Article 28 GDPR agreement for personal data that may incidentally appear in scan evidence, with Annexes I–III.
Copyright © 2026 Safe and Informed S.R.L. All rights reserved.
This Data Processing Agreement ("DPA") is concluded under Article 28 of Regulation (EU) 2016/679 (the "GDPR") between:
It forms part of the ConsentVeil Monitor Terms of Service (the "Terms") and applies from the moment the Order is confirmed. Capitalised terms not defined here have the meaning given in the Terms. "Controller", "Processor", "Subprocessor", "Personal Data Breach" and "data subject" have the meanings given in the GDPR. The parties may also sign this DPA as a separate document at the Customer's request.
1.1 This DPA governs the personal data Safe & Informed processes on behalf of the Customer when providing ConsentVeil Monitor (the "Service"). The details are set out in Annex I.
1.2 The Service scans public pages of the Customer's verified Website. The technical evidence of a scan (request URLs, methods and resource types; browser console errors, counted and sampled; cookie and storage keys with their attributes and value lengths; the visible behaviour of consent controls; the state of IAB TCF and Google Consent Mode signals as counts and flags; screenshots of public pages) may incidentally contain personal data, for example a name visible on a public page ("Scan Data"). For Scan Data, Safe & Informed acts on the Customer's instructions.
1.3 This DPA does not apply to personal data for which Safe & Informed is itself the controller (order correspondence, verification record, exclusion register, invoicing data). That processing is described in the Monitor Privacy Policy.
1.4 Roles. The Customer acts as Controller or Processor, as applicable. Safe & Informed acts as Processor where the Customer is Controller and as Subprocessor where the Customer processes the Scan Data on behalf of another controller. A Customer acting as Processor confirms that it is authorised to appoint Safe & Informed and to issue the instructions contained in the Order and this DPA. In either case the Customer is Safe & Informed's sole point of contact, and references in this DPA to the Customer's obligations as controller apply, where the Customer is a Processor, to the obligations the Customer owes to its own controller.
This DPA applies for as long as Safe & Informed holds Scan Data for the Customer, including the retention period after delivery until deletion under section 10.
3.1 Safe & Informed processes Scan Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which Safe & Informed is subject. In that case Safe & Informed informs the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
3.2 The Customer's instructions are: the Terms, this DPA, the Order (Website, pages, browsers and locales agreed) and any further written instruction agreed between the parties. The Methodology describes how instructions are carried out.
3.3 Safe & Informed informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data-protection provisions, and may suspend the instruction concerned until the Customer confirms or amends it. The Customer's confirmation does not authorise an instruction that is in fact unlawful; Safe & Informed does not carry out an instruction it knows to be unlawful, and the Customer remains responsible for the lawfulness of its instructions.
3.4 Safe & Informed does not use Scan Data for its own purposes, does not combine it with data of other customers and does not use it to profile website visitors. Safe & Informed may use Scan Data to investigate and correct the Customer's specific scan only as necessary to perform the Service and under the Customer's documented instructions. General product development uses synthetic data or data that has first been irreversibly anonymised.
Safe & Informed ensures that persons authorised to process Scan Data have committed themselves to confidentiality and process Scan Data only on instructions and only to the extent needed for their role.
5.1 Safe & Informed implements the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, as required by Article 32 GDPR.
5.2 Safe & Informed may update Annex II provided the level of protection is not reduced. The current version is available at the published URL of this DPA.
5.3 The Customer is responsible for choosing which pages are scanned, and for not ordering a scan of pages that display more personal data than necessary where that is avoidable.
6.1 The Customer gives Safe & Informed general written authorisation to engage the sub-processor listed in Annex III. The current sub-processor list is provided before the Order is accepted and remains available at https://www.zoho.com/privacy/sub-processors.html (Zoho's list, which is the only further-sub-processor list applicable to Scan Data) and in Annex III.
6.2 Safe & Informed will notify the Customer of intended additions or replacements at least 15 days in advance, by e-mail to the address the Customer ordered from, allowing a reasonable opportunity to object. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the Order or subscription with a refund of any prepaid fees for work not yet performed. This is the contractual resolution of an unresolved objection to a proposed sub-processor; it does not limit mandatory rights or remedies for breach of this DPA.
6.3 Safe & Informed imposes on each sub-processor, by contract, data-protection obligations equivalent to those in this DPA. Where a sub-processor fails to fulfil its obligations, Safe & Informed remains fully liable to the Customer for the performance of that sub-processor's obligations.
