Data Processing Agreement

"Personal data", "processing","data subject" and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 (GDPR).

"Services" means the StackPatrol SaaS platform available at stackpatrol.eu, including scan history, monitoring and reporting features.

The Processor processes the following categories of personal data on behalf of the Controller:

• Email addresses of the Controller's users (account holders)
• URLs submitted for scanning (may contain personal identifiers in path/query)
• IP addresses captured in server logs (retained for 7 days)

Processing is carried out for the purpose of providing the Services described in the Terms of Service. The legal basis for processing is performance of a contract (GDPR Art. 6(1)(b)).

Processing continues for the duration of the subscription. Upon termination or account deletion, personal data is deleted within 30 days, except where retention is required by applicable law.

The Processor shall:

• Process personal data only on documented instructions from the Controller.
• Ensure that persons authorised to process the data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures (Art. 32 GDPR).
• Assist the Controller in responding to data subject requests under Chapter III GDPR.
• Notify the Controller without undue delay (and in any event within 72 hours) upon becoming aware of a personal data breach.
• Delete or return all personal data at the end of the contract, at the Controller's choice.
• Make available all information necessary to demonstrate compliance, and allow for audits at reasonable notice.

The Controller authorises the use of the following sub-processors. The Processor will notify the Controller of any intended changes at least 14 days in advance, giving the Controller the opportunity to object.

Stripe processes payment and billing data under its own DPA. Billing data (name, email, billing address, payment method token) is transferred to the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses. Email is delivered from Resend's EU send region (Ireland); as Resend Inc. is US-based, some account data, email metadata and logs may be processed in the United States under Standard Contractual Clauses. The optional OpenAI processing and its risk of incidental personal data are described separately below.

Where the Processor's deterministic consent-banner detection cannot locate the relevant consent control on a scanned website, it may optionally call OpenAI's API to classify which button performs that action. Only bounded button metadata from the scanned site (visible label text, HTML tag, CSS classes, element IDs and ARIA labels) is transmitted. Frame identifiers are opaque, and common email, phone, URL and long identifier patterns are redacted first. The Processor does not intentionally send personal data, scan URLs, cookies or page content. Because third-party HTML attributes can contain unexpected text, the filtering reduces rather than eliminates the risk of incidental personal data. The classifier is disabled unless an API key is configured, and OpenAI does not use API inputs to train its models.

The Controller warrants that it has a lawful basis to instruct the Processor to process personal data and that data subjects have been informed of processing in accordance with GDPR Arts. 13–14.

Technical and organisational measures in place include:

• Encryption in transit using HTTPS/TLS
• Access control limited to authorised personnel
• Application data stored on access-controlled infrastructure in Hetzner's EU region
• No third-party tracking or analytics on the StackPatrol application itself

This DPA is governed by Norwegian law. Disputes shall be submitted to the courts of Østfold, Norway. For data subjects in the EU/EEA, the supervisory authority for the Processor is Datatilsynet (Norwegian Data Protection Authority).

To exercise your rights, request a signed copy of this DPA, or report a data concern, contact: Andreas@stackpatrol.eu

We aim to respond within 5 business days.