Data processing agreement (DPA)

Parties and purpose

The customer (controller) and STRATACORE LLC (processor). Cookigator processes personal data of visitors to the customer's websites only to show the banner, apply their choice and keep proof of consent.

Data and data subjects

Data subjects: visitors to the customer's websites. Data: random consent ID, choices, date, banner version, domain, anonymised IP, country and user agent. No special categories of data.

Duration

While the customer's subscription is active. At the end, data is deleted within 30 days unless the customer exports it first or the law requires keeping it.

Processor obligations

Process data only on the customer's documented instructions; ensure confidentiality of authorised staff; apply appropriate technical and organisational measures; help the customer respond to data subject requests; make available the information needed to demonstrate compliance.

Security measures

Encryption in transit (HTTPS), IP anonymisation before storage, EU database (Frankfurt), access restricted per account, API keys stored as hashes, and backups managed by the database provider.

Sub-processors

The customer authorises these sub-processors. We'll give notice of changes so the customer can object:

• Vercel Inc. (hosting and content delivery)

• Neon Inc. (database, servers in Frankfurt, EU)

• Stripe Payments Europe Ltd. (payments and billing)

• Resend (transactional emails)

• Google LLC (Sign in with Google, only if you choose it)

Personal data breaches

We'll notify the customer without undue delay, and in any case within 48 hours of becoming aware of a breach, with the information available.

Audits

The customer may request reasonable information or audits, with 30 days' notice, at most once a year unless there is a breach.