub-processors under this DPA.

8. Data Subject Rights

8.1 ConsentStack will assist the Customer in fulfilling its obligations to respond to Data Subject requests under applicable Data Protection Laws, taking into account the nature of the Processing.

8.2 The ConsentStack consent banner serves as the primary mechanism for End Users to exercise their right to withdraw or modify consent. End Users can re-open the banner at any time to change their preferences.

8.3 For other Data Subject rights (access, deletion, rectification, portability, restriction, and objection), ConsentStack will:

  • (a) Provide the Customer with the ability to view and export consent records through the ConsentStack dashboard on plans that include consent logs and during a Retention Hold, and the ability to delete an individual End User's consent records as described in Section 11.5;
  • (b) Promptly forward any Data Subject request received directly by ConsentStack to the Customer, without responding to the Data Subject directly unless instructed by the Customer; and
  • (c) Provide reasonable technical assistance to the Customer in responding to such requests, to the extent the Customer is unable to do so independently using the Service.

9. Data Breach Notification

9.1 ConsentStack will notify the Customer of any confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data ("Data Breach") within 72 hours of becoming aware of the Data Breach.

9.2 The notification will include, to the extent reasonably available:

  • (a) A description of the nature of the Data Breach, including the categories and approximate number of Data Subjects and records concerned;
  • (b) The likely consequences of the Data Breach;
  • (c) A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its adverse effects; and
  • (d) The name and contact details of ConsentStack's point of contact for further information.

9.3 ConsentStack will cooperate with the Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of the Data Breach.

9.4 Notifications to supervisory authorities under Article 33 GDPR or to Data Subjects under Article 34 GDPR are the responsibility of the Customer. ConsentStack will provide reasonable assistance to the Customer in making such notifications.

9.5 ConsentStack will bear the costs of breach investigation and remediation where the Data Breach resulted from ConsentStack's failure to comply with its obligations under this DPA. The Customer will bear such costs where the Data Breach resulted from the Customer's instructions or configuration.

10. Data Protection Impact Assessments

10.1 ConsentStack will provide reasonable assistance to the Customer in conducting data protection impact assessments and prior consultations with supervisory authorities, to the extent required under Articles 35 and 36 of the GDPR, taking into account the nature of the Processing and the information available to ConsentStack.

11. Data Deletion and Return

11.1 Export during the term. On plans that include consent logs, the Customer can export its consent records from the dashboard at any time, as a CSV file or as JSON. Export is also available on any plan during a Retention Hold.

11.2 Retention Hold. When a plan change would shorten how long a site's consent records are kept, the site keeps its previous retention period for 30 days after the change (a "Retention Hold"). This applies when a paid plan ends and the site moves to Basic (a cancelled plan ends at the end of its billing period), and when a site moves to a paid plan with a shorter retention period. During the Retention Hold the Customer can export the site's consent records from the dashboard, including on Basic. When it ends, the new plan's retention period applies and older records are deleted.

11.3 Deletion by the Customer. When the Customer deletes a site, a workspace or its account in the dashboard, ConsentStack immediately deletes the Consent Data of every site concerned from its production database and removes those sites' configuration files and hosted policies from its storage. Deletion cannot be undone, so the Customer should export any records it needs first. Copies of the ConsentStack script already cached in browsers or on the network can keep running for a few minutes after deletion; they then stop working.

11.4 Other termination. If the Agreement ends other than by the Customer deleting its account, ConsentStack will keep the Customer's Consent Data for 30 days after the end date so that the Customer can request an export, and will then delete it as described in Section 11.3.

11.5 Deleting specific Consent Data. At any time during the term, the Customer can delete all consent records of an individual End User using the deletion functionality in the dashboard, available to the Customer's owners and admins on plans that include consent logs, or can ask ConsentStack to delete specific Consent Data by contacting [email protected]. ConsentStack will process such requests within 30 days.

11.6 Backups. Deleted Consent Data can remain in our database provider's encrypted backups until those backups expire, which is normally within 7 days. ConsentStack uses backups only to recover from data loss or system failure, and does not restore deleted Consent Data for any other purpose. Backups stay protected under this DPA until they expire.

11.7 Certification. When a site, workspace or account is deleted, ConsentStack automatically emails a certificate of deletion to the person who deleted it. ConsentStack will also provide written certification of deletion upon the Customer's request.

11.8 Retention required by law. This Section does not require deletion of Consent Data that applicable law requires ConsentStack to keep. Any such data remains protected under this DPA and is used only for the purpose that requires it.

