Data Processing Agreement

This agreement is made under Article 28(3) of Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"). Terms such as personal data, processing, controller, processor and personal data breach have the meaning Article 4 GDPR gives them.

It is part of the terms of service and applies to every Conforma account. A copy signed by Falka Software is available on request at support@conformahq.com.

Parties

• The Customer: the person or organisation that holds a Conforma account.
• The Processor: Falka Software, registered with the Netherlands Chamber of Commerce (KvK) under number 42175658, VAT identification number NL005558095B21, postal address Box C8803, Zinkstraat 24, 4823 AD Breda, the Netherlands, contact support@conformahq.com.

1. Scope and roles

1.1 This agreement applies to the personal data the Processor processes on behalf of the Customer when the Customer uses Conforma, as described in Annex 1.

1.2 The Customer is the controller of that data, or a processor acting for its own client, such as the operator of a website the Customer looks after. In that case the Processor is a sub-processor, and the Customer confirms that its client has authorised the use of the Processor and of the sub-processors in Annex 3 (Article 28(2) and 28(4) GDPR).

1.3 The Processor is the controller for the data described in its privacy policy: account details such as the name, email address and password of the people who sign in, billing status, sign-in security, visit statistics, the free public scanner and email sent to Falka Software. This agreement does not cover that data.

1.4 Paddle, the merchant of record for payments, Shopify, which bills a Shopify store for Conforma Pro, and Google and GitHub, when a user chooses to sign in with them, act as independent controllers and are not sub-processors.

2. Subject matter and duration

2.1 Subject matter: automated and manual accessibility testing of the websites the Customer adds to Conforma, and the reports, statements and records built from those tests.

2.2 Duration: for as long as the Customer has a Conforma account, and after that until the data is deleted under clause 11.

3. Nature and purpose

3.1 Nature: opening publicly reachable web pages in a headless browser, testing them with the axe-core rules at desktop and phone width, recording a keyboard walk with a screenshot for the first pages of a crawl, storing the results, producing reports, statements and PDF documents, sending emails about the results, and storing the manual test results and branding the Customer enters.

3.2 Purpose: to give the Customer accessibility test results, monitoring, reports and accessibility statements for the websites it adds.

3.3 The scanner is given no cookies, passwords or other login details for a website, so it only reaches pages that anyone on the internet can open. The one exception is the storefront password a Shopify store enters in the Conforma app, which the scanner uses only to open that store's own password page during that store's scans. The Customer only adds websites it owns or is authorised to test (terms of service, section 3).

4. Personal data and data subjects

4.1 Website content: personal data that appears on the public pages of a website the Customer adds, such as names, email addresses, telephone numbers, photographs or reviews. Conforma does not look for personal data, but the page addresses and titles, the HTML of failing elements, the names of focusable elements and the screenshots it stores can contain it. Special categories of personal data (Article 9 GDPR) appear only where a public page shows them; the Customer does not use Conforma to process them on purpose.

4.2 Data the Customer enters: the names of the people who record manual test results, their notes and remarks, the statement contact address, and the agency name and logo.

4.3 Data subjects: people who appear on, or wrote content for, the websites the Customer adds; the Customer's staff; and the people reachable at the Customer's statement contact address.

5. Instructions

5.1 The Processor processes the personal data only on documented instructions from the Customer. This agreement, the terms of service and the Customer's use of Conforma's settings, such as adding a site, starting or scheduling a scan, creating or revoking a share link and deleting a site or the account, are those instructions, also for transfers to a third country.

5.2 Where Union or Member State law requires other processing, the Processor tells the Customer before it processes, unless that law forbids this on important grounds of public interest.

5.3 The Processor tells the Customer at once if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law.

6. Confidentiality

6.1 Only the owner of Falka Software has access to the production systems. Anyone else who is given access commits to confidentiality in writing first.

