Data Processing Agreement

Last Updated: September 22, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Transfon Ltd ("Transfon") and the customer that has entered into it ("Customer") for the use of Transfon's products and services (the "Agreement"). It reflects the parties' agreement on the processing of Customer Personal Data in accordance with Data Protection Law.

1. Definitions

Capitalised terms not defined in this DPA have the meaning given in the Agreement.

• "Data Protection Law" means all laws relating to the processing of personal data that apply to a party's performance under the Agreement, including the UK GDPR and the UK Data Protection Act 2018, the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the Swiss Federal Act on Data Protection, and US state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
• "Customer Personal Data" means personal data that Transfon processes on behalf of Customer in providing the Service.
• "Documented Instructions" means the Agreement, this DPA, Customer's configuration and use of the Service, and any other written instructions from Customer that Transfon agrees to.
• "Service" means the products and services Transfon provides to Customer under the Agreement.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Sub-processor" means a third party engaged by Transfon to process Customer Personal Data.
• "EU SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner.

The terms "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in Data Protection Law. "Business", "service provider", "sell" and "share" have the meanings given in the CCPA.

2. Scope and Roles

2.1 Roles. Customer is the controller (or, under the CCPA, the business) and Transfon is the processor (or service provider) of Customer Personal Data. Where Customer is itself a processor acting for a third-party controller, Transfon is Customer's sub-processor. Each party shall comply with its obligations under Data Protection Law.

2.2 Independent controller processing. This DPA does not apply where Transfon determines the purposes and means of processing, including operating its websites, managing Customer accounts and billing, and processing as a vendor in the IAB Europe Transparency & Consent Framework. That processing is governed by the Transfon Privacy Policy.

2.3 Details of processing. The subject matter, nature, purpose and duration of the processing, and the categories of data and data subjects, are described in Schedule I.

2.4 Customer responsibilities. Customer is responsible for the lawfulness of the Customer Personal Data it provides and of its instructions, including having a lawful basis and giving any notices and obtaining any consents required for Transfon to process Customer Personal Data under this DPA.

2.5 Conflicts. If there is a conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Customer Personal Data. If there is a conflict between this DPA and the EU SCCs or the UK Addendum, the EU SCCs or the UK Addendum prevail.

3. Processing of Customer Personal Data

3.1 Instructions. Transfon shall process Customer Personal Data only on Documented Instructions, unless required to do otherwise by applicable law. In that case, Transfon shall inform Customer of the legal requirement before processing, unless the law prohibits it. Transfon shall inform Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend the relevant processing until Customer confirms or changes the instruction.

3.2 Confidentiality. Transfon shall ensure that personnel authorised to process Customer Personal Data are bound by appropriate obligations of confidentiality.

3.3 US state privacy laws. Transfon shall not:

• (a) sell or share Customer Personal Data;
• (b) retain, use or disclose Customer Personal Data for any purpose other than performing the Service, including any commercial purpose, or outside the direct business relationship between Customer and Transfon, except as permitted by the CCPA;
• (c) combine Customer Personal Data with personal data Transfon receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA.

Transfon shall notify Customer if it can no longer meet its obligations under the CCPA. Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data. Transfon certifies that it understands and will comply with these restrictions.

4. Sub-processors

4.1 Authorisation. Customer gives Transfon general authorisation to engage Sub-processors, including those listed in Schedule III.

4.2 Sub-processor obligations. Transfon shall engage Sub-processors under a written contract that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA. Transfon remains liable to Customer for the performance of its Sub-processors' obligations.

4.3 Notice of changes. Transfon shall update the list in Schedule III at least thirty (30) days before a new or replacement Sub-processor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds by notifying Transfon in writing at [email protected] within the notice period. The parties shall discuss the objection in good faith with a view to reaching a reasonable resolution.

5. Assistance

5.1 Data subject requests. If Transfon receives a request from a data subject or consumer relating to Customer Personal Data, it shall promptly forward the request to Customer and shall not respond except to direct the requester to Customer, unless required by law. Taking into account the nature of the processing, Transfon shall provide reasonable assistance to enable Customer to respond to such requests, including through the functionality of the Service.