6.4 Payment is by bank transfer against invoice at the date above. A payment provider, where Safe & Informed later offers a hosted card payment link, is not a sub-processor of Scan Data. It receives payment data only. The provider's role depends on the processing purpose. It may act on our instructions for payment services and as an independent controller for purposes described in its own notice, including legal compliance and fraud prevention. Where a merchant of record is used, it is identified before purchase. No payment provider receives Scan Data under this arrangement.
7.1 Taking into account the nature of the processing, Safe & Informed assists the Customer, insofar as this is possible, in fulfilling the obligation to respond to requests for exercising data subject rights under Chapter III GDPR. The Customer may request assistance at [email protected]; Safe & Informed responds within 10 business days.
7.2 If a data subject contacts Safe & Informed directly about Scan Data, through any reasonable channel, Safe & Informed does not respond on the merits but forwards the request to the Customer without undue delay, unless the law requires otherwise, and tells the data subject that it has done so.
7.3 Information to data subjects. The information to be provided to data subjects under Articles 13 and 14 GDPR in respect of Scan Data is provided by the Customer or by the controller on whose behalf the Customer acts, not by Safe & Informed. Safe & Informed assists by making this DPA, Annex I, Annex II and the Methodology available for inclusion or reference in the controller's notices, and by forwarding requests under section 7.2.
8.1 Safe & Informed will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Scan Data, with an operational target of notification within 24 hours. Information not initially available may be supplied in phases without undue further delay.
8.2 The notification is sent by e-mail to the address the Customer ordered from and contains, to the extent known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact.
8.3 Safe & Informed assists the Customer in meeting its obligations under Articles 33 and 34 GDPR by providing the information it holds. Safe & Informed does not notify the supervisory authority or data subjects on the Customer's behalf unless instructed to.
Taking into account the nature of the processing and the information available to it, Safe & Informed assists the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36 GDPR: security of processing (Article 32), notification of a Personal Data Breach to the supervisory authority (Article 33) and communication to data subjects (Article 34), data protection impact assessments (Article 35) and prior consultation (Article 36). The Methodology, this DPA, Annex II and the information provided under section 8 are made available for that purpose.
10.1 Safe & Informed retains Scan Data and its own copies of Reports for 12 months after delivery of the Report. This retention supports the dispute procedure in the Terms and the Customer's ability to compare successive Reports; the Customer may shorten it by written instruction at any time. Scan Data and Safe & Informed's copies of Reports are deleted through a documented monthly process once the retention period expires, and no later than 31 days after expiry. The process covers local working folders, sent-e-mail copies and other copies under Safe & Informed's control. Backup copies, where made, are unavailable for ordinary use, expire within 35 days of the day the data was deleted from the working copy, and are re-deleted if restored.
10.2 At the end of the provision of the Service involving Scan Data, Safe & Informed will, at the Customer's choice, either return the remaining Scan Data in a commonly used electronic format and then delete its copies, or delete the Scan Data and confirm deletion in writing, unless Union or Member State law requires continued storage. Delivery of the Report constitutes return only of the Scan Data contained in that Report. If the Customer does not communicate a choice, deletion under section 10.1 applies.
10.3 At the Customer's written request at any earlier time, Safe & Informed returns the Scan Data in a commonly used electronic format, deletes it, or both, as the Customer chooses, and confirms deletion in writing. A valid return or early-deletion request is completed within 30 days for copies under Safe & Informed's control. Safe & Informed returns or deletes Scan Data on the Customer's documented instruction within that period, except where Union or Member State law requires storage. Any retention separately necessary for Safe & Informed's own legal obligations or a specific legal claim is limited to identified records, assessed and documented under Safe & Informed's controller responsibilities, and disclosed to the Customer with its purpose, legal basis and retention period. It is not a general right to retain Scan Data after a deletion instruction. Backup copies are subject to the 35-day limit in section 10.1, which runs from the day the data was deleted from the working copy.
11.1 Safe & Informed will provide the information reasonably necessary to demonstrate compliance with this DPA and will allow and contribute to audits, including inspections, by the Customer or an independent auditor mandated by the Customer.
11.2 Audits must be proportionate, subject to reasonable advance notice, confidentiality and security requirements, and normally begin with documentary evidence and remote review. These conditions do not prevent an inspection where reasonably necessary or required by law.