7. Security

7.1 The Processor takes the technical and organisational measures in Annex 2.

7.2 The Processor may change a measure, provided the overall level of security does not go down.

8. Sub-processors

8.1 The Customer gives general written authorisation for the sub-processors in Annex 3.

8.2 The Processor announces any new or replacement sub-processor by email to the account's address at least 30 days before the change. If the Customer objects on reasonable data protection grounds and the parties cannot resolve it, the Customer may end this agreement by deleting its account before the change takes effect, and the Processor refunds, through Paddle, the part of a prepaid subscription period that runs after the change.

8.3 The Processor binds each sub-processor by contract to data protection obligations that give the same level of protection as this agreement, and remains fully liable to the Customer for each sub-processor's performance.

9. Requests from data subjects

9.1 The Processor helps the Customer, as far as the nature of the processing allows, to answer requests from data subjects under Chapter III GDPR.

9.2 The Customer can answer most requests in Conforma itself. Deleting a site deletes its scans, results, keyboard walks and screenshots, manual test results and conformance statuses. Manual test results and remarks can be edited, the logo and the statement contact address can be changed or removed in Settings, and results can be exported as CSV and PDF.

9.3 When a data subject contacts the Processor about data it processes for the Customer, the Processor passes the request to the Customer without undue delay and does not answer it unless the Customer asks it to.

10. Security, breaches and impact assessments

10.1 The Processor helps the Customer to meet its obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it.

10.2 The Processor notifies the Customer of a personal data breach affecting the Customer's data without undue delay, and within 48 hours of becoming aware of it, by email to the account's address. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. What is not yet known follows as soon as it is.

10.3 The Processor gives the Customer the information it has that the Customer needs for a data protection impact assessment, including Annexes 1 to 3.

11. Deletion and return

11.1 At the end of the service, the Processor deletes or returns the personal data, as the Customer chooses, and deletes existing copies unless Union or Member State law requires storage.

11.2 Return: the Customer can download its reports as PDF and its results as CSV before it deletes its account.

11.3 Deletion: deleting the account in Settings deletes at once the account's sites, scans, results, keyboard walks and screenshots, manual test results, conformance statuses, activity log and logo. For a Shopify store, uninstalling the app deletes the storefront password at once, and the same data is deleted when Shopify asks for it, 48 hours after the uninstall. Copies remain in the backups until those are deleted: the copies on the server after about 15 days, and the encrypted copies after about 12 months. Emails already sent stay with the email provider in Annex 3 under its own retention.

11.4 An account is not deleted because it is inactive or moved to the Free plan. Its data stays until the Customer deletes the account.

12. Information and audits

12.1 The Processor makes available all information needed to show compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates.

12.2 The Processor first answers the Customer's written questions. Where an audit is still needed, the Customer gives at least 30 days' written notice, holds it at most once a year unless a breach or a supervisory authority requires more, during office hours and at its own cost, and has the auditor bound to confidentiality.

13. Transfers outside the EEA

13.1 The Customer's data is stored in the European Union. Annex 3 names the sub-processors established in the United States.

13.2 The Processor transfers personal data outside the EEA only under Chapter V GDPR: to a recipient certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), or with the standard contractual clauses of Commission Implementing Decision (EU) 2021/914. Annex 3 states the basis for each sub-processor.

14. Records

14.1 The Processor keeps a record of the categories of processing it carries out for its customers (Article 30(2) GDPR) and a register of personal data breaches (Article 33(5)).

15. Liability

15.1 Liability under this agreement follows Article 82 GDPR. Between the parties, the limitation in section 8 of the terms of service applies as far as the law allows.

16. Term, precedence and law

16.1 This agreement runs for as long as the Processor processes personal data for the Customer.

16.2 Where this agreement and the terms of service conflict about personal data, this agreement prevails.

16.3 Dutch law governs this agreement, and disputes go to the competent court in the Netherlands.

16.4 Material changes to this agreement are announced by email at least 14 days in advance, as for the terms of service.

Annex 1: Description of the processing

Everything is stored in the European Union, on the server in Helsinki, Finland, and in the backups described below.