5.2 Impact assessments and consultations. Transfon shall provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities, where required by Data Protection Law and to the extent Customer cannot reasonably do so itself.

5.3 Authorities. Transfon shall, unless prohibited by law, promptly inform Customer of any request, inspection or investigation by a supervisory authority that relates to Customer Personal Data.

5.4 Costs. Transfon may charge reasonable fees for assistance under this Section 5 that goes beyond what the Service provides as standard, unless the assistance is needed because of Transfon's breach of this DPA.

6. Security

6.1 Security measures. Transfon shall implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to data subjects. These measures are described in Schedule II. Transfon may update them from time to time, provided the updates do not materially decrease the overall security of the Service.

6.2 Security Incidents. Transfon shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident. The notice shall describe, to the extent known, the nature of the Security Incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where information is not yet available, Transfon shall provide it in phases as it becomes available. Transfon shall promptly take reasonable steps to investigate, contain and mitigate the Security Incident. Notification is not an acknowledgement of fault or liability.

7. Audits

7.1 Information. On written request, Transfon shall make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA, which may include summaries of its security measures, policies and relevant third-party reports or certifications.

7.2 Audits. If the information under Section 7.1 is not sufficient to demonstrate compliance, or where required by a supervisory authority or Data Protection Law, Customer may audit Transfon's compliance with this DPA, either itself or through an independent auditor bound by confidentiality. Audits shall take place no more than once in any twelve (12) month period (unless required by a supervisory authority), on at least thirty (30) days' written notice, during normal business hours, and in a way that minimises disruption to Transfon's business. Customer shall bear the costs of the audit. Audits under the EU SCCs are carried out in accordance with this Section 7.

8. International Data Transfers

8.1 Transfers. Transfon and its Sub-processors may process Customer Personal Data outside the UK, the European Economic Area and Switzerland, provided the transfer complies with Data Protection Law, for example because the destination is subject to an adequacy decision or because the parties have entered into the transfer mechanisms below.

8.2 EU transfers. To the extent Customer Personal Data subject to the EU GDPR is transferred to Transfon in a country without an adequacy decision, the EU SCCs are incorporated into this DPA as follows:

• (a) Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor;
• (b) Customer is the data exporter and Transfon is the data importer;
• (c) the optional docking clause in Clause 7 applies;
• (d) in Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in Section 4.3 of this DPA;
• (e) the optional wording in Clause 11 does not apply;
• (f) in Clause 17, Option 2 applies: the EU SCCs are governed by the law of the EU Member State in which Customer is established or, where that law does not allow for third-party beneficiary rights or Customer is not established in an EU Member State, the law of Ireland;
• (g) in Clause 18(b), disputes are resolved before the courts of the EU Member State whose law governs under paragraph (f);
• (h) Annexes I and II are completed by Schedules I and II of this DPA, and Annex III by Schedule III.

8.3 UK transfers. To the extent Customer Personal Data subject to the UK GDPR is transferred to a country without UK adequacy regulations, the UK Addendum is incorporated into this DPA. The UK Addendum is governed by the laws of England and Wales. Table 1 is completed with the details of the parties in Schedule I; Table 2 refers to the EU SCCs as incorporated under Section 8.2; Table 3 is completed by Schedules I, II and III; and in Table 4, either party may end the UK Addendum as set out in its Section 19.

8.4 Swiss transfers. For transfers subject to Swiss data protection law, the EU SCCs apply as set out in Section 8.2, with references to the EU GDPR read as references to Swiss law, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and data subjects in Switzerland able to bring claims in their place of habitual residence.

9. Return and Deletion

On termination or expiry of the Agreement, or earlier on Customer's written request, Transfon shall delete or return Customer Personal Data within six (6) months, at Customer's choice, and shall delete existing copies, unless applicable law requires further storage. Customer Personal Data held in backups shall be deleted in accordