Effective date: 31 October 2026
This Data Processing Agreement ("DPA") forms part of the TrustCookies Terms and Conditions (the "Terms") between the customer that has accepted the Terms (the "Customer") and Vishnuraam S, an individual carrying on business as a sole proprietor under the trade names HextonHQ and TrustCookies, with his principal place of business at 3rd Floor, Door No. 1-60/8/A and B, KNR Square, Opp. The Platina, Gachibowli, Hyderabad, Rangareddy District, Telangana — 500032, India (the "Processor", which includes any successor under clause 12). It takes effect when the Customer accepts the Terms and needs no separate signature. Where the Customer has signed an Order Form, this DPA applies to it as well. Capitalised terms not defined here have the meaning given in the Terms.
1. Definitions and roles
1.1 Definitions.
- "Applicable Data Protection Law" — every law on the protection of personal data that applies to the processing under this DPA, which may include India's Digital Personal Data Protection Act, 2023 and the rules under it ("DPDP Act"), Regulation (EU) 2016/679 ("EU GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the California Consumer Privacy Act as amended ("CCPA"), each to the extent it applies.
- "Customer Personal Data" — personal data processed by the Processor on the Customer's behalf in providing the Service, as described in clause 2.
- "controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the EU GDPR; under the DPDP Act, "controller" means Data Fiduciary, "processor" means Data Processor and "data subject" means Data Principal; under the CCPA, "processor" means "service provider".
1.2 Roles. The Customer is the controller of Customer Personal Data and the Processor processes it on the Customer's behalf. Where the Customer is itself a processor for a third party, the Customer warrants that it is authorised to appoint the Processor as its sub-processor, and the Processor acts as the Customer's sub-processor.
1.3 Customer's decisions. The Customer determines the purposes and means of the processing: the Websites on which the Service runs, the consent categories, the jurisdiction rules, the banner text, which technologies are gated, and the retention resulting from its subscription. The Processor acts only on the Customer's documented instructions, which comprise the Terms, this DPA, any Order Form, the Customer's Configuration and the Customer's use of the Service's functions (including export and erasure).
1.4 Processor acting as controller. If the Processor determines the purposes and means of any processing, it acts as a controller for that processing only, and this DPA does not apply to it (clause 11).
2. Details of the processing
| Subject matter | Provision of the TrustCookies consent management Service |
| Duration | The term of the Terms, plus the export and deletion periods in clause 9 |
| Nature and purpose | Presenting the Customer's consent banner to End Users; collecting, recording, storing and making available End Users' consent decisions; applying the jurisdiction rules the Customer configured; sending consent signals to tags the Customer configured; scanning the Customer's Websites at the Customer's request; supporting the Customer's export, lookup and erasure |
| Personal data stored in the consent record | A pseudonymous subject reference (a keyed hash of a random identifier stored in the End User's browser, under a per-subject salt held separately and deletable — clause 3.5); the consent decision (grants by category, origin, applicable regime, the End User's country and first-level region as resolved at the network edge, Global Privacy Control signal state, policy version, decision and recording times); the identifier and content hash of the Configuration in force; the version of the client-side component; the record's chain fields (sequence number and hashes) |
| Personal data processed transiently, not stored in the consent record | The End User's full IP address and the request's user-agent string, processed at the network edge on each request to resolve country and first-level region, and for the edge provider's own security, rate-limiting and request logging (Annex C, row 1) |
| Personal data held on the End User's device | The signed consent receipt and any pending decision, in the browser's local storage for the Customer's Website, under the Customer's control as first-party storage |
| Scans of the Customer's Websites | The scanner loads public pages of the Customer's Websites at the Customer's request and records the cookies, storage and network requests observed. Where those pages display personal data, the scanner may encounter it while loading the page; scan results record technologies, not End User personal data |
| Categories of data subjects | End Users of the Customer's Websites |
| Special categories | None. The Service is not designed for, and must not be configured to process, special-category data, criminal-offence data or children's data beyond the consent choices it records |
| Frequency | Continuous, for each page view on which the Runtime Script runs |
2.1 No IP address in the consent record. The consent record contains the End User's country and first-level region, not the IP address — whether raw, truncated or hashed. The parties acknowledge that the pseudonymous subject reference and the consent record are nevertheless pseudonymised personal data, not anonymous data, and fall within this DPA. Neither party will state that the Service stores "no personal data" or "never processes the IP address".
3. Processor obligations
The Processor will:
3.1 Instructions. Process Customer Personal Data only on the Customer's documented instructions, including on transfers, unless required otherwise by law, in which case it will inform the Customer first unless the law prohibits that.