11.3 The documentary evidence consists of this DPA, Annex II, the Methodology, the current sub-processor list, the deletion records and written answers to the Customer's reasonable questions, which Safe & Informed provides within 20 business days.
12.1 The liability of each party under this DPA is subject to the limitations and exclusions of the Terms, except where the GDPR or other mandatory law provides otherwise. Nothing in this DPA limits a data subject's rights under Article 82 GDPR.
12.2 In case of conflict between this DPA and the Terms, this DPA prevails for the processing of Scan Data.
12.3 Safe & Informed may update this DPA to reflect changes in law, guidance of supervisory authorities or the Service, with at least 30 days' notice by e-mail, provided the level of protection is not reduced. Other amendments require written agreement.
This DPA is governed by the laws of Romania and the courts of Bucharest, Romania have jurisdiction, without prejudice to Article 79 GDPR and to the rights of data subjects. The competent supervisory authority for Safe & Informed is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).
Safe and Informed S.R.L. Aleea Slt. Adrian Cârstea, Nr. 13, Bl. 37, Sc. 2, Et. 8, Ap. 141, Sector 3, Bucharest, Romania Email: [email protected]
A. Subject matter. Scanning of public pages of the Customer's verified Website to observe their technical behaviour before, during and after a consent choice, and storage of the resulting Findings and evidence until deletion.
B. Nature of the processing. Loading public pages, one at a time, in isolated automated browsers on Safe & Informed's own equipment (Chromium runs only as Playwright's bundled headless shell; WebKit is supported; Firefox is used only where available, included in the Order and passing the required startup checks; browser-channel and executable-path overrides are refused); clicking consent controls inside those browsers, opening the banner's settings layer and pressing keyboard keys to measure operability without a mouse (toggles are read, never changed), reading the state of IAB TCF and Google Consent Mode signals as counts and flags; observing request URLs, methods and resource types, browser console errors (counted and sampled), cookies and storage keys with their attributes and value lengths, and the visible behaviour of consent controls; taking screenshots of public pages as rendered; applying the redaction rules to the target URL, the Findings, the refused requests and the records of the outbound-request guard before any report file is written, with header values, cookie values and storage values never included; reviewing the results by hand; producing and delivering a PDF Report; deleting evidence at the end of the retention period. The scanner does not modify source code, CMS content or server configuration. Ordinary page loads and interactions with consent controls may create server or CDN logs, cookies, consent records, analytics events or similar operational records on the Customer's side. The scanner does not sign in, create accounts, complete business forms or place orders, and does not authenticate into, circumvent or bypass paywalled or otherwise access-controlled areas.
C. Purpose of the processing. Providing the Customer with reproducible technical observations about the Website's consent and tracking behaviour, as ordered, so that the Customer (or the controller on whose behalf it acts) can make its own assessment and decisions.
D. Duration of the processing. From the start of the Scan until 12 months after delivery of the Report, plus the deletion period in section 10.
E. Categories of data subjects. Visitors of the Website whose data may appear in public page content or request URLs (in practice limited, because the scanner visits with a clean profile and no visitor session); the Customer's staff, authors or contributors whose names or images appear on public pages; staff of third-party providers whose identifiers appear in request data; any other person whose personal data is visible on a scanned public page.
F. Categories of personal data. Online identifiers in request URLs to the extent they survive redaction; content of public pages captured in screenshots (names, images, text, contact details visible to any visitor); technical metadata (host names, timestamps).
G. Special categories of data (Article 9 GDPR). None intended. The scanner visits only public pages and does not sign in. If a public page displays special categories of data, they may appear in a screenshot. The Customer must not order a scan of such a page unless there is a lawful basis for the resulting processing.
H. Frequency. At the frequency stated in the Order, including any included re-scan and agreed recurring runs.
I. Location of processing. Romania, on Safe & Informed's own equipment. The sub-processor's processing locations are stated in Annex III.
1. Storage on company devices only. Scan working files are stored only on company-managed devices protected by a login password, to which only named staff have access. No cloud evidence store is used.
2. Access limited to named staff. Only named Safe & Informed staff have access to the devices and the e-mail account that hold Scan Data. Access is removed on departure.
3. Redaction before writing. Header values, cookie values and storage values are not included in Reports at all; for cookies and storage only keys, attributes and value lengths are kept. Before any report file is written, the redaction rules are applied to the target URL, the Findings, the refused requests and the records of the outbound-request guard: query parameters not on an allowlist and path segments that look like e-mail addresses or long identifiers are replaced. The redaction rules are part of the Methodology and are covered by automated tests.
