[{"data":1,"prerenderedAt":1212},["ShallowReactive",2],{"\u002Fdata-processing-agreement":3},{"id":4,"title":5,"body":6,"description":1204,"extension":1205,"meta":1206,"navigation":1208,"path":1209,"seo":1210,"stem":12,"__hash__":1211},"content\u002Fdata-processing-agreement.md","Data Processing Agreement",{"type":7,"value":8,"toc":1162},"minimark",[9,13,28,51,62,73,78,81,164,172,175,179,225,228,232,238,244,250,256,262,266,269,308,312,315,393,397,403,407,414,420,426,429,432,443,446,450,456,459,469,473,480,494,497,500,504,507,510,534,537,540,544,549,554,558,561,619,623,626,630,633,637,640,651,654,658,661,684,687,691,694,697,701,704,707,710,714,717,720,724,728,734,740,746,866,872,878,884,890,894,899,905,910,916,920,925,930,935,937,941,944,1018,1023,1025,1029,1033,1041,1045,1059,1063,1077,1081,1086,1090,1107,1111,1122,1126,1134,1140,1142,1146,1149],[10,11,5],"h1",{"id":12},"data-processing-agreement",[14,15,16,20,21,24,27],"p",{},[17,18,19],"strong",{},"Effective Date:"," September 9, 2026",[22,23],"br",{},[17,25,26],{},"Version:"," 1.0",[14,29,30,33,34,36,39,40,42,45,46],{},[17,31,32],{},"Company Name:"," Beespoke Services Ltd (trading as Backona)",[22,35],{},[17,37,38],{},"Company Address:"," 4th Floor, 18 St. Cross Street, London, United Kingdom, EC1N 8UN",[22,41],{},[17,43,44],{},"Contact Email:"," ",[47,48,50],"a",{"href":49},"mailto:support@backona.com","support@backona.com",[14,52,53,54,58,59,61],{},"This Data Processing Agreement (the \"DPA\") applies where Beespoke Services Ltd, trading as Backona (\"Backona,\" \"we,\" \"us,\" \"our\"), processes personal data on behalf of a customer (\"Customer,\" \"you,\" \"your\") in the course of providing the Services. It forms part of, and is incorporated by reference into, the Backona ",[47,55,57],{"href":56},"\u002Fterms-of-use","Terms of Use",". By accepting the Terms of Use you accept this DPA. If you require a separately executed copy for your records, contact us at ",[47,60,50],{"href":49},".",[14,63,64,65,68,69,72],{},"This DPA is most relevant to ",[17,66,67],{},"Backona CMP"," (Consent Management Platform) and ",[17,70,71],{},"Backona SST"," (Server Side Tagging), where personal data relating to visitors of your websites is processed on your instruction.",[74,75,77],"h2",{"id":76},"_1-roles-of-the-parties","1. Roles of the Parties",[14,79,80],{},"Backona acts in different capacities depending on whose personal data is processed and why. The distinction is important and is set out below.",[82,83,84,100],"table",{},[85,86,87],"thead",{},[88,89,90,94,97],"tr",{},[91,92,93],"th",{},"Personal data",[91,95,96],{},"Controller",[91,98,99],{},"Backona's role",[101,102,103,114,123,138,151],"tbody",{},[88,104,105,109,112],{},[106,107,108],"td",{},"Your account, billing, support and product usage data as a Backona customer",[106,110,111],{},"Backona",[106,113,96],{},[88,115,116,119,121],{},[106,117,118],{},"Personal data of visitors to Backona's own website",[106,120,111],{},[106,122,96],{},[88,124,125,128,133],{},[106,126,127],{},"Consent records collected through a Backona CMP banner deployed on your website or app",[106,129,130],{},[17,131,132],{},"You (Customer)",[106,134,135],{},[17,136,137],{},"Processor",[88,139,140,143,147],{},[106,141,142],{},"Event and identifier data forwarded through a Backona SST container you configure",[106,144,145],{},[17,146,132],{},[106,148,149],{},[17,150,137],{},[88,152,153,156,160],{},[106,154,155],{},"Data retrieved from your connected third-party accounts (e.g. Google Analytics, Google Ads, Facebook Marketing API) at your instruction",[106,157,158],{},[17,159,132],{},[106,161,162],{},[17,163,137],{},[14,165,166,167,171],{},"Where Backona acts as controller, the ",[47,168,170],{"href":169},"\u002Fprivacy-policy","Privacy Policy"," governs that processing. Where Backona acts as processor, this DPA governs that processing and the Privacy Policy does not determine the purposes of it.",[14,173,174],{},"Under the UK GDPR and EU GDPR, you are the \"controller\" and Backona is the \"processor\". Under the California Consumer Privacy Act as amended (\"CCPA\") and comparable U.S. state privacy laws, you are the \"business\" and Backona is a \"service provider\". Nothing in this DPA makes Backona a joint controller with you, and Backona does not become a controller of Customer Personal Data by performing the Services.",[74,176,178],{"id":177},"_2-definitions","2. Definitions",[180,181,182,189,195,201,207,213,219],"ul",{},[183,184,185,188],"li",{},[17,186,187],{},"Customer Personal Data:"," personal data contained in or derived from your use of the Services that relates to your end users, website visitors, customers or personnel, and that Backona processes on your behalf.",[183,190,191,194],{},[17,192,193],{},"Consent Record:"," a record of a consent action taken by a visitor to your website or app through a Backona CMP banner, as described in Annex 1.",[183,196,197,200],{},[17,198,199],{},"Data Protection Laws:"," the UK GDPR, the EU GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the ePrivacy Directive as implemented in the relevant member state, the CCPA, and any other data protection or privacy law applicable to a party's processing under this DPA.",[183,202,203,206],{},[17,204,205],{},"Data Subject Request:"," a request from a data subject to exercise a right under Data Protection Laws, including