Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between the Customer and ClickCMT. It applies when ClickCMT processes personal data of the Customer's visitors and customers on the Customer's behalf.

1. Roles

The Customer is the controller (or "data fiduciary") of its visitors' personal data, and ClickCMT is the processor (or "service provider"). ClickCMT processes it only on the Customer's documented instructions — the Terms, this DPA and the Customer's settings in the Service — unless the law requires otherwise, in which case we will tell the Customer where allowed.

2. Our commitments

• We do not sell personal data, or use it outside our direct business relationship with the Customer.
• People authorised to process it are bound by confidentiality.
• We apply the security measures in section 5.
• We help the Customer respond to visitors' requests to access, correct or delete their data, mostly through the delete tools in the Service.
• We notify the Customer without undue delay (and aim for within 72 hours) after becoming aware of a personal data breach affecting its data.
• When the Customer's account ends, we delete its personal data within 30 days, unless the law requires us to keep it.
• We make available the information reasonably needed to show compliance with this DPA.

3. Sub-processors

The Customer authorises us to use sub-processors for hosting and infrastructure, email delivery and payments (Stripe), and the ad platforms the Customer itself chooses to connect. We bind sub-processors to data protection terms at least as protective as this DPA and remain responsible for them. We will give notice of new sub-processors by updating this page, and the Customer may object by contacting us.

4. International transfers

Where personal data is transferred across borders, we use the safeguards required by applicable law, such as standard contractual clauses.

5. Security measures

• Encryption of data in transit (HTTPS/TLS) and of integration tokens at rest.
• Access limited to people who need it, with strong authentication.
• Hashed passwords and optional two-factor authentication for customers.
• Monitoring, logging, backups and regular updates of systems.
• Automatic deletion of tracking data after the Customer's retention period.

Annex 1 — Details of the processing

Subject matter and purpose: click tracking, conversion attribution, fraud and bot detection, reporting, and sending conversions to platforms the Customer connects.

Duration: while the Customer uses the Service, plus up to 30 days for deletion.

Data subjects: visitors to the Customer's websites, ads and links; the Customer's leads and customers.

Types of personal data: IP address; visitor ID; approximate location (country, region, city); time zone; browser, browser version, device and operating system; page URLs and referring URLs; UTM parameters and ad-platform click IDs; conversion details (type, reference, amount, currency, time); and, if the Customer enables them, contact details entered on the Customer's forms (name, email, phone, address fields).

Special categories: none intended. The Customer must not send special-category or sensitive data.