3.2 Confidentiality. Ensure that persons authorised to process Customer Personal Data are bound by confidentiality.
3.3 Security. Implement the technical and organisational measures in Annex A.
3.4 Sub-processors. Respect the conditions in clause 5.
3.5 Data subject requests. Taking account of the nature of the processing, assist the Customer by appropriate technical and organisational measures in responding to data subjects' requests. The Service provides lookup, export and erasure of consent records in the dashboard. Where a function is not available there, the Processor will carry out a documented Customer instruction within five (5) business days. Lookup is by consent receipt or decision identifier only: the Service holds no name, email address, account identifier or IP address by which an End User could be found, and the Customer will not instruct a lookup by any such means. Erasure deletes the per-subject salt from which the End User's pseudonymous subject reference is derived and removes the subject reference from every consent record that carried it. The records themselves remain as unlinkable, hash-chained records, so that the Customer's evidence that a consent decision was taken at that time under that policy survives (clause 9.5). The End User's device copy of the receipt is cleared through the preference centre; an erasure instructed through another channel cannot reach the device. If a data subject contacts the Processor directly, the Processor will refer them to the Customer and will not respond to the request itself, except to say so.
3.6 Assistance. Assist the Customer with its obligations on security, personal data breach notification, data protection impact assessments and prior consultation, taking account of the nature of the processing and the information available to the Processor.
3.7 Deletion or return. At the end of the Service, at the Customer's election, make Customer Personal Data available for export and then delete it, as set out in clause 9.
3.8 Information and audits. Make available the information necessary to demonstrate compliance with this DPA and allow and contribute to audits under clause 8.
3.9 Infringing instructions. Inform the Customer without undue delay if the Processor becomes aware, in the course of providing the Service, that an instruction infringes Applicable Data Protection Law. The Processor does not monitor, review or audit the Configuration for this purpose, gives no opinion on its adequacy, and this clause creates no obligation of review.
3.10 No use for the Processor's own purposes. Not use Customer Personal Data — including consent records and scan results — for its own advertising, profiling, analytics, product marketing, training of artificial-intelligence models, or any other purpose of its own; not combine it with personal data the Processor holds as a controller; and not sell or share it (as those terms are used in the CCPA). The Processor will comply with the CCPA's requirements for service providers to the extent it applies, and will notify the Customer if it can no longer meet them.
3.11 Records. Keep the records of processing that Applicable Data Protection Law requires of a processor.
4. Customer obligations
4.1 The Customer warrants that it has a valid legal basis (including, where needed, valid consent) for the processing it instructs, and that it has given End Users all required notices, including identifying the Processor's role where the law requires.
4.2 The Customer's documented instructions are given through its Configuration, which the Customer alone decides. As set out in Terms clause 3.3, the Customer is solely responsible for identifying, listing and correctly categorising every cookie, storage item, script, pixel, tag and request on every page of its Websites; installing the Service correctly on every page; testing and verifying, after installation and after every change, that consent is collected and that each item is controlled; and re-categorising and re-verifying when anything changes. The Processor does not review, approve or verify the Configuration. Its scanner, checks and suggestions are aids and do not transfer any of these responsibilities (Terms clause 3.5). Processing that follows from the Customer's Configuration, including any item the Customer has not listed or categorised, is processing on the Customer's instructions.
4.3 The Customer will not instruct the processing of special-category data, criminal-offence data, children's data beyond what the Service is designed to record, or any data outside clause 2.
4.4 The Customer is responsible for its own privacy notice and cookie notice, and for responding to data subjects.
4.5 The Customer's instructions must comply with Applicable Data Protection Law.
5. Sub-processors
5.1 The Customer gives general written authorisation for the Processor to engage sub-processors. The current list is Annex C, also published at https://trustcookies.com/subprocessors.
5.2 The Processor will give at least thirty (30) days' notice, by email or in the dashboard, before adding or replacing a sub-processor of Customer Personal Data, including before engaging any Annex C row marked "not engaged".
5.3 The Customer may object on reasonable data protection grounds within fourteen (14) days of the notice. If the parties cannot resolve the objection, the Customer may terminate the affected subscription without penalty before the change takes effect, and the Processor will refund the Fees prepaid for the unused part of the current Subscription Period.
5.4 The Processor will impose on each sub-processor, by written contract, data protection obligations offering at least the same level of protection as this DPA, and remains liable to the Customer for each sub-processor's performance of its obligations as Applicable Data Protection Law requires. Subject to that requirement, the limitations in the Terms apply.
