1. Roles
For the personal data of website visitors processed through the Novexa Pilot tracking snippet, the customer is the data controller and J Software Solution ("processor") processes that data only on the customer’s documented instructions, as set out in this DPA and the Terms of Service.
2. Subject matter, duration and purpose
Subject matter: providing the website analytics, SEO intelligence and CRM functionality of the Service. Duration: for as long as the underlying subscription is active, plus the 30-day account soft-delete window. Purpose: solely to generate the analytics/CRM output the controller sees in their own portal.
3. Categories of data subjects and data
Data subjects: visitors to the controller’s instrumented website(s), and the controller’s own team members who use the Service.
Categories of data: session and device metadata (browser, OS, device type, referrer), approximate city-level location derived from IP and never the raw IP itself, a rotating 24-hour salted visitor hash, page-view and conversion events, and any lead/contact information the controller’s own forms or CRM entry capture.
4. Processor obligations
The processor will: process data only on the controller’s instructions; ensure personnel with access are bound by confidentiality; implement the technical and organisational measures described in §5; assist the controller in responding to data-subject requests and in its own regulatory obligations; notify the controller without undue delay, and no later than 72 hours after becoming aware, of a personal data breach affecting the controller’s data; and, at the end of the engagement, delete or return the data per the retention schedule in the Privacy Policy.
5. Technical and organisational measures
Encryption in transit (TLS) and at rest for backups; argon2id password hashing; role- and domain-scoped, server-enforced access control; an append-only audit log for privileged actions, written in the same transaction as the change it records; a Content Security Policy with per-request nonces; rate limiting and an optional IP allowlist for administrative access; two-factor authentication (mandatory for platform administrators).
6. Sub-processors
The controller authorises the processor’s use of the sub-processors listed on the Sub-processor list page. The processor will give at least 30 days’ notice before adding a new sub-processor, during which the controller may object on reasonable data-protection grounds.
7. International transfers and Standard Contractual Clauses
Where personal data subject to the EU/UK/Swiss data protection framework is transferred to a country without an adequacy decision, the parties intend to rely on the European Commission’s Standard Contractual Clauses (2021/914), Module 2 (controller-to-processor), incorporated by reference, with the controller as data exporter and the processor as data importer, and the UK International Data Transfer Addendum where the transfer originates from the UK.
[Placeholder — the SCC annexes (parties, description of transfer, technical/organisational measures, competent supervisory authority) must be completed with the processor’s actual production hosting location, which is not yet finalized in this codebase (doc 22 §5 tracks region choice as a post-launch item), and reviewed by counsel before this DPA is executed with any customer.]
8. Audits
On reasonable notice, no more than once per year absent a suspected incident, the controller may request evidence of the measures in §5 (e.g. the current runbooks and CI security-scanning configuration) or request a third-party audit report once one exists.
9. Liability and term
Liability under this DPA is subject to the limitations in the Terms of Service. This DPA terminates automatically when the underlying subscription and its data-retention window both end.