access, rectification, erasure, restriction, portability, objection or withdrawal of consent.",[183,208,209,212],{},[17,210,211],{},"Personal Data Breach:"," a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data.",[183,214,215,218],{},[17,216,217],{},"Sub-processor:"," a third party engaged by Backona to process Customer Personal Data.",[183,220,221,224],{},[17,222,223],{},"Services:"," as defined in the Terms of Use.",[14,226,227],{},"Terms such as \"personal data\", \"processing\", \"controller\", \"processor\" and \"data subject\" have the meanings given to them in the UK GDPR.",[74,229,231],{"id":230},"_3-subject-matter-duration-nature-and-purpose-of-processing","3. Subject Matter, Duration, Nature and Purpose of Processing",[14,233,234,237],{},[17,235,236],{},"Subject matter."," Backona's provision of the Services to you under the Terms of Use.",[14,239,240,243],{},[17,241,242],{},"Duration."," For the term of your subscription or other agreement with Backona, plus the retention periods set out in Section 11. Consent Records are subject to the specific retention rules in Section 11.2, which apply irrespective of whether your subscription remains active.",[14,245,246,249],{},[17,247,248],{},"Nature and purpose."," Collecting, recording, storing, retrieving, transmitting and deleting Customer Personal Data solely as necessary to provide the Services you have configured, and for no independent purpose of Backona's own.",[14,251,252,255],{},[17,253,254],{},"Documented instructions."," Your instructions to Backona consist of the Terms of Use, this DPA, and the configuration you apply within the Services (for example the consent categories, banner text, cookie declarations and template you select in Backona CMP, or the tags and endpoints you configure in Backona SST). Backona will not process Customer Personal Data for any other purpose unless required by law, in which case Backona will inform you before processing unless legally prohibited from doing so.",[14,257,258,259,61],{},"Categories of personal data and of data subjects are set out in ",[17,260,261],{},"Annex 1",[74,263,265],{"id":264},"_4-your-obligations-as-controller","4. Your Obligations as Controller",[14,267,268],{},"You are responsible for, and warrant to Backona, the following:",[270,271,272,278,284,290,296,302],"ol",{},[183,273,274,277],{},[17,275,276],{},"Lawful basis and lawful instructions."," You have a valid legal basis for the processing you instruct, and your instructions comply with Data Protection Laws. You will not instruct Backona to process Customer Personal Data in a way that would put Backona in breach of Data Protection Laws.",[183,279,280,283],{},[17,281,282],{},"Your own notices and disclosures."," You are responsible for drafting, publishing and maintaining your own privacy notice, cookie notice and any other required disclosures, and for ensuring they accurately describe the technologies in use on your properties. Backona does not draft these documents for you, and any template, sample or default text provided within the Services is illustrative only and is not legal advice.",[183,285,286,289],{},[17,287,288],{},"Configuration."," You are responsible for configuring the Services correctly and for the accuracy and completeness of that configuration. In the case of Backona CMP this includes selecting consent categories, declaring the cookies and similar technologies actually present on your properties, mapping your tags and scripts to the correct categories, and ensuring that non-essential technologies do not execute before consent is obtained. See Section 6.3 of the Terms of Use.",[183,291,292,295],{},[17,293,294],{},"Accuracy of your declarations."," Backona does not scan, crawl or audit your properties to discover cookies or trackers, and does not verify that your declarations match reality. Cookie declarations rendered by a Backona CMP banner reflect what you have entered.",[183,297,298,301],{},[17,299,300],{},"Data minimisation on your side."," You will not use the Services to transmit special category data (Article 9 UK GDPR), criminal offence data, payment card data, or personal data of children below the age of digital consent in the relevant jurisdiction, unless separately agreed with Backona in writing.",[183,303,304,307],{},[17,305,306],{},"Your personnel and access."," You are responsible for administering access to your account and for the acts and omissions of your users and agents.",[74,309,311],{"id":310},"_5-backonas-obligations-as-processor","5. Backona's Obligations as Processor",[14,313,314],{},"Backona will:",[270,316,317,323,329,335,341,351,357,363,369,375,381,387],{},[183,318,319,322],{},[17,320,321],{},"Process only on instruction."," Process Customer Personal Data only on your documented instructions as described in Section 3, and not for its own purposes.",[183,324,325,328],{},[17,326,327],{},"No sale or unauthorised use."," Not sell, rent, share, license or otherwise make Customer Personal Data available to any third party except as permitted by this DPA, and not combine Customer Personal Data with data from other sources to build profiles or cross-site identifiers.",[183,330,331,334],{},[17,332,333],{},"No model training."," Not use Customer Personal Data to develop, improve or train any generalised artificial intelligence or machine learning model.",[183,336,337,340],{},[17,338,339],{},"Confidentiality."," Ensure