6. Location of processing and international transfers
6.1 Location. The Processor is established in India. Consent records, subject salts, receipt keys, Configurations and the audit log are stored in the European Union — the one storage region in service at the effective date. Requests from End Users' browsers are processed transiently on the edge provider's network at the location nearest the End User and written only to that storage region. The Processor's personnel access stored data remotely from India for support, export, erasure and operation of the Service. Additional storage regions, when offered, will be added to Annex C by notice under clause 5.2.
6.2 DPDP Act. Transfers of Customer Personal Data outside India are made in accordance with the DPDP Act and any restriction notified under it.
6.3 EU, UK and Swiss transfer terms — to the extent applicable. To the extent that Customer Personal Data is subject to the EU GDPR, the UK GDPR or the FADP and its processing under this DPA involves a transfer to a country that does not ensure an adequate level of protection, and no other transfer mechanism or exemption applies, the parties agree that:
(a) the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the "SCCs") are incorporated into this DPA by reference — Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor — with the Customer as data exporter and the Processor as data importer, and completed as set out in Annex B;
(b) for transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (the "UK Addendum") is incorporated, completed as set out in Annex B; and
(c) for transfers subject to the FADP, the SCCs apply with the amendments set out in Annex B.
Nothing in this clause is an acknowledgement by either party that any of those laws applies to it or to a particular transfer. If the SCCs, the UK Addendum or the Swiss amendments apply and conflict with this DPA, they prevail to the extent of the conflict.
6.4 Transfer impact assessment. The Processor will provide reasonable information to help the Customer assess a transfer, on request.
7. Personal data breach
7.1 The Processor will notify the Customer without undue delay and in any event within forty-eight (48) hours after becoming aware of a personal data breach affecting Customer Personal Data. "Becoming aware" means the Processor's actual awareness; there is no 24/7 monitoring (Annex A).
7.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and will be supplemented as more information becomes available.
7.3 The Processor will assist the Customer with its own notification obligations. The Customer is responsible for notifying its supervisory authority, the Data Protection Board of India where applicable, and affected data subjects, unless the law requires the Processor to notify directly.
8. Audits
8.1 The Processor will make available the information reasonably necessary to demonstrate compliance with this DPA, including the full description of its technical and organisational measures, on request.
8.2 Where that information is not sufficient, the Customer (or an independent auditor bound by confidentiality and not a competitor of the Processor) may audit the Processor once in any twelve (12) months, and additionally after a personal data breach or where a supervisory authority requires it, on thirty (30) days' written notice, during business hours, without unreasonable disruption, and at the Customer's cost — unless the audit reveals material non-compliance, in which case the Processor bears its own reasonable costs of the audit.
9. Retention, deletion and erasure
9.1 Retention. Consent records are retained for the term of the Customer's subscription plus the Export Period in clause 9.2. The Service does not offer per-record retention settings: records are appended to a per-Website, hash-chained log and are deleted as a whole per Website, not individually.
9.2 Export and deletion. During the subscription the Customer may export its consent records from the dashboard. For thirty (30) days after the Customer's Account is closed or terminated, or a Website is removed (the "Export Period"), the Processor will provide an export on written request. After the Export Period the Processor will delete the affected consent records, subject salts, receipt keys and Configurations within ninety (90) days, and from backups in the ordinary backup cycle stated in Annex A.
9.3 Consent records are evidence. The parties acknowledge that deleting consent records may remove the Customer's ability to demonstrate consent. Deletion instructions are the Customer's decision and at the Customer's risk.
9.4 Legal retention. The Processor may retain Customer Personal Data where required by law, subject to continued protection under this DPA.
9.5 Erasure is not deletion. Erasure under clause 3.5 removes the personal segment of the affected records and the salt that linked them to the End User; the records remain as unlinkable, hash-chained evidence that a consent decision was taken, and the chain continues to verify. Whole-record deletion is available only under clause 9.2.
10. Liability
10.1 The limitations and exclusions in the Terms apply to claims under this DPA to the fullest extent permitted by law.
10.2 Nothing in this DPA limits either party's liability to a data subject or a supervisory authority under Applicable Data Protection Law, or any liability that cannot be limited by law.
11. Processing for the Processor's own purposes
The Processor acts as a controller, not under this DPA, for: account, billing and support data of the Customer's personnel; security and abuse-prevention logs of the Service; and statistics about the Service's use and performance that identify no End User. Its Privacy Policy governs that processing. Clause 3.10 continues to apply: none of this processing uses Customer Personal Data for the Processor's own advertising, profiling or other purposes.
