Data processing agreement

1. About this agreement

This data processing agreement (“DPA”) forms part of the terms of service between Edward William Francis Morris (ABN 12 483 583 778) of Melbourne, Victoria, Australia, who operates OnProd (“OnProd”, “we”), and the customer that accepted them (“you”). It applies whenever we process Customer Personal Data on your behalf. You accept it by accepting the terms; if you need a signed copy, e-mail [email protected] and we’ll countersign one.

If this DPA conflicts with the terms, this DPA applies to personal data. If it conflicts with the Standard Contractual Clauses, the Clauses apply.

2. Definitions

• Data Protection Laws means the laws that apply to the processing of Customer Personal Data under the terms, which may include the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs); the EU General Data Protection Regulation 2016/679 (GDPR); the GDPR as it forms part of UK law and the Data Protection Act 2018 (UK GDPR); the Swiss Federal Act on Data Protection (FADP); and US state privacy laws such as the California Consumer Privacy Act as amended (CCPA).
• Customer Personal Data means personal data (or personal information) in the data your sites send to OnProd, or that you put into your workspace, which we process on your behalf.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor means another processor we engage to process Customer Personal Data.
• Standard Contractual Clauses or Clauses means the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914.
• “Controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the GDPR; “business”, “service provider”, “sell” and “share” have the meanings given in the CCPA.

3. Roles and scope

You are the controller of Customer Personal Data and we are your processor. If you use OnProd for your own clients (for example on the Agency plan), you may be a processor for them; we are then your sub-processor, and you confirm that your clients have authorised this DPA, including our sub-processors. Annex 1 describes the processing.

This DPA does not cover the information we handle about you as our customer (account, billing and support information). We are the controller of that, as our privacy policy explains.

4. Instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise (in which case we tell you first, unless the law forbids it). Your instructions are:

• these terms and this DPA;
• how you set up OnProd: the sites you add, the script options you use (including masking and capture levels), your visitor privacy setting, allowed hosts and internal users, retention periods, whether AI Insights are on and which provider they use, and deletions you make;
• other written instructions you give us that are consistent with the terms.

We’ll tell you if we believe an instruction breaks Data Protection Laws. You are responsible for the lawfulness of your instructions and of the data your sites send, including giving notice to and getting any consent needed from your sites’ visitors, and for masking or blocking personal data that should not be recorded. You must not send special categories of personal data, or data about children, to OnProd.

5. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, and has access only to the extent needed for their role.

6. Security

We implement and maintain the technical and organisational measures in Annex 2. We may update them as technology and risks change, but never in a way that lowers the overall level of protection.

7. Sub-processors

• You give us general authorisation to engage the sub-processors listed on our sub-processors page.
• We’ll give at least [30] days’ notice before we add or replace a sub-processor, by updating that page and e-mailing workspace owners.
• You may object on reasonable data protection grounds within that notice period. We’ll then work with you in good faith on an alternative. If we can’t find one, you may end the affected part of the service and we’ll refund any prepaid, unused fees for it.
• We impose on each sub-processor, in a written contract, data protection obligations that protect Customer Personal Data at least as well as this DPA, and we remain responsible to you for their performance.

8. International transfers

We store and process Customer Personal Data in Australia, in the Amazon Web Services Sydney region (ap-southeast-2). It leaves Australia only to sub-processors on our sub-processors page, for the purposes listed there. Every request to OnProd passes in transit through Cloudflare’s network, at a data centre near the visitor or user that can be outside Australia. AI Insights evidence goes to Anthropic in the United States only when you choose the Anthropic API for a site.

• From the EEA: Australia does not have an adequacy decision, so transfers of Customer Personal Data subject to the GDPR to us are governed by the Standard Contractual Clauses, Module Two (controller to processor) or, where you are a processor, Module Three (processor to processor), which are incorporated into this DPA by reference. For the Clauses: the optional docking clause in Clause 7 applies; Clause 9(a) Option 2 (general written authorisation) applies with the notice period in section 7 above; the optional wording in Clause 11 does not apply; the supervisory authority under Clause 13 is the one competent for you; the Clauses are governed by the law of [Ireland] (Clause 17) and disputes go to the courts of [Ireland] (Clause 18); and Annexes I to III of the Clauses are completed by Annexes 1 to 3 of this DPA.
• From the United Kingdom: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies, with its tables completed by this DPA and the section above.
• From Switzerland: the Clauses apply as above, with the Swiss Federal Data Protection and Information Commissioner as the competent authority for transfers under the FADP, and references to “Member State” including Switzerland so that data subjects there can enforce their rights.
• Onward transfers: when a sub-processor processes Customer Personal Data in a country without adequate protection, we rely on the Standard Contractual Clauses (Module Three) or another transfer mechanism recognised by Data Protection Laws.

9. Assistance

• Data subject requests: OnProd lets you export a signed-in user’s data, delete the data of a signed-in user or of one browser (also through the deletion API), set retention periods and read your data through the API. If we receive a request about Customer Personal Data directly, we’ll pass it to you without undue delay and won’t answer it ourselves, except to tell the person to contact you. Where you can’t meet a request with these tools, we’ll help you, taking into account the nature of the processing.
• Impact assessments: we’ll give you reasonable information and help for data protection impact assessments and prior consultations with regulators that relate to OnProd.

10. Security incidents

• We’ll notify you without undue delay, and no later than [48] hours, after becoming aware of a Security Incident affecting your Customer Personal Data.
• Our notice will describe, as far as we know them, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. We’ll send more information as we learn it.
• We’ll take reasonable steps to contain the incident and limit its effects, and help you meet your own obligations, including assessing a suspected eligible data breach under the Notifiable Data Breaches scheme within 30 days and notifying a supervisory authority within 72 hours under the GDPR.
• We won’t notify regulators or data subjects about an incident affecting Customer Personal Data on your behalf without your agreement, unless the law requires us to.

11. Deletion and return

While you use OnProd, you can export Customer Personal Data through the read API and the per-user export, and delete it with retention periods, per-user deletion or by closing your workspace. When you close a workspace, we erase its Customer Personal Data 7 days later. [When the terms end in another way, we delete Customer Personal Data within [30] days.] Deleted data stays in our backups until they expire, as Annex 2 describes. We keep it longer only where the law requires it. We’ll confirm deletion in writing if you ask.

12. Audits

We’ll make available the information reasonably needed to show that we meet this DPA: this DPA, our security page, answers to reasonable security questionnaires, and the certifications and reports of our infrastructure provider (for example AWS’s SOC and ISO reports, available through AWS Artifact). If that is not enough, or a regulator requires it, you may audit our compliance once a year, at your cost, with at least [30] days’ notice, during business hours, without disrupting the service and under confidentiality, either yourself or through an independent auditor who is not our competitor.

13. Australian Privacy Act

For Customer Personal Data that is personal information under the Privacy Act 1988 (Cth), we handle it as if we were bound by the APPs in the same way you are, including APP 11 (security) and APP 8 (overseas disclosure: we disclose it overseas only to the sub-processors listed, under contracts consistent with the APPs). We tell you promptly about any suspected eligible data breach, so you can assess it and notify under the Notifiable Data Breaches scheme.

14. US state privacy laws

Where the CCPA or a similar US state law applies, we are your service provider (or processor). We will not sell or share Customer Personal Data; retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing OnProd as the terms describe; or combine it with personal information we get from others, except as those laws allow. We’ll meet the obligations those laws place on service providers, tell you if we can no longer do so, and let you take reasonable steps to stop and remedy unauthorised use.

15. Liability and term

Each party’s liability under this DPA is subject to the limits in the terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow liability to be limited [to be reviewed]. This DPA lasts as long as we process Customer Personal Data on your behalf.

Annex 1: Details of processing

Data exporter	You, the customer, as controller (or as processor for your own clients). Contact: the workspace owners’ e-mail addresses.
Data importer	Edward William Francis Morris, ABN 12 483 583 778, Melbourne, Victoria, Australia, who operates OnProd, as processor. Contact: [email protected].
Data subjects	Visitors to your websites, including your signed-in users and your own staff when they visit your sites.
Categories of personal data	Online identifiers: a random visitor ID and session ID, and your own user ID for signed-in users if you send one. Device and browser details: the browser’s user agent (browser, version and operating system), device type, screen and window size, language and time zone. Approximate location and network: country and network (internet provider), looked up from the IP address, and for visitors in Australia the state, from the time zone. The IP address is not stored with events or sessions; it appears only in our server logs. Page activity: page URLs and referrers (with sensitive query parameters redacted in the browser), campaign tags, clicks and the text of clicked elements (never of form fields), form submits without their values, the time spent in each form field with its name or label, forms left unsent, scroll depth and time on page. Errors: JavaScript error messages and stack traces, and failed network requests (method, URL, status and timing). Session replay: recordings of the page’s structure and text as the visitor saw it, with input values masked in the browser and any other text or elements you mask or block; on-screen messages found in the replay. Anything else you choose to send: custom event properties and user traits.
Sensitive data	None intended. You must not send special categories of personal data or data about children, and must mask or block pages and elements that show them.
Frequency	Continuous, while the OnProd script runs on your sites.
Nature and purpose	Collecting, storing, classifying (for example as human or bot), analysing and displaying the data so you can see analytics, session replays and issues on your sites; and, unless you turn AI Insights off for a site, sending evidence about one issue at a time, without session or user IDs, IP addresses, locations, network names, full user agents or form values, to the AI provider you choose, and storing the result.
Retention	The retention period you set for each site, or, until you set one, for as long as your workspace exists. Erased 7 days after the site or its workspace is deleted [and within [30] days after the terms end in another way]. Backups as in Annex 2.
Sub-processors	As listed in Annex 3.
Competent supervisory authority	Determined under Clause 13 of the Standard Contractual Clauses.

Annex 2: Security measures

• Hosting: Amazon Web Services, Sydney region (ap-southeast-2); AWS is responsible for the physical security of its data centres. Traffic reaches the servers only through Cloudflare, and the servers accept web connections only from Cloudflare’s addresses.
• Encryption: all connections to OnProd use HTTPS (TLS 1.2 or later), from the browser to Cloudflare and from Cloudflare to our servers, which present a certificate Cloudflare checks. The server disks (including the database’s own volume), replay storage and backups are encrypted at rest with keys managed by AWS (EBS encryption, and S3 server-side encryption with AES-256). Two-factor secrets are encrypted with AES-256-GCM.
• Minimisation in the browser: input values are masked before they leave the page; site owners can mask or block more; sensitive URL parameters are redacted; IP addresses are used to look up country and network and are not stored with events or sessions, only in server logs; under counted-only settings no visitor or user IDs are kept and nothing is stored in the browser.
• Access control: passwords stored as scrypt hashes; optional two-factor authentication (TOTP) with recovery codes; accounts locked for 15 minutes after 10 failed attempts; rate limits on sign-in; sessions that can be listed and revoked; roles (owner, admin, member) per workspace; API keys limited by scope; an audit log of workspace actions.
• Tenant isolation: every request is checked, in one place, against the workspace that owns the site it names, and automated tests check that one workspace cannot read another’s data.
• Application security: security headers including a content security policy, origin checks against cross-site requests, parameterised database queries, and rate limits.
• Operations: production access limited to [named staff] with [multi-factor authentication]; no SSH on the servers, whose shell is reached only through AWS Systems Manager Session Manager; server secrets kept encrypted in AWS Systems Manager Parameter Store; logs rotated within [14] days.
• Backups: the database is backed up every night to a separate, encrypted S3 bucket in the Sydney region, which the server can add to but not delete from. Each backup is kept for 30 days and removed for good 7 days later. Replay storage keeps old versions, so a deleted replay recording can be recovered for 30 days before it is removed for good. [How often a restore is tested.]
• Incident response: incidents are investigated, contained and notified as described in section 10.
• AI Insights: on by default for each new site, and you can turn them off in its settings; evidence packs are checked before sending and refused if they contain the session, user or visitor IDs, or the network names or numbers, of the sessions involved; the exact evidence sent is shown to you with every Insight.

Annex 3: Sub-processors

The sub-processors on our sub-processors page on the date above, and those added later under section 7.