that personnel authorised to process Customer Personal Data are subject to a duty of confidentiality and are granted access only on a need-to-know basis.",[183,342,343,346,347,350],{},[17,344,345],{},"Security."," Implement and maintain the technical and organisational measures set out in ",[17,348,349],{},"Annex 3",", taking account of the state of the art, the costs of implementation, and the nature, scope, context and risks of the processing.",[183,352,353,356],{},[17,354,355],{},"Sub-processors."," Engage Sub-processors only in accordance with Section 8.",[183,358,359,362],{},[17,360,361],{},"Assist with data subject rights."," Assist you in responding to Data Subject Requests in accordance with Section 10.",[183,364,365,368],{},[17,366,367],{},"Assist with compliance."," Provide reasonable assistance with your data protection impact assessments and prior consultations with a supervisory authority, to the extent the assistance relates to Backona's processing and is not otherwise available to you.",[183,370,371,374],{},[17,372,373],{},"Notify of breaches."," Notify you of a Personal Data Breach in accordance with Section 9.",[183,376,377,380],{},[17,378,379],{},"Deletion and return."," Handle Customer Personal Data on termination in accordance with Section 11.",[183,382,383,386],{},[17,384,385],{},"Make information available."," Make available the information necessary to demonstrate compliance with this Section, and submit to audits in accordance with Section 12.",[183,388,389,392],{},[17,390,391],{},"Notify unlawful instructions."," Inform you without undue delay if, in Backona's opinion, an instruction infringes Data Protection Laws.",[74,394,396],{"id":395},"_6-security","6. Security",[14,398,399,400,402],{},"Backona's technical and organisational measures are set out in ",[17,401,349],{},". Backona may update those measures from time to time provided the level of protection is not materially reduced. You are responsible for assessing whether the measures meet your requirements, and for the security of the environments and systems under your control, including your own website, tag manager and CDN.",[74,404,406],{"id":405},"_7-location-of-processing-and-international-transfers","7. Location of Processing and International Transfers",[14,408,409,410,413],{},"Customer Personal Data processed through Backona CMP, including all Consent Records, is stored on infrastructure operated by OVHcloud in ",[17,411,412],{},"London, United Kingdom",", as set out in Annex 2. It is not stored or replicated outside the United Kingdom.",[14,415,416,419],{},[17,417,418],{},"If you are established in the United Kingdom,"," or the UK GDPR otherwise applies to you, this involves no restricted transfer.",[14,421,422,425],{},[17,423,424],{},"If you are established in the European Economic Area,"," or the EU GDPR otherwise applies to you, storage in the United Kingdom is a transfer to a third country. That transfer is made in reliance on the European Commission's adequacy decision for the United Kingdom, renewed by Commission Implementing Decision (EU) 2025\u002F2574 of 19 December 2025 and in force until 27 December 2031. No supplementary transfer mechanism or transfer risk assessment is required for the transfer while that decision remains in force, and no further action is required from you to rely on this Section.",[14,427,428],{},"If the adequacy decision expires without renewal, or is annulled, suspended, repealed or amended so that it ceases to cover this processing, Backona will without undue delay enter into the European Commission's Standard Contractual Clauses (Module Two, controller to processor) with you in respect of the transfer, and will notify the administrative contact on your account. Those clauses are deemed incorporated into this DPA and to take effect automatically on the date the adequacy decision ceases to apply, with Backona as data importer and you as data exporter, with the optional docking clause included, with Clause 17 governed by the law of Ireland and Clause 18(b) designating the courts of Ireland, and with Annexes I, II and III of those clauses populated by Annexes 1, 3 and 2 of this DPA respectively.",[14,430,431],{},"Where the provision of another Service necessarily involves a transfer of Customer Personal Data outside the United Kingdom or the European Economic Area — for example where you instruct Backona to retrieve data from a third-party platform that hosts it elsewhere, or where you configure Backona SST to forward events to a destination outside the UK or EEA — that transfer is made on your instruction and Backona will ensure an appropriate transfer mechanism is in place, being one of:",[180,433,434,437,440],{},[183,435,436],{},"an adequacy decision or adequacy regulations covering the recipient country;",[183,438,439],{},"the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies; or",[183,441,442],{},"the recipient's certification under the EU-U.S. Data Privacy Framework and the UK Extension to it, where applicable.",[14,444,445],{},"You remain responsible for the lawfulness of transfers to destinations that you yourself select and configure.",[74,447,449],{"id":448},"_8-sub-processors","8. Sub-processors",[14,451,452,453,61],{},"You give Backona general authorisation to engage the Sub-processors listed in ",[17,454,455],{},"Annex 2",[14,457,458],{},"Backona