Data Processing Agreement

1. Scope and how this agreement applies

This Data Processing Agreement ("DPA") is entered into between Digitonica SRL ("BetterPopup", "we", the processor) and the customer identified on the BetterPopup account ("you", the controller). It forms part of our Terms of Service and applies whenever we process personal data on your behalf.

Where this DPA conflicts with the Terms of Service on the subject of personal data processing, this DPA prevails. Terms defined in the GDPR (controller, processor, personal data, processing, data subject, personal data breach, sub-processor and supervisory authority) carry the same meaning here. "Data Protection Law" means Regulation (EU) 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, applicable ePrivacy rules, and US state privacy laws, each as applicable.

2. Roles of the parties

You are the controller of the personal data collected through your popups: the email addresses, phone numbers, consent records and related visitor information described in Annex I. You decide what to collect, why, and on what legal basis, and you are responsible for the lawfulness of the instructions you give us.

We are your processor for that data. We process it only to provide the service to you and only on your documented instructions.

We act as an independent controller for the account, billing, support and product-usage data we hold about you as our customer. That processing is governed by our Privacy Policy, not by this DPA.

3. Our processing instructions

Your instructions to us are made up of the Terms of Service, this DPA, and the configuration choices you make in the product: the popups you publish, the fields you ask for, the audiences you target, the retention settings you choose, the integrations you connect, and any third-party pixels or custom code you turn on. Your use of the service in the ordinary way constitutes an instruction to process personal data accordingly.

We will:

• process personal data only on those instructions, including for transfers, unless required otherwise by EU or member-state law, in which case we will tell you before processing unless the law forbids it on important grounds of public interest;
• immediately inform you if, in our opinion, an instruction infringes Data Protection Law;
• not sell personal data, not use it for our own purposes, and not use it to train machine-learning models. Aggregated statistics that do not identify you, your visitors or your subscribers are not personal data and are not covered by this restriction.

4. Confidentiality

We ensure that every person authorised to process personal data under this DPA is bound by an appropriate duty of confidentiality, is trained on their obligations, and has access limited to what their role genuinely requires.

5. Security of processing

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by Art. 32 GDPR. Those measures are described in Annex II. We may update them as the service evolves, provided the level of protection is not reduced.

6. Sub-processors

You give us general authorisation to engage sub-processors to help deliver the service. The current list is in Annex III.

Before adding or replacing a sub-processor we will give you at least 30 days' notice by email to account owners. If you have a reasonable objection on data-protection grounds, tell us within that period and we will work with you in good faith to find an alternative. If we cannot, you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees for the unused remainder of the term.

We impose data-protection obligations on every sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

7. Assisting with data subject requests

The service gives you direct access to the personal data we hold for you: you can search, export and delete subscriber records from your dashboard at any time. In most cases this lets you answer access, correction, erasure and portability requests yourself without needing us.

Where a request cannot be handled through the product, we will provide reasonable assistance, taking into account the nature of the processing. If a data subject contacts us directly about data we process for you, we will not respond substantively. We will redirect them to you and, where we can identify you, tell you promptly.

8. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data we process for you. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for more information, supplying details in phases where they are not all available at once. We will assist you in meeting your own obligations under Art. 33 and 34 GDPR. Our notification is not an acknowledgement of fault or liability.

9. Impact assessments and prior consultation

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with your data protection impact assessments and any prior consultation with a supervisory authority under Art. 35 and 36 GDPR. Annex I and Annex II, together with our Privacy Policy, are designed to supply most of the information such an assessment requires.

10. Return and deletion

You can export your subscriber data from the dashboard at any time while your account is open, and can delete individual records or your whole account yourself.

On termination we delete the personal data we process for you within 30 days, with encrypted backups purged on their normal rotation within a further 30 days. For Shopify installations, deletion happens 48 hours after uninstall, when Shopify sends its shop deletion request. We retain data beyond that only where EU or member-state law requires it (for example accounting records), and in that case we keep it protected and process it only for the purpose that requires retention.

11. Audits and demonstrating compliance

We will make available the information reasonably necessary to demonstrate compliance with this DPA, starting with written answers to your security questionnaire and the documentation in the annexes. If that is not enough, you may request an audit no more than once in any 12-month period, on at least 30 days' written notice, at your cost, during business hours, without unreasonably disrupting our operations, and subject to confidentiality. An audit may not extend to other customers' data or to our systems where access would compromise their security. Where a supervisory authority requires an audit, we will cooperate as the law directs.