4. Outbound-request guard in the scanner. For HTTP and HTTPS requests intercepted by the browser-context route (the document, every frame, every sub-resource), supported request types are judged against the same rules as the scan target before the scanner fetches them: local, private, link-local and cloud-metadata addresses are refused, and a navigation of the page itself to another registrable domain is refused. Requests eligible for fetching are fetched by the scanner's own client with redirects disabled, so the browser does not make the connection; a redirect has its destination judged hop by hop before it is followed, and a refused hop is aborted before any connection and listed in the Report. Media, event-stream and unsupported request types are refused without fetching; WebSockets are refused separately; service workers are blocked. For requests eligible for fetching, hostname checks use fresh DNS resolution by default, and the scanner's client resolves the name again when it fetches. These are application-layer controls, not a complete browser-network sandbox or socket-level IP pinning: a name that answers differently to two consecutive lookups can still reach a different address than the one checked, and browser traffic outside these routing controls (WebRTC) is removed in every scanner context by a script whose required protections are verified on a startup probe, in the supported browser configurations only, and, on the documented server deployment, by host-level egress rules bound to the scanner's user that reject the listed prohibited address ranges while those rules remain intact. Chromium runs only as Playwright's bundled headless shell. WebKit is supported. Firefox is used only where available, included in the Order and passing the required startup checks. Browser-channel and executable-path overrides are refused. Engine settings supplement the checked initialisation protections where available.
5. Verification and exclusion register. The scanner refuses to run unless exactly one of the four verification methods described in the Terms (dns_txt, well_known_file, domain_email, written_order) has been recorded for the Website, and the Report names the method. Before every Scan, staff check the Website against the domain-exclusion register, and the scanner refuses an excluded domain.
6. Identified scanner traffic. The scanner uses a dedicated User-Agent header containing ConsentVeilMonitor/<version> (+https://www.safeandinformed.com/monitor), printed in every Report, so that the Website operator can recognise and, if needed, block Monitor traffic.
7. Documented deletion routine. Scan Data and Safe & Informed's copies of Reports are deleted through a documented monthly process once the 12-month retention period expires, or any shorter period the Customer instructs, and no later than 31 days after expiry, covering local working folders, sent-e-mail copies and other copies under Safe & Informed's control. Backup copies, where made, are unavailable for ordinary use, expire within 35 days of the day the data was deleted from the working copy, and are re-deleted if restored. Deletions are recorded.
8. Breach notification. The Customer is notified of a Personal Data Breach affecting Scan Data without undue delay, with an operational target of 24 hours, as set out in section 8.
| Sub-processor (legal name) | Registered address and contact | Purpose | Processing locations | Transfer mechanism |
|---|---|---|---|---|
| Zoho Corporation B.V. | Beneluxlaan 4B, 3527 HT Utrecht, The Netherlands; privacy contact: [email protected] | delivery of Reports and customer correspondence, mailbox storage | Primary mailbox storage and delivery in the European Union, using Netherlands and Ireland data centres in the zoho.eu region | Primary storage stays in the EU, so no transfer takes place for storage. Authorised Zoho personnel in India (Zoho Corporation Pvt. Ltd.) may access data for technical support under the Standard Contractual Clauses incorporated into Zoho's applicable data processing addendum and the supplementary safeguards in Zoho's documented transfer-impact assessment. A copy or a meaningful summary of these safeguards is available from Safe & Informed on request, subject to legitimate redactions. Zoho's current further-sub-processor list is available at https://www.zoho.com/privacy/sub-processors.html and a copy is retained with the order evidence. Zoho's sub-processors that would transfer data outside the EEA are disabled by default in the zoho.eu region and Safe & Informed does not enable them. Zoho has confirmed in writing that the mailbox is in its EU data centres, that access from India is covered by its SCC-based intra-group agreement, and has provided its transfer impact assessment (version of 24 April 2025, EDPB Recommendations 01/2020 steps, supplementary technical, organisational and contractual measures); both are retained with the order evidence. |
No other direct sub-processor processes Scan Data; Zoho may use group entities and further sub-processors as disclosed in its list. No payment provider is a sub-processor of Scan Data (section 6.4). The current sub-processor list is provided before the Order is accepted and remains available at https://www.zoho.com/privacy/sub-processors.html. Safe & Informed will notify the Customer of intended additions or replacements at least 15 days in advance, allowing a reasonable opportunity to object (section 6.2).