will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains liable to you for a Sub-processor's performance of those obligations.",[14,460,461,462,465,466,468],{},"Backona will give you at least ",[17,463,464],{},"30 days' notice"," before adding or replacing a Sub-processor that processes Customer Personal Data, by updating Annex 2 and notifying the administrative contact on your account. If you have a reasonable objection on data protection grounds, raise it at ",[47,467,50],{"href":49}," within that notice period. Backona will work with you in good faith to find an alternative; if none is available, you may terminate the affected Service without penalty and receive a pro-rated refund of any prepaid fees for the unused period.",[74,470,472],{"id":471},"_9-personal-data-breach","9. Personal Data Breach",[14,474,475,476,479],{},"Backona will notify you of a Personal Data Breach affecting Customer Personal Data ",[17,477,478],{},"without undue delay"," after becoming aware of it, so as to allow you to meet your own notification obligations. The notification will describe, to the extent then known:",[180,481,482,485,488,491],{},[183,483,484],{},"the nature of the breach, including the categories and approximate number of data subjects and records affected;",[183,486,487],{},"the likely consequences;",[183,489,490],{},"the measures taken or proposed to address the breach and mitigate its effects; and",[183,492,493],{},"a contact point for further information.",[14,495,496],{},"Where the full picture is not available at the time of the initial notification, Backona will not delay that notification, and will provide the remaining information in phases as it becomes available. Backona will cooperate with you and take reasonable steps to assist in your investigation, containment and remediation.",[14,498,499],{},"Notification to you is not an acknowledgement of fault or liability by Backona. You are responsible for any notification you are required to make to a supervisory authority or to affected data subjects, and for determining whether such notification is required.",[74,501,503],{"id":502},"_10-data-subject-requests","10. Data Subject Requests",[14,505,506],{},"If Backona receives a Data Subject Request that relates to Customer Personal Data, Backona will not respond to it directly except to confirm that the request should be directed to you, and will refer the request to you without undue delay.",[14,508,509],{},"Backona will provide reasonable assistance to enable you to respond, taking into account the nature of the processing. For Backona CMP specifically:",[180,511,512,518,524],{},[183,513,514,517],{},[17,515,516],{},"Access to a Consent Record."," A visitor is shown their Consent ID within the banner's preferences interface, and the banner's default text directs the visitor to quote that Consent ID when contacting the operator of the website. On your request, quoting the Consent ID, Backona will provide the Consent Record history held for that identifier.",[183,519,520,523],{},[17,521,522],{},"Erasure of a Consent Record."," On your request, quoting the Consent ID, Backona will delete the Consent Record held for that identifier.",[183,525,526,529,530,533],{},[17,527,528],{},"Timing."," Backona will respond to such requests within ",[17,531,532],{},"10 working days"," of receipt so as to allow you to meet your own statutory deadline. Requests are currently fulfilled manually; Backona does not expose a self-service export interface for Consent Records.",[14,535,536],{},"Where fulfilling a request would require Backona to identify records across an entire website or account rather than by Consent ID, each Consent Record carries your client identifier and the hostname the consent was given on, so the request can be scoped to your records and to a single website of yours. Backona will confirm the scope with you before acting.",[14,538,539],{},"Assistance under this Section is provided at no additional charge for requests of reasonable volume. Backona may charge its reasonable costs for assistance that is disproportionate in scale or frequency, on prior written notice.",[74,541,543],{"id":542},"_11-retention-export-and-deletion","11. Retention, Export and Deletion",[545,546,548],"h3",{"id":547},"_111-general","11.1 General",[14,550,551,552,61],{},"Backona retains Customer Personal Data only for as long as necessary to provide the Services and for the periods described in this Section and in the ",[47,553,170],{"href":169},[545,555,557],{"id":556},"_112-consent-records-and-the-audit-trail","11.2 Consent Records and the Audit Trail",[14,559,560],{},"A Consent Record exists so that you, as controller, can demonstrate that consent was obtained, as required by Article 7(1) UK GDPR. The following applies:",[180,562,563,573,583,589,598,604],{},[183,564,565,568,569,572],{},[17,566,567],{},"Rolling retention."," Each Consent Record is automatically deleted ",[17,570,571],{},"24 months after the last consent action recorded against it",". Where a visitor takes a further consent action, the 24-month period restarts from that action.",[183,574,575,578,579,582],{},[17,576,577],{},"Bounded history."," Backona retains the ",[17,580,581],{},"10 most recent"," consent actions for each Consent ID. Earlier actions for that identifier are discarded as new ones are recorded.",[183,584,585,588],{},[17,586,587],{},"Retention is independent of your