Data Processing Agreement (DPA)

1. Preamble and Parties

This Data Processing Agreement (“DPA”) supplements the Principal Agreement (Terms of Service or Client Agreement) between the client (“Controller”) and:

This agreement applies whenever the Processor processes personal data on behalf of the Controller during the performance of marketing, conversion tracking, CRM configuration, or advertising operations.

2. Scope, Nature, and Purpose of Processing

The Processor provides digital acquisition, server-side tracking, CRM architecture (e.g. GoHighLevel), and campaign management. Processing activities include the collection, transmission, recording, and storage of customer lead data and digital tracking signals necessary to measure and optimize marketing campaigns.

3. Types of Personal Data & Categories of Data Subjects

• Categories of Data Subjects: Prospective clients, website visitors, leads, and customers of the Controller.
• Types of Personal Data: Contact details (names, email addresses, phone numbers, company names), IP addresses, conversion timestamps, purchase values, and digital identifiers (e.g. hashed lead emails for Enhanced Conversions / Meta CAPI).

4. Obligations of the Processor

• Documented Instructions: The Processor processes personal data only on documented instructions from the Controller (Art. 28(3)(a) GDPR).
• Confidentiality: Personnel authorized to process personal data have committed themselves to confidentiality (Art. 28(3)(b) GDPR).
• Technical and Organisational Measures (TOMs): The Processor maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR), including encryption, strict role-based access control, and EU-domiciled hosting infrastructure.
• Sub-processors: The Controller grants general authorization to engage sub-processors listed in the Privacy Policy (Supabase, Vercel, Resend, Cal.com). The Processor binds sub-processors to equivalent data protection obligations (Art. 28(4) GDPR).
• Data Subject Rights Assistance: Taking into account the nature of processing, the Processor assists the Controller in fulfilling obligations to respond to data subject requests under Chapter III of the GDPR.
• Deletion or Return of Data: Upon termination of the service agreement, the Processor shall, at the choice of the Controller, delete or return all personal data, unless statutory retention laws apply.

5. Audits and Inspections

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allows for audits conducted by the Controller or an independent auditor mandated by the Controller.

6. Execution & Inquiries

Clients requiring a countersigned copy of this Data Processing Agreement may request one by emailing our privacy team at: [PLACEHOLDER: dpa@skyup.agency].