12. Transfer to a successor processor
12.1 The Processor intends to transfer the TrustCookies business to a limited liability partnership or company formed or controlled by Vishnuraam S, and may later transfer it to another successor to all or substantially all of that business (each a "Successor").
12.2 The Customer agrees that this DPA, and the processing of Customer Personal Data under it, may be transferred to a Successor on at least thirty (30) days' notice under Terms clause 21.3, provided the Successor agrees in writing to be bound by this DPA (including any SCCs, UK Addendum and Swiss amendments then in force between the parties) on the same terms. From the transfer date the Successor is the Processor, Customer Personal Data stays in the same storage region and with the same sub-processors unless clause 5 is followed, and the Customer need not sign or accept anything again.
12.3 If the Customer objects, it may terminate the affected subscriptions before the transfer date, with the refund in Terms clause 21.3(c).
13. End Users in the EEA, the UK and Switzerland
The Processor does not currently accept customers established or resident in the European Economic Area, the United Kingdom or Switzerland (Terms clause 1.6). Customers outside those territories may use the Service on Websites visited by End Users in them. For those End Users the Processor acts solely as the Customer's processor (or sub-processor), has no direct relationship with them, processes only the data listed in clause 2, and applies clause 6.3 to the extent applicable.
14. General
14.1 If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA prevails; clause 6.3 and Annex B prevail over both as stated there.
14.2 This DPA is governed by the laws of India and the courts at Hyderabad, Telangana, India have jurisdiction, as in the Terms, except where Applicable Data Protection Law or the SCCs require otherwise.
14.3 The Processor may update this DPA to reflect changes in law, guidance or the Service, on the notice set out in Terms clause 19, provided the update does not reduce the overall protection of Customer Personal Data.
Annex A — Technical and organisational measures (summary)
A fuller description is provided to Customers on request (clause 8.1). Where a measure is limited, this summary says so.
| Area | Measure |
|---|---|
| Encryption in transit | TLS on every public endpoint, terminated by the edge provider; connections between the edge provider and the Processor's servers use TLS or an encrypted tunnel. Plain HTTP is not served |
| Encryption at rest | The database server's volume is not encrypted at rest beyond the data centre's physical security; off-host backup copies are encrypted before they leave the server. Per-Website receipt signing keys are additionally encrypted by the Service under a key held only in the edge provider's secret store |
| Pseudonymisation and minimisation | The only per-End-User field in a consent record is a keyed hash of a random browser identifier under a per-subject salt stored separately. No IP address (raw, truncated or hashed), user agent, name, email address or account identifier is written to a consent record. The salt is deletable, which makes the reference permanently unlinkable |
| Access control | Dashboard users sign in individually; two-factor authentication is available; organisation roles (owner, admin, member) limit what each user can do. Administrative operations by the Processor use separately authenticated credentials. The database enforces separate roles: the application role can only append consent records and cannot update or delete them; a separate role performs erasure. |
| Tenant isolation | Row-level security, enforced for all database roles including the table owner, separates each customer's data; consent records are partitioned per Website. Automated tests assert on every change that a cross-tenant read returns no rows |
| Audit logging | Changes to organisations, Websites, memberships, configurations, key rotation and erasure are written to an append-only audit table with actor, action and time |
| Integrity of consent records | Records are append-only by database permission and hash-chained per Website; each End User decision is acknowledged with a receipt signed by a per-Website Ed25519 key, which the browser verifies. Exports can be verified offline with a verification tool the Processor provides on request. The Service periodically anchors a digest of the log to a public timestamping service (OpenTimestamps). These measures are described as hash-chained, signed and anchored; they are not a guarantee against alteration by a party controlling the database between anchors |
| Backups and restore | Continuous write-ahead-log archiving and a daily base backup, retained fourteen (14) days on the database server itself; restore procedure documented. An encrypted off-host copy is kept in Cloudflare R2 object storage under EU jurisdiction (Annex C, row 1) (since 10 October 2026). A restore drill from production backups on the database server passed on 8 October 2026 and is repeated monthly. No RTO or RPO is committed |
| Availability behaviour | During an outage the client-side component fails closed: no category is released because of a failure (Terms clause 4.5) |
| Testing | An automated test suite is run before every change is merged, covering the API contract, row-level security and append-only permissions, receipt and chain verification (including altered-record cases), and fail-closed behaviour |
| Incident response | Documented procedure; detection by the Processor's operator during business hours and by Customer report. No 24/7 on-call and no automated alerting |
| Personnel | Written confidentiality obligations on every person with access. One operator has production access at the effective date |
| Known limitations | No SOC 2, ISO 27001 or other certification. No penetration test or independent security audit to date. No 24/7 on-call, no committed RTO/RPO. Single storage region. Single operator |
Annex B — Transfer terms (applies only to the extent clause 6.3 applies)
B.1 SCCs — selections.