subscription."," Consent Records are retained on the schedule above whether or not your subscription remains active. This is deliberate: terminating your subscription does not extinguish your obligation to demonstrate consents that were collected while it was active, and deleting the trail on cancellation would destroy your own evidence. During that period Backona will not use the Consent Records for any purpose other than making them available to you.",[183,590,591,594,595,597],{},[17,592,593],{},"Export on request."," You may request an export of your Consent Records at any time, including after termination, at ",[47,596,50],{"href":49},". Backona will provide the export in a structured, machine-readable format within 30 days.",[183,599,600,603],{},[17,601,602],{},"Early deletion on request."," As controller, the decision to delete is yours. You may instruct Backona at any time to delete Consent Records, in whole or scoped to a Consent ID or website, and Backona will do so within 30 days and confirm in writing. Backona will not delete Consent Records early on its own initiative.",[183,605,606,609,610,614,615,618],{},[17,607,608],{},"Cookies on the visitor's device."," The Consent ID cookie (",[611,612,613],"code",{},"cBConsentId",") and consent state cookie (",[611,616,617],{},"cBModeMap",") are first-party cookies set on the visitor's own device with a lifetime of 365 days. They are outside Backona's control once set and are cleared by the visitor clearing their browser storage.",[545,620,622],{"id":621},"_113-configuration-and-account-data","11.3 Configuration and Account Data",[14,624,625],{},"Deleting a client configuration in Backona CMP removes the banner configuration for that client identifier. It does not delete Consent Records, which are governed by Section 11.2.",[545,627,629],{"id":628},"_114-on-termination","11.4 On Termination",[14,631,632],{},"On termination or expiry of your agreement, Backona will, at your choice, return or delete Customer Personal Data other than Consent Records, within 60 days, except to the extent Backona is required by law to retain a copy. Consent Records are handled under Section 11.2. Backup copies are overwritten in the ordinary course of Backona's backup rotation.",[74,634,636],{"id":635},"_12-audit-and-information-rights","12. Audit and Information Rights",[14,638,639],{},"On written request, and no more than once in any 12-month period unless a Personal Data Breach or a supervisory authority requires otherwise, Backona will:",[180,641,642,645,648],{},[183,643,644],{},"respond to a reasonable security and data protection questionnaire concerning the Services;",[183,646,647],{},"provide a copy of Annex 3 current at the date of the request, together with any then-current third-party certifications or audit reports Backona holds; and",[183,649,650],{},"where the above is genuinely insufficient for you to demonstrate compliance, permit an audit conducted during business hours, on at least 30 days' notice, in a manner that does not disrupt the Services or compromise the confidentiality or security of other customers' data.",[14,652,653],{},"Audits are at your cost. Any auditor you appoint must not be a competitor of Backona and must be bound by confidentiality obligations.",[74,655,657],{"id":656},"_13-ccpa-and-us-state-privacy-laws","13. CCPA and U.S. State Privacy Laws",[14,659,660],{},"Where Customer Personal Data includes personal information subject to the CCPA or a comparable U.S. state privacy law, Backona is a service provider (or processor, as the applicable statute terms it) and:",[270,662,663,666,669,672,675,678,681],{},[183,664,665],{},"processes personal information only to perform the Services specified in this DPA and the Terms of Use;",[183,667,668],{},"does not sell or share personal information, as those terms are defined by the CCPA;",[183,670,671],{},"does not retain, use or disclose personal information for any purpose other than the business purposes specified in this DPA, including not for its own commercial purposes;",[183,673,674],{},"does not combine personal information received from you with personal information received from any other source, except as permitted by the CCPA for a service provider;",[183,676,677],{},"will notify you if Backona determines it can no longer meet these obligations;",[183,679,680],{},"certifies that it understands and will comply with these restrictions; and",[183,682,683],{},"imposes equivalent obligations on any Sub-processor to which it discloses personal information.",[14,685,686],{},"You may take reasonable and appropriate steps to stop and remediate any unauthorised use of personal information by Backona, using the audit and information rights in Section 12.",[74,688,690],{"id":689},"_14-liability","14. Liability",[14,692,693],{},"Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms of Use, including the aggregate cap in Section 17.2 of the Terms of Use. Nothing in this DPA excludes or limits either party's liability where Data Protection Laws prohibit it, including liability to a data subject under Article 82 UK GDPR.",[14,695,696],{},"Without limiting the above, and as set out in Sections 17.11 and 17.12 of the Terms of Use, Backona is not liable for fines, penalties or other sanctions imposed on you by a supervisory authority, nor for claims brought against you by data subjects, arising from your configuration of the Services, your own notices, your legal basis for processing, or your compliance decisions.",[74,698,700],{"id":699},"_15-term-changes-and-precedence","15. Term, Changes and Precedence",[14,702,703],{},"This DPA takes effect when you accept the Terms of Use and continues for as long as Backona processes Customer Personal Data.",[14,705,706],{},"Backona may update this DPA where necessary to reflect a change in Data Protection Laws, a change in the Services, or a change to Annex 2 or Annex 3, provided the update does not materially reduce the protections afforded to you. Material changes will be notified to the administrative contact on your account at least 30 days before taking effect, and the version number and effective date above will be updated.",[14,708,709],{},"In the event of a conflict, the order of precedence is: (1) a separately negotiated and executed data processing agreement between you and Backona, if any; (2) this DPA; (3) the Terms of Use; (4) the Privacy Policy.",[74,711,713],{"id":712},"_16-governing-law","16. Governing Law",[14,715,716],{},"This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as set out in Section 19 of the Terms of Use.",[718,719],"hr",{},[74,721,723],{"id":722},"annex-1-details-of-processing","Annex 1 — Details of Processing",[545,725,727],{"id":726},"a-backona-cmp-consent-management-platform","A. Backona CMP (Consent Management Platform)",[14,729,730,733],{},[17,731,732],{},"Data subjects:"," visitors to the websites and applications on which you deploy a Backona CMP banner.",[14,735,736,739],{},[17,737,738],{},"Purpose:"," presenting a consent interface, storing the visitor's consent preferences, signalling those preferences to consent-aware tools on your property, and maintaining a record of consent actions so that you can demonstrate consent.",[14,741,742,745],{},[17,743,744],{},"Consent Record contents."," Where you enable the consent audit log in your banner configuration, each recorded consent action contains:",[82,747,748,758],{},[85,749,750],{},[88,751,752,755],{},[91,753,754],{},"Field",[91,756,757],{},"Description",[101,759,760,771,779,799,818,826,834,842,850,858],{},[88,761,762,765],{},[106,763,764],{},"Consent ID",[106,766,767,768,770],{},"A randomly generated identifier (UUID version 4) created in the visitor's browser and stored in the first-party ",[611,769,613],{}," cookie. It is not derived from any other identifier and is not shared across websites.",[88,772,773,776],{},[106,774,775],{},"Client identifier",[106,777,778],{},"The identifier of your Backona CMP configuration, recorded so that your audit trail can be exported or deleted without reference to any other customer's records.",[88,780,781,784],{},[106,782,783],{},"Domain",[106,785,786,787,790,791,794,795,798],{},"The hostname on which the consent action was taken, determined by Backona from the request rather than from page script. A leading ",[611,788,789],{},"www."," is removed before storage so that ",[611,792,793],{},"www.example.com"," and ",[611,796,797],{},"example.com"," are recorded as the same domain.",[88,800,801,804],{},[106,802,803],{},"Action",[106,805,806,807,810,811,814,815,61],{},"One of ",[611,808,809],{},"accept_all",", ",[611,812,813],{},"reject_all"," or ",[611,816,817],{},"preferences_saved",[88,819,820,823],{},[106,821,822],{},"Consent categories",[106,824,825],{},"The visitor's choice per category as a set of true\u002Ffalse values. The category of strictly necessary technologies is always true.",[88,827,828,831],{},[106,829,830],{},"Timestamp",[106,832,833],{},"The server time at which the action was recorded.",[88,835,836,839],{},[106,837,838],{},"Page URL",[106,840,841],{},"The address of the page on which the action was taken, as reported by the browser.",[88,843,844,847],{},[106,845,846],{},"IP address",[106,848,849],{},"The visitor's IP address, truncated before storage: an IPv4 address is reduced to its first three octets, and an IPv6 address to its first three groups (a \u002F48 prefix), in both cases discarding the portion that identifies an individual subscriber or device. An address in any other format is discarded and recorded as unknown. The untruncated address is never written to storage.",[88,851,852,855],{},[106,853,854],{},"User agent",[106,856,857],{},"The browser user agent string, as reported by the browser.",[88,859,860,863],{},[106,861,862],{},"Policy version",[106,864,865],{},"The version identifier of the consent notice in force when the action was taken.",[14,867,868,871],{},[17,869,870],{},"Not collected by Backona CMP."," Names, email addresses, account identifiers, telephone numbers, precise or approximate geolocation, IP-derived country or region, IAB Transparency and Consent Framework strings, cross-site or cross-device identifiers, and any special category data. Backona CMP does not perform IP-to-location lookup.",[14,873,874,877],{},[17,875,876],{},"Signalling to your tools."," Where enabled in your configuration, the banner writes consent signals to Google Consent Mode and Microsoft UET in the visitor's browser, and honours the Global Privacy Control browser signal. These signals are exchanged within the visitor's browser between the banner and your own tools. Backona does not receive, store or have access to the resulting tool data.",[14,879,880,883],{},[17,881,882],{},"Optional logging."," The consent audit