Data processing agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service or another written agreement between the customer (“Customer”) and Volcanic Labs SLU, trading as PushFeedback (“PushFeedback”). It applies when PushFeedback processes personal data in Customer Content on Customer’s behalf (“Customer Personal Data”). Data-protection terms have the meanings given in the EU General Data Protection Regulation (“GDPR”). Both parties will comply with data-protection laws applicable to their processing.

1. Roles and instructions

Customer is controller and PushFeedback processor. A Customer acting for another controller confirms authority to appoint us as subprocessor. Each party must meet its role’s duties. Customer must establish a lawful basis, required notices and valid instructions.

We follow documented instructions in the agreement and Customer’s use, including transfers. If EU or Member State law requires other processing, we inform Customer beforehand unless prohibited on important public-interest grounds. We promptly report instructions we reasonably believe unlawful and may pause affected processing until lawful instructions are agreed.

2. Details of processing

The subject matter is the provision, operation, support, and security of the Services. Processing lasts while the Services are provided, on a free or paid plan, and for the limited period described in section 9. Its nature and purpose are to collect, store, organise, display, transmit, analyse, and delete feedback at Customer’s direction. The Personal Data may include names, email addresses, IP addresses, session identifiers, page URLs, messages, screenshots, and metadata. Data subjects may include Customer’s end users, visitors, customers, employees, and authorised users. Customer should configure collection to avoid unnecessary personal data, including sensitive information in messages and screenshots.

Optional AI Reports process selected feedback only when an authorised user requests a report. Administrators can disable them. PushFeedback does not use Customer Content to train AI models or authorise its AI providers to do so. AI providers processing Customer Personal Data are subject to section 4.

3. Confidentiality and security

PushFeedback will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations and process it only on documented instructions, unless EU or Member State law requires otherwise. PushFeedback will implement and maintain technical and organisational measures appropriate to the risk, including measures described in our security overview. We may update those measures as technology and the Services evolve, provided the overall level of protection is not materially decreased.

4. Sub-processors

Customer generally authorises subprocessors. See the current list. We give at least 30 days’ advance notice of additions or replacements by email or another direct written notice that Customer can retain and update the list. Customer may object during that period on reasonable data-protection grounds.

We will reasonably seek a resolution. If unresolved, Customer may terminate affected Services before the new provider processes Customer Personal Data, with a pro-rata refund of prepaid unused fees for those Services. Written subprocessor duties will be no less protective for the relevant processing. PushFeedback remains responsible for their compliance.

5. Assistance

Taking account of the processing and available information, we will reasonably assist with rights requests, security, impact assessments and authority consultations as required by GDPR Article 28. Customer handles responses and assessments. We promptly refer requests about Customer Personal Data to Customer and respond substantively only on instructions or where legally required.

Material work beyond standard Services may incur reasonable fees agreed in advance, except where caused by our breach. Fees cannot prevent or delay legally required assistance.

6. Personal Data Breaches

PushFeedback will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Content and will provide information reasonably available to us to help Customer meet its obligations. PushFeedback will investigate, contain and mitigate the breach and provide further relevant information as it becomes available. Notices will describe the breach, affected data and people where known, likely consequences, measures taken or proposed, and a contact for follow-up. Customer is responsible for determining whether a notification to an authority or affected individuals is required.

7. Audits and information

We provide information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by Customer or its independent auditor bound by confidentiality. Routine audits are limited to once a year, on at least 30 days’ written notice during business hours without unreasonable disruption. Earlier or additional audits remain available where required by law or an authority, or reasonably necessary to investigate a breach or evidence of material non-compliance.

Use documentation and remote review first where sufficient, without blocking necessary inspections. Auditors must have appropriate expertise, no conflicts and protect others’ data. Customer pays its auditor’s costs. Supervisory authorities retain their statutory powers.

8. International transfers

Processing outside the EEA requires a valid transfer mechanism, with necessary supplementary measures. Required Standard Contractual Clauses must be executed or validly incorporated with completed annexes. This DPA does not replace that documentation. Relevant safeguards are available on request, subject to reasonable confidentiality.

9. Return and deletion

After Services end, Customer chooses return or deletion and may export through available tools beforehand. We carry out that choice and delete existing copies within 60 days after termination unless law requires retention. Backup copies remain isolated and protected until normal rotation deletes them, without ordinary service use. Disaster recovery must reapply deletion instructions. Legal retention is limited to its required purpose and remains protected. We confirm deletion on reasonable written request.

10. Aggregated data and liability

PushFeedback may use aggregated service statistics independently only when they are anonymised so that neither Customer, its users nor Customer Content can be identified. Data that is only pseudonymised remains Customer Personal Data and subject to this DPA.

The agreement’s liability limits apply between the parties to the extent permitted by law. They do not limit data subjects’ statutory rights or supervisory authorities’ powers. If this DPA conflicts with the Terms of Service on processing Customer Personal Data, this DPA prevails. Applicable Standard Contractual Clauses prevail over conflicting terms.

11. Contact

Volcanic Labs SLU

Plaza de Galicia, Local 7, 38612, Santa Cruz de Tenerife, Spain

[email protected]