| SCC clause | Selection |
|---|---|
| Modules | Module Two (Customer = controller); Module Three (Customer = processor) |
| Clause 7 (docking) | Included |
| Clause 9(a) (sub-processors) | Option 2, general written authorisation; notice period as in DPA clause 5.2 (30 days) |
| Clause 11(a) (redress) | Optional language not included |
| Clause 13 (supervision) | The supervisory authority determined under Clause 13(a) for the data exporter; where the data exporter is not established in an EU member state and has not appointed a representative under Art 27 GDPR: the Data Protection Commission (Ireland). |
| Clause 17 (governing law) | The law of Ireland. |
| Clause 18 (forum) | The courts of Ireland. |
B.2 Annex I.A — Parties. Data exporter: the Customer, as identified in its Account (contact: the Account owner); role: controller (Module Two) or processor (Module Three); activities: use of the Service. Data importer: the Processor, as identified in the preamble (contact: support@trustcookies.com, subject line "Privacy request"); role: processor (Module Two) or sub-processor (Module Three); activities: provision of the Service. Signature and date: by the Customer's acceptance of the Terms.
B.3 Annex I.B — Description of the transfer. As in DPA clause 2. Transfer occurs continuously, by remote access from India to data stored in the European Union and by transit through the edge provider's network. Retention: DPA clause 9. Transfers to sub-processors: Annex C.
B.4 Annex I.C — Competent supervisory authority. As selected for Clause 13 above.
B.5 Annex II — Technical and organisational measures. Annex A of this DPA.
B.6 Annex III — Sub-processors. Annex C of this DPA.
B.7 UK Addendum. Table 1: parties as in B.2. Table 2: the SCCs, modules and selections in B.1, as incorporated by this DPA. Table 3: Annexes as in B.2–B.6. Table 4: either party may end the UK Addendum as set out in its Section 19.
B.8 Swiss amendments. For transfers subject to the FADP: references to the EU GDPR are read as references to the FADP; the competent supervisory authority is the Federal Data Protection and Information Commissioner; "member state" in Clause 18(c) includes Switzerland so that data subjects there may bring claims at their place of habitual residence.
Annex C — Sub-processors (as at 31 October 2026)
Sub-processors of Customer Personal Data
| # | Sub-processor | Purpose | Personal data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|---|
| 1 | Cloudflare, Inc. (USA) | Edge network and TLS; the consent API (Workers); database connection pooling; tunnels to the Processor's servers; secret store for key-encryption keys; Workers logs; encrypted off-host backup copies of the database in object storage (R2, EU-jurisdiction bucket) | Full IP address and user agent transiently on every request; country/region derived from them; consent request bodies in transit; Cloudflare's request metadata and logs; encrypted backup copies of everything in clause 2's "stored" row (encrypted before upload; Cloudflare holds no decryption key) | Processing at the edge location nearest each End User; Cloudflare's logs and request metadata may be processed in the United States and other countries | Cloudflare Data Processing Addendum, incl. SCCs and UK Addendum | Engaged |
| 2 | Contabo GmbH (seat: Munich, Germany) — virtual private server | Infrastructure hosting for the database the Processor operates (consent ledger, salts, wrapped keys, configurations, audit log, backups), the scanner service and the dashboard. Contabo does not administer the database and has no logical access to it | Everything in clause 2's "stored" row, at rest | European Union (Contabo "Hub Europe" location) | Contabo data processing agreement; no third-country transfer | Engaged |
| 3 | OpenTimestamps public calendar servers (no processor relationship; listed for transparency) | Anchoring of digests of each Website's log | A hash only; no personal data | Public network | None required | Engaged |
Providers that never receive Customer Personal Data (the Processor's own controller-side vendors, governed by the Privacy Policy, not by this DPA): the payment gateway we use for checkout; the transactional email provider we use for account and billing notices, once engaged; Cloudflare Turnstile for the website's free scanner; and the analytics and advertising tools on trustcookies.com (Google and Microsoft, and Meta and LinkedIn if we use their advertising tags). No End User data from the Customer's Websites is ever sent to any of them.
Also disclosed (not sub-processors): the Processor's own personnel access stored data remotely from India (clause 6.1); the c15t open-source consent engine runs on the End User's device only and sends nothing to its authors.