• Sites: name, address, excluded paths, scan settings and share link. Kept until the site or the account is deleted.
• Scans and results: the address and title of every tested page, and for each failing element its rule, CSS selector and HTML (at most 2,000 characters). Kept for 12 months; the latest completed scan of each site is kept as long as the site.
• Keyboard walks: for the first 5 pages of a crawl, each focus stop's element, role and name, and one screenshot of the page at desktop width. Kept as long as the scan, and deleted with it.
• Manual test results and conformance statuses: result, notes, failed criteria, and the name of the person who recorded them. Kept until the site or the account is deleted.
• Activity log: what was done and when, naming sites, not people. Kept until the account is deleted.
• Branding and statement contact: agency name, logo and the statement contact address. Kept until removed in Settings or the account is deleted.
• Storefront password of a password-protected Shopify store, when the store enters it in the Conforma app. Stored encrypted and deleted when the app is uninstalled.
• Emails about results, such as regression alerts, sent to the account's address. Not stored in Conforma.
• Backups: a copy of the database on the server every 24 hours, kept for about 15 days, and an encrypted copy of the database and the logos every 24 hours, kept as 30 daily and 12 monthly copies.
• Server logs: error messages, which can contain an address. Overwritten once a service has written 30 MB of them.

Annex 2: Technical and organisational measures

Hosting and encryption

• The service, its database, its files and the server backups run on one server of Hetzner Online GmbH in Helsinki, Finland.
• All traffic to Conforma uses HTTPS. Passwords are stored as bcrypt hashes.
• Backups are encrypted on the server before they are copied off it, with a key the storage provider does not have. Data on the server's own disk is not separately encrypted.

Network and infrastructure access

• The database and the scanner cannot be reached from the internet. The scanner only accepts requests that carry a shared secret, and refuses addresses in private, reserved, loopback and link-local ranges for every request, including those from browser tabs a scanned page opens. A Shopify store's storefront login stays in a browser context of that store's scan only.
• Only the owner of Falka Software can reach the server, over SSH with a key; password login is switched off. The hosting control panel is reachable only over HTTPS.

Access control in Conforma

• Every page and file of a site checks that the site belongs to the signed-in account. Keyboard walk screenshots are served only through that check.
• Client documents and the billing portal require a confirmed email address.
• Sign-in attempts are limited per email address and IP address. Changing the password signs out every other device, and deleting the account ends its sessions everywhere.
• The operator panel is open only to a short list of confirmed addresses.

Availability and recovery

• Backups as in Annex 1. A failed backup emails the owner, and a restore of the latest backup is tested every quarter.
• An hourly check reports a stopped job queue.

Organisation

• The owner of Falka Software is responsible for data protection, reviews access once a year, and keeps a written breach procedure and a breach register.
• Annex 3 is updated, and customers are told, before a sub-processor changes (clause 8.2).

Annex 3: Sub-processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Runs the server in Helsinki, Finland, that holds the service, its database, its files and the server backups. No transfer outside the EU.
• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States. Stores the encrypted backup copies in its R2 storage, in a bucket restricted to the European Union. Transfer basis: the EU standard contractual clauses and the EU-U.S. Data Privacy Framework, as Cloudflare's data processing agreement states.
• Plus Five Five, Inc. (Resend), San Francisco, United States. Sends Conforma's emails, such as regression alerts; processing takes place mainly in the United States. Transfer basis: the EU standard contractual clauses and the EU-U.S. Data Privacy Framework, as Resend's data processing agreement states.

Not sub-processors: Paddle, Shopify, Google and GitHub, which act as independent controllers (clause 1.4), and the providers that receive email sent to Falka Software, which is Falka Software's own correspondence under its privacy policy.