12. International transfers

We are established in the EU, so no transfer takes place when a customer in the EU/EEA gives us personal data. Where we transfer personal data to a sub-processor outside the EU/EEA or the UK, we do so on the basis of an adequacy decision (including the EU-US Data Privacy Framework where the sub-processor is certified) or, in its absence, the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Three (processor to processor), together with the UK International Data Transfer Addendum where UK data is involved.

If you are established outside the EU/EEA, Module Four (processor to controller) of those clauses applies between you and us to the extent Data Protection Law requires it. By agreeing to this DPA, the parties are deemed to have signed those clauses, with Annex I and Annex II of this DPA supplying the corresponding annexes, and the governing law and forum being Romania.

We apply supplementary measures including encryption in transit and at rest, and we will challenge unlawful government access requests where there is a reasonable basis to do so.

13. Your obligations as controller

You are responsible for:

• establishing a valid legal basis for the personal data you collect through your popups, and providing data subjects with the information Art. 13 and 14 GDPR require, normally in your own privacy notice (section 16 has text you can use);
• obtaining and recording valid consent where it is required, including for email and SMS marketing and for the browser storage our script uses on your site, and honouring withdrawals;
• the third-party pixels and custom code you turn on, and the providers that receive data through them;
• not collecting special categories of personal data (Art. 9) or criminal-offence data (Art. 10) through the service, and not using it to collect data from children;
• the accuracy and lawfulness of your instructions, and the security of your own account credentials.

14. US state privacy laws

Where US state privacy law applies, including the CCPA as amended by the CPRA, we act as your service provider or processor. We will not sell or share personal information we process for you; will not retain, use or disclose it for any purpose other than providing the service to you, or outside our direct business relationship with you; will not combine it with personal information we receive from anyone else, except as those laws permit; will provide the same level of privacy protection those laws require; and will tell you if we can no longer meet these obligations. You may take reasonable steps to stop and remedy unauthorised use. We certify that we understand and will comply with these restrictions.

15. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, to the extent permitted by Data Protection Law. This DPA takes effect when you accept the Terms of Service and continues for as long as we process personal data on your behalf, after which the deletion obligations in section 10 apply.

16. Text for your own privacy policy

You can adapt this paragraph for your own privacy policy, and list the browser storage in your cookie banner using the table in our Cookie Policy. Check it against how you have set up your popups, and replace the bracketed parts.

17. Annex I: Details of processing

Data minimisation note. The platform does not store visitors' IP addresses in its database. An IP address is held in memory only long enough to rate-limit abusive requests and is then discarded. Reports are built from daily aggregate counts per popup. A pseudonymous event log (event type, page path, screen size, country and the random ids) is kept for 90 days for debugging and contains no contact details. Audience targeting is evaluated in the visitor's browser, so visit history is not sent to us.

18. Annex II: Technical and organisational measures

• Encryption: TLS for all data in transit; an encrypted (LUKS2) database volume and encrypted backups; field-level encryption of subscribers' email addresses and phone numbers, with keyed hashes for lookups; AES-256-GCM encryption of the access tokens for the integrations you connect.
• Access control: authentication managed by a specialist provider, administrative access limited to named personnel on a least-privilege basis, and separate database roles so the public capture endpoint can insert records but cannot read or modify existing data.
• Access logging: every view and export of subscriber data is recorded with who did it and how many records were returned, and kept for about 13 months.
• Tenant isolation: every record is scoped to an organisation identifier and queries are constrained to the authenticated organisation, so one customer cannot reach another's data.
• Payment data: card details are handled entirely by Stripe or Shopify and never reach our systems.
• Resilience and recovery: hourly encrypted database backups kept off the application server for 30 days, and documented restore procedures.
• Abuse protection: rate limiting on public write endpoints, signed webhook verification, CDN-level protection, and filtering of automated crawler traffic.
• Secure development: code review before release, automated test coverage, dependency monitoring, and secrets held in environment configuration rather than in source control.
• Data minimisation by design: IP addresses are never written to the database, reports are aggregated, targeting runs in the visitor's browser, Global Privacy Control is honoured, and optional double opt-in is available to confirm consent.
• Organisational: confidentiality obligations for all personnel, data-protection agreements with every sub-processor, and periodic review of these measures.

19. Annex III: Authorised sub-processors

Not sub-processors. The email and SMS platforms you connect (such as Klaviyo, Mailchimp, Omnisend, Attentive, Postscript and Drip) and the third-party pixels you turn on receive data at your direction under your own agreement with them. They are independent recipients, not our sub-processors, and we are not responsible for their processing.

20. Contact

Questions about this DPA, requests for a countersigned copy, or requests for transfer safeguards: [email protected].

Digitonica SRL
Str. Dr. Victor Gomoiu
Craiova, Dolj, Romania
CUI 46142569 · Trade Register J18/1195/2022