12. Audit Rights

12.1 ConsentStack will make available to the Customer all information necessary to demonstrate compliance with this DPA and applicable Data Protection Laws.

12.2 ConsentStack will satisfy audit requests by providing compliance documentation, including:

  • (a) This DPA and its Annexes;
  • (b) Summaries of security assessments, penetration test results, and certifications (when available);
  • (c) Responses to reasonable written questions about ConsentStack's data protection practices.

12.3 If the documentation provided under Section 12.2 is insufficient, the Customer (or a qualified third-party auditor bound by confidentiality obligations) may conduct an audit of ConsentStack's facilities and records relevant to the Processing, subject to:

  • (a) At least 30 days' prior written notice;
  • (b) The audit being conducted during normal business hours and in a manner that minimizes disruption to ConsentStack's operations;
  • (c) The Customer bearing the costs of the audit, unless the audit reveals material non-compliance by ConsentStack with its obligations under this DPA, in which case ConsentStack will bear the reasonable costs.

12.4 On-site and remote audit rights under Section 12.3 are available to Customers on a paid plan (currently Pro Lite, Pro, Pro+ and Business, or a plan agreed in an Order Form). Customers on the free plan (Basic) have access to the documentation-based audit rights described in Section 12.2.

12.5 ConsentStack may limit the scope and frequency of audits to once per twelve-month period, unless the Customer has reasonable grounds to believe a Data Breach has occurred or that ConsentStack is in material breach of this DPA.

13. International Data Transfers

13.1 ConsentStack stores Consent Data in the United States. Our database runs on Supabase in Amazon Web Services' US East (N. Virginia) region. Site configuration files and hosted policies are stored in Cloudflare R2 in Eastern North America.

13.2 End Users' requests to the Service are handled by Cloudflare's global network, at a data center near the End User. Before consent records and visitor counts are written to our database, Cloudflare holds them briefly in Durable Objects, normally for a minute or less and longer only if our database is unavailable, and then removes them. Cloudflare decides where a Durable Object runs, and ConsentStack does not fix that location, so this buffering can take place outside the United States. A transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to the United States therefore occurs when the Service is used.

13.3 For transfers of Personal Data from the EEA, the parties agree to the EU Standard Contractual Clauses (Module 2: Controller to Processor), as set out in European Commission Implementing Decision (EU) 2021/914. The Annexes to this DPA serve as the appendices required by the SCCs. In the event of any conflict between this DPA and the SCCs, the SCCs will prevail with respect to the data transfers they govern.

13.4 For transfers of Personal Data from the United Kingdom, the parties agree to the UK International Data Transfer Addendum to the EU SCCs, as issued by the UK Information Commissioner's Office.

13.5 For transfers of Personal Data from Switzerland, the SCCs apply with the modifications required to comply with the Swiss Federal Act on Data Protection (FADP), including that the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority.

13.6 ConsentStack may rely on additional transfer mechanisms recognized under applicable Data Protection Laws, including adequacy decisions and the EU-US Data Privacy Framework, if and when applicable.

14. US State Privacy Laws

14.1 To the extent that ConsentStack processes Personal Data subject to the CCPA/CPRA, ConsentStack acts as a Service Provider (as defined under the CCPA) with respect to that Personal Data.

14.2 ConsentStack will not:

  • (a) Sell or share Personal Data;
  • (b) Retain, use, or disclose Personal Data for any purpose other than providing the Service as specified in the Agreement, or as otherwise permitted by the CCPA;
  • (c) Retain, use, or disclose Personal Data outside of the direct business relationship between ConsentStack and the Customer; or
  • (d) Combine Personal Data received from the Customer with Personal Data received from any other source, except as permitted by the CCPA.

14.3 Data that has been aggregated and de-identified under Section 4.4 is not Personal Data, and Section 14.2 does not restrict its use as Section 4.4 describes.

14.4 ConsentStack will assist the Customer in responding to consumer rights requests under the CCPA/CPRA and other applicable US state privacy laws.

14.5 The obligations in this Section apply equally to Personal Data subject to other US state privacy laws that impose processor or service provider obligations, including the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and similar laws.

15. Liability

15.1 The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Agreement, except where such limitations are not permitted by applicable Data Protection Laws.

15.2 Nothing in this DPA limits either party's liability to Data Subjects under Article 82 of the GDPR or equivalent provisions of applicable Data Protection Laws.

16. Miscellaneous

16.1 ConsentStack may amend this DPA. For a material change, ConsentStack will give the Customer at least 30 days' notice by email and in the dashboard before the change takes effect, and will ask the Customer to accept the amended DPA, as the Terms of Service describe. If the amendment materially reduces the Customer's rights under this DPA, the Customer may object by terminating the Agreement within 30 days of receiving notice. Changes that are not material, such as corrections and clarifications, take effect when published. Section 7 governs changes to Sub-processors, and ConsentStack will not amend the SCCs except to adopt a successor version approved by the competent authority.

16.2 If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.

16.3 This DPA survives termination of the Agreement with respect to any Personal Data that ConsentStack continues to process.

16.4 This DPA is governed by the same governing law as the Agreement, except that the SCCs are governed by the law of the EU Member State specified in the SCCs.

Annex 1: Technical and Organizational Measures

The following measures are implemented by ConsentStack to protect Personal Data in accordance with Article 32 of the GDPR.

1. Confidentiality (Article 32(1)(b))

Physical access controls:

  • All data is hosted in managed cloud infrastructure (Supabase on AWS, Cloudflare and Vercel). ConsentStack does not operate on-premises servers.
  • Cloud providers maintain SOC 2 Type II certification and physical security controls including biometric access, 24/7 monitoring, and multi-factor entry.

Electronic access controls:

  • All data in transit is encrypted with TLS (HTTPS).
  • Database access is restricted via Row-Level Security (RLS) policies, ensuring team-scoped data isolation.
  • Administrative access to production systems requires multi-factor authentication.
  • Principle of least privilege applied to all system access.

Internal access controls:

  • Access to production databases is restricted to authorized personnel only.
  • Service accounts use scoped API keys with minimum required permissions.

Encryption:

  • Data in transit: TLS for all connections.
  • Data at rest: AES-256 encryption via AWS managed encryption (Supabase).
  • Visitor identifiers hashed with SHA-256 before storage.

2. Integrity (Article 32(1)(b))

  • Database constraints enforce relational integrity.
  • Input validation at the application layer for all data inputs.
  • Database access restricted to application service accounts; direct database manipulation requires authorized administrative access.
  • The Service has no function to edit a consent record after it is written. Records are deleted under the retention periods in Annex 3 and Section 11.
  • Configuration changes are versioned with full audit trail (created_by, published_by, timestamps).

3. Availability and Resilience (Article 32(1)(b))

  • Application hosting: Vercel (global edge network with automatic failover).
  • Database hosting: Supabase on AWS (managed PostgreSQL with high availability).
  • Edge network and storage: Cloudflare (global network for SDK delivery, configuration delivery and data ingest; Durable Objects for short-term buffering; R2 for configuration files and hosted policies).
  • DDoS protection: Cloudflare Web Application Firewall (WAF) with rate limiting.
  • Rate limiting: Applied to the endpoints that receive consent records and tracker reports, and to our server functions, to prevent abuse.

4. Recoverability (Article 32(1)(c))

  • Automated daily database backups managed by Supabase, kept for 7 days.
  • Consent records waiting in the edge buffer are kept until our database confirms they are written, so a database outage delays their storage.
  • Infrastructure-as-code deployment enables rapid service restoration.
  • Serverless architecture eliminates single points of failure.

5. Pseudonymization (Article 32(1)(a))

  • Visitor identifier hashing: The random visitor identifier created by the ConsentStack script is hashed using SHA-256 on ConsentStack's servers as soon as it is received, before it is buffered or stored. The original identifier is not kept.
  • No IP address retention: IP addresses are processed transiently to determine the End User's country and region for regulatory compliance, and are not stored in Consent Data. Only the derived country and region are retained.
  • Site-scoped identifiers: Visitor identifiers are unique to each Customer's site and cannot be correlated across different Customers.
  • No cross-site tracking: ConsentStack cannot and does not track, fingerprint, or identify End Users across multiple Customers' websites.
  • No direct identifiers: Consent records do not contain names, email addresses, account identifiers, or other directly identifiable information about End Users. Page URLs are stored without query strings or fragments.

6. Regular Review (Article 32(1)(d))

  • Security practices reviewed and updated regularly.
  • Personnel with access to Personal Data receive data protection training.
  • Sub-processor security practices reviewed before engagement and periodically thereafter.
  • Vulnerability assessments conducted on public-facing endpoints.

Annex 2: Sub-processor List

The Sub-processors authorized to process Personal Data on behalf of the Customer are listed on the Sub-processor List page. ConsentStack maintains this list with each Sub-processor's name, function, categories of data processed, and hosting location.

Annex 3: Processing Description

Subject Matter and Duration

ConsentStack processes Consent Data on behalf of the Customer for the purpose of providing the consent management Service described in the Agreement. Processing continues for the duration of the Agreement and the periods described in Section 11.

Nature and Purpose of Processing

Collection, recording, organization, storage, retrieval, and use of Consent Data for the purpose of:

  • Providing proof of consent for regulatory compliance;
  • Enabling End Users to manage their consent preferences;
  • Providing consent analytics to the Customer (consent rates, device and geographic breakdown, trends);
  • Detecting and categorizing third-party scripts, cookies and storage on the Customer's website, and keeping the site's tracker inventory, which the Customer's generated Privacy Policy and Cookie Policy draw on;
  • Enforcing consent-based script blocking;
  • Counting unique visitors per billing period to measure plan usage and apply plan limits; and
  • Hosting the configuration and policies the Customer publishes.

Categories of Data Subjects

End Users: Visitors to the Customer's websites on which the Service is installed, whether or not they interact with the consent banner.

Customer contacts: People whose details the Customer enters into the Service, for example a privacy contact named in a generated policy.

Categories of Personal Data

Data processed without being stored

  • IP address: Network routing, and working out the country and region whose rules apply. Processed transiently by Cloudflare and not stored. Only the derived country and region are retained.
  • Precise location, if the Customer turns it on: If the Customer enables the setting that makes location details available to its own page code, Cloudflare's estimate of the End User's city, postal code, coordinates and time zone is returned to the End User's browser with the banner configuration. ConsentStack does not store it.
  • User-Agent header: Read from consent requests to work out browser, operating system and device type. The header itself is not stored.
  • Accept-Language header: Choosing the language in which the banner is shown. Not stored.
  • Origin header: Checking that the request comes from one of the Customer's registered domains. Not stored.

Visitor counting (before consent)

  • Hashed visitor identifier and billing period: Recorded once per site per billing period, from the first page view, to count unique visitors. At the end of each billing period the identifiers are deleted and only the total count is kept.

Tracker detection (before consent)

  • Cookies: Cookie name, the domain that set it, the cookie's attributes (domain, path, SameSite, Secure, lifetime), whether it was blocked, the region, and the address of the page where it was seen, without query string or fragment.
  • Storage items: Local and session storage key names, the domain that set them, and whether they were blocked.
  • Scripts and vendors: The script's domain, a sample script address, the matched vendor and category, first and last seen times, and a sample of the page paths (without query strings) and hashed visitor identifiers for which the script was seen.

Data stored in consent records

  • Hashed visitor identifier: Links the consent events of one End User on one site.
  • Consent choices: Which categories were accepted or rejected.
  • Event type and action: The nature of the consent event (initial or update; opt_in, opt_out, partial, acknowledge).
  • Interaction details: How the End User decided (for example accept all, reject all, save preferences), whether the preferences panel was opened, time to decision, banner load time, banner position, and the label of any in-page prompt or import that triggered the decision.
  • Timestamp: When the decision was recorded (server-side UTC).
  • Configuration details: The configuration and its version, and whether global compliance mode and instant configuration updates were on.
  • Country code and region: The End User's country and region (for example, a US state), used to decide which rules apply. City, postal code and coordinates are not stored.
  • Regulation and consent model: The regulation and consent model applied (for example opt_in, opt_out, notice).
  • Global Privacy Control: Whether a GPC signal was present, and whether the decision came from an honored signal, a banner click or the preferences panel.
  • Browser, operating system and device type: Derived from the user agent for consent analytics.
  • Page URL and domain: Where consent was given, stored without query string or fragment.
  • Language: The End User's browser language and the language the banner was shown in.
  • SDK version: Technical diagnostics.
  • Imported consent: If the Customer imports consent from a previous consent platform, the record also keeps that platform's consent identifier as that platform issued it (it is not hashed), with its timestamp, region and method, so the Customer's proof of consent stays continuous.

Customer content

  • Policy generator answers and hosted policies: The business details the Customer enters to generate its policies, which can include a contact's name, email address or phone number, and the policies ConsentStack hosts for the Customer.

Sensitive Data

None intended. The Service is not designed to collect special categories of Personal Data. Page URLs are stored without query strings or fragments to reduce the chance that they carry personal information, and the Customer should not place such information in the paths of its page addresses.

Frequency of Transfer

Continuous, for as long as the Service is installed on the Customer's websites.

Retention Periods

Consent records are kept for the retention period of the site's plan, unless an Order Form says otherwise:

  • Basic: the current monthly period, counted from the day the site was created.
  • Pro Lite: 30 days.
  • Pro: 30 days.
  • Pro+: 180 days.
  • Business: 365 days.

An automated job deletes records older than the retention period every day. When a plan change would shorten retention, the previous period continues for 30 days under the Retention Hold in Section 11.2. Deleting a site, workspace or account deletes its consent records immediately (Section 11.3).

  • Edge buffer: Consent records and visitor counts are held in Cloudflare Durable Objects until our database confirms they are written, normally for a minute or less.
  • Visitor counting records: The current billing period. Afterwards only the total count is kept.
  • Detected cookies and storage items: Deleted 90 days after they were last seen.
  • Detected scripts and vendors: Kept for as long as the site exists, because they make up the site's tracker inventory, which the Customer's generated policies rely on. Deleted with the site.
  • Client-side consent state: Stored in the End User's browser for the lifetime the Customer configures (365 days by default). Removed when it expires or when the End User clears their browser storage.
  • Client-side visitor identifier: Stored in the browser's local storage on the Customer's site until the End User clears it. Removed by the script if the site is disabled.
  • Backups: As described in Section 11.6.

Annex 4: International Transfer Mechanisms

EU Standard Contractual Clauses (Module 2: Controller to Processor)

The parties agree to the EU Standard Contractual Clauses as set out in European Commission Implementing Decision (EU) 2021/914, Module 2 (Transfer controller to processor), which are incorporated by reference into this DPA.

Clause-specific elections:

  • Clause 7 (Docking clause): Not included.
  • Clause 9(a) (Sub-processor authorization): Option 2 (General written authorization) applies. ConsentStack will inform the Customer of changes to Sub-processors with at least 30 days' notice, as described in Section 7 of this DPA.
  • Clause 11 (Redress): The optional language is not included.
  • Clause 13 (Supervision): Where the data exporter is established in an EU Member State, the supervisory authority of that Member State is the competent authority. Where the data exporter is not established in an EU Member State but falls within the territorial scope of the GDPR under Article 3(2), the supervisory authority of the Member State designated by the data exporter under Article 27(1) is the competent authority.
  • Clause 17 (Governing law): Option 1, the law of Ireland.
  • Clause 18(b) (Forum): The courts of Ireland.

Annex I.A (List of Parties):

  • Data exporter: The Customer, being the legal entity that agreed to the Agreement for the ConsentStack account, as named in the account's billing details or, if none is named, the organization of the account owner. Address and contact details: as provided in the account. Activities relevant to the transfer: use of the Service on the Customer's websites. Role: Controller. Signature and date: the Customer's acceptance of the Agreement, which incorporates this DPA.
  • Data importer: ConsentStack LLC, a California limited liability company, 23046 Avenida De La Carlota, Suite #600, Laguna Hills, California 92653, United States. Contact: [email protected]. Contact person: Ben Churchill, Co-founder and CTO. Activities relevant to the transfer: providing the Service under the Agreement. Role: Processor. Signature and date: ConsentStack's agreement to the Agreement, effective on the date the Customer accepts it.

Annex I.B (Description of Transfer): As set out in Annex 3 (Processing Description) of this DPA.

Annex I.C (Competent Supervisory Authority): As determined under Clause 13 above.

Annex II (Technical and Organizational Measures): As set out in Annex 1 (TOMs) of this DPA.

Annex III (List of Sub-processors): As set out in Annex 2 of this DPA.

UK International Data Transfer Addendum

For transfers of Personal Data from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs (as issued by the UK Information Commissioner under Section 119A of the Data Protection Act 2018) is incorporated by reference. The ICO is the competent supervisory authority for UK transfers.

Swiss Addendum

For transfers of Personal Data from Switzerland, the SCCs apply with the following modifications: (a) references to "Regulation (EU) 2016/679" are interpreted as references to the Swiss FADP; (b) references to the "competent supervisory authority" mean the Swiss Federal Data Protection and Information Commissioner (FDPIC); (c) references to "Member State" are interpreted as references to Switzerland; and (d) the governing law and forum are those of Switzerland.