log is active only where your banner configuration includes it. Where it is not enabled, no Consent Record is created and consent state exists only in first-party cookies on the visitor's device.",[14,885,886,889],{},[17,887,888],{},"Retention:"," as set out in Section 11.2.",[545,891,893],{"id":892},"b-backona-sst-server-side-tagging","B. Backona SST (Server Side Tagging)",[14,895,896,898],{},[17,897,732],{}," visitors to the websites and applications from which you send events to a Backona SST container.",[14,900,901,904],{},[17,902,903],{},"Categories of personal data:"," as determined by the tags, variables and event payloads you configure. This may include online identifiers, IP addresses, user agent strings, page and event metadata, and any identifiers or custom parameters you choose to send.",[14,906,907,909],{},[17,908,738],{}," receiving, transforming and forwarding event data to the destinations you configure.",[14,911,912,915],{},[17,913,914],{},"Note on scope."," Backona does not determine what data your container receives or where it is forwarded. Where a Backona CMP banner and a Backona SST container are both in use, it is your responsibility to configure the container so that consent-dependent tags fire only where the corresponding consent has been given. See Section 6.3 of the Terms of Use.",[545,917,919],{"id":918},"c-connected-third-party-accounts","C. Connected third-party accounts",[14,921,922,924],{},[17,923,732],{}," individuals whose data is present in the third-party accounts you connect, typically in aggregated or pseudonymised form.",[14,926,927,929],{},[17,928,903],{}," as returned by the platform, for example advertising account metadata, campaign and performance metrics, search performance data, and pixel or conversion data.",[14,931,932,934],{},[17,933,738],{}," retrieving the data at your instruction to deliver the analytics and insight features of the relevant Service.",[718,936],{},[74,938,940],{"id":939},"annex-2-authorised-sub-processors","Annex 2 — Authorised Sub-processors",[14,942,943],{},"Current as of the effective date above.",[82,945,946,962],{},[85,947,948],{},[88,949,950,953,956,959],{},[91,951,952],{},"Sub-processor",[91,954,955],{},"Entity and location",[91,957,958],{},"Purpose",[91,960,961],{},"Processes Consent Records",[101,963,964,978,992,1005],{},[88,965,966,969,972,975],{},[106,967,968],{},"OVHcloud",[106,970,971],{},"Data centre in London, United Kingdom",[106,973,974],{},"Hosting of the Kubernetes infrastructure, application containers and databases on which Backona CMP and the consent database run",[106,976,977],{},"Yes",[88,979,980,983,986,989],{},[106,981,982],{},"Docker Hub",[106,984,985],{},"Docker, Inc., United States",[106,987,988],{},"Distribution of Backona's own application container images",[106,990,991],{},"No",[88,993,994,997,1000,1003],{},[106,995,996],{},"Let's Encrypt",[106,998,999],{},"Internet Security Research Group, United States",[106,1001,1002],{},"Issuance of TLS certificates for Backona domains",[106,1004,991],{},[88,1006,1007,1010,1013,1016],{},[106,1008,1009],{},"Google",[106,1011,1012],{},"Google Ireland Limited \u002F Google LLC",[106,1014,1015],{},"Authentication of Backona personnel to internal administrative interfaces",[106,1017,991],{},[14,1019,1020,1021,61],{},"The following process personal data only where you have connected them or where they relate to Backona's own controller-side processing, and are listed for completeness. They do not receive Consent Records: OpenAI, Anthropic, LangChain, Stripe, Sender, ClickUp, Google Workspace, and the analytics and advertising platforms identified in the ",[47,1022,170],{"href":169},[718,1024],{},[74,1026,1028],{"id":1027},"annex-3-technical-and-organisational-measures","Annex 3 — Technical and Organisational Measures",[545,1030,1032],{"id":1031},"encryption-and-transmission","Encryption and transmission",[180,1034,1035,1038],{},[183,1036,1037],{},"All traffic to Backona services, including the consent banner and the consent logging endpoint, is served over HTTPS with TLS, using certificates issued and automatically renewed through cert-manager and Let's Encrypt.",[183,1039,1040],{},"Credentials, connection strings and other secrets are stored encrypted in the deployment repository as sealed secrets and are decrypted only inside the target cluster.",[545,1042,1044],{"id":1043},"access-control","Access control",[180,1046,1047,1050,1053,1056],{},[183,1048,1049],{},"Administrative interfaces for Backona CMP are placed behind an authenticating reverse proxy requiring Backona single sign-on, with an eight-hour session lifetime.",[183,1051,1052],{},"Public endpoints are limited to those required to deliver the banner and to record a consent action.",[183,1054,1055],{},"Access to production infrastructure is restricted to named personnel on a need-to-know basis and is granted through individually issued cluster credentials.",[183,1057,1058],{},"Personnel with access are bound by written confidentiality obligations.",[545,1060,1062],{"id":1061},"data-minimisation-and-pseudonymisation","Data minimisation and pseudonymisation",[180,1064,1065,1068,1071,1074],{},[183,1066,1067],{},"The Consent ID is a randomly generated value with no relationship to any other identifier, and is scoped as a first-party cookie to the individual website on which it was set.",[183,1069,1070],{},"IP addresses are truncated before storage, to a \u002F24 for IPv4 and a \u002F48 for IPv6, so that the subscriber- and device-identifying portion of the address is never written to storage. An address that cannot be recognised as either format is discarded rather than stored. No location lookup is performed on any IP address.",[183,1072,1073],{},"No name, email address or other direct identifier is collected by Backona CMP.",[183,1075,1076],{},"Consent history per identifier is bounded to the ten most recent actions.",[545,1078,1080],{"id":1079},"storage-limitation","Storage limitation",[180,1082,1083],{},[183,1084,1085],{},"Consent Records carry an automatic expiry enforced by the database, deleting each record 24 months after the last action recorded against it, without reliance on a scheduled job.",[545,1087,1089],{"id":1088},"segregation-and-infrastructure","Segregation and infrastructure",[180,1091,1092,1095,1098,1101,1104],{},[183,1093,1094],{},"Consent Records are stored on infrastructure located in London, United Kingdom, and are not replicated to any other jurisdiction.",[183,1096,1097],{},"Each Consent Record is attributed to the client identifier and hostname it was collected for, so that a single customer's audit trail can be retrieved or erased without reference to any other customer's records.",[183,1099,1100],{},"Backona CMP runs in a dedicated Kubernetes namespace, separate from Backona's other products.",[183,1102,1103],{},"Configuration data is stored as a separate record per client identifier. The public banner endpoint serves the configuration for the requested identifier only; enumeration of configurations is possible only through the administrative interface described above.",[183,1105,1106],{},"Infrastructure is managed declaratively through version-controlled configuration with continuous reconciliation, so that changes are auditable and reproducible.",[545,1108,1110],{"id":1109},"availability-and-resilience","Availability and resilience",[180,1112,1113,1116,1119],{},[183,1114,1115],{},"The consent banner is served with HTTP caching so that a transient failure of the origin does not immediately prevent the banner from loading for returning visitors.",[183,1117,1118],{},"Where the configuration database is unreachable, the banner can fall back to a configuration held with the application itself, so that consent gating continues to operate. Availability of this fallback depends on your configuration being provisioned for it.",[183,1120,1121],{},"Infrastructure is monitored, and operational logs and metrics are collected for availability and incident review.",[545,1123,1125],{"id":1124},"change-management","Change management",[180,1127,1128,1131],{},[183,1129,1130],{},"Application changes are version-controlled, reviewed and released as immutable container images through an automated pipeline.",[183,1132,1133],{},"Deployments are reconciled from the declared state, and a release can be rolled back to a previous image.",[14,1135,1136,1137,1139],{},"Backona does not currently hold ISO 27001 or SOC 2 certification. Where a certification or an independent audit report is required for your vendor assessment, contact ",[47,1138,50],{"href":49}," to discuss what can be provided.",[718,1141],{},[545,1143,1145],{"id":1144},"contact-information","Contact Information",[14,1147,1148],{},"Data protection enquiries and requests under this DPA:",[14,1150,1151,1152,1154,1155,1157,1158,1160],{},"Beespoke Services Ltd (trading as Backona)",[22,1153],{},"\n4th Floor, 18 St. Cross Street,",[22,1156],{},"\nLondon, United Kingdom, EC1N 8UN",[22,1159],{},[47,1161,50],{"href":49},{"title":1163,"searchDepth":1164,"depth":1164,"links":1165},"",2,[1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1183,1184,1185,1186,1187,1188,1193,1194],{"id":76,"depth":1164,"text":77},{"id":177,"depth":1164,"text":178},{"id":230,"depth":1164,"text":231},{"id":264,"depth":1164,"text":265},{"id":310,"depth":1164,"text":311},{"id":395,"depth":1164,"text":396},{"id":405,"depth":1164,"text":406},{"id":448,"depth":1164,"text":449},{"id":471,"depth":1164,"text":472},{"id":502,"depth":1164,"text":503},{"id":542,"depth":1164,"text":543,"children":1177},[1178,1180,1181,1182],{"id":547,"depth":1179,"text":548},3,{"id":556,"depth":1179,"text":557},{"id":621,"depth":1179,"text":622},{"id":628,"depth":1179,"text":629},{"id":635,"depth":1164,"text":636},{"id":656,"depth":1164,"text":657},{"id":689,"depth":1164,"text":690},{"id":699,"depth":1164,"text":700},{"id":712,"depth":1164,"text":713},{"id":722,"depth":1164,"text":723,"children":1189},[1190,1191,1192],{"id":726,"depth":1179,"text":727},{"id":892,"depth":1179,"text":893},{"id":918,"depth":1179,"text":919},{"id":939,"depth":1164,"text":940},{"id":1027,"depth":1164,"text":1028,"children":1195},[1196,1197,1198,1199,1200,1201,1202,1203],{"id":1031,"depth":1179,"text":1032},{"id":1043,"depth":1179,"text":1044},{"id":1061,"depth":1179,"text":1062},{"id":1079,"depth":1179,"text":1080},{"id":1088,"depth":1179,"text":1089},{"id":1109,"depth":1179,"text":1110},{"id":1124,"depth":1179,"text":1125},{"id":1144,"depth":1179,"text":1145},"Data Processing Agreement for Backona products where Backona processes personal data on behalf of a customer","md",{"date":1207},"2026-09-09",true,"\u002Fdata-processing-agreement",{"title":5,"description":1204},"JHTcKDfQyAwVmmZ8LX8MuANNERrkNsQoqJ2eHJafOWw",1788973495553]