DPA FRAMEWORK
Processing terms built around
controlled collection.
This framework documents the intended controller-processor relationship and current safeguards. It is not an executed DPA and requires the provider's legal identity, transfer mechanism, jurisdiction-specific annexes and legal approval.
Status: review draft dated October 3, 2026. The customer would act as controller or business; the ConvertClarity operating entity would act as processor or service provider for customer visitor data.
1. Scope and instructions
Processing is limited to providing, securing, supporting and improving the subscribed service under the customer's documented configuration and lawful instructions. ConvertClarity does not sell customer visitor data or use it for cross-context behavioral advertising.
2. Processing details
| Subject matter | Behavior analytics, replay, heatmaps, funnel reporting and CRO evidence for customer-controlled sites. |
|---|---|
| Duration | Subscription term plus configured retention and deletion periods. |
| Data subjects | Visitors to customer websites and authorized customer workspace users. |
| Data categories | Anonymous session identifiers, URLs and paths, device category, interaction coordinates, scroll depth, masked DOM changes, performance/error signals, commerce milestones and account administration data. |
| Excluded data | Payment-card data, credentials, health data, government identifiers and unmasked sensitive or free-form input content. |
3. Confidentiality and personnel
Access must be limited to personnel and contractors who need it to operate or secure the service and who are bound by confidentiality obligations. Administrative access must be authenticated, least-privileged and reviewable.
4. Security measures
- Organization isolation and role-based access.
- Scoped site write keys, origin validation and key rotation.
- Encryption in transit and provider-managed encryption at rest.
- Inputs masked by default, configurable private regions and consent-gated collection.
- Rate limits, queued ingestion, bounded payloads and bot filtering.
- Audit records, retention controls, exports and delayed account deletion.
- Operational logs, dead-letter handling and failure-state visibility.
Penetration testing, restore drills, named incident ownership and production alert routing remain general-availability gates.
5. Subprocessors
Approved infrastructure providers and their purposes are maintained on the subprocessor schedule. Final notice periods and objection procedures must be specified in the executed DPA.
6. Data-subject and regulator assistance
The service provides collection pause, site deletion, organization export, configurable retention and scheduled account deletion. The customer remains responsible for authenticating requests and determining the appropriate response. ConvertClarity would reasonably assist with requests and regulator inquiries relating to its processing.
7. Security incidents
The processor would notify affected customers without undue delay after confirming a personal-data breach, provide available scope and remediation information, preserve relevant evidence and cooperate with legally required notices. Final notification contacts and contractual timing require legal approval.
8. Return and deletion
Customer-configured retention removes expired events, sessions and replay chunks. Customers can export workspace data and schedule account deletion. Legal holds and provider backup practices must be documented in the final agreement.
9. International transfers and annexes
The final DPA must identify storage locations and add any required Standard Contractual Clauses, UK addendum, U.S. state service-provider terms or other regional transfer safeguards. No transfer mechanism is asserted until the operating entity and processing locations are verified.
10. Audit and precedence
The executed DPA should define reasonable documentation, audit and certification rights and should control over conflicting service terms for personal-data processing. This public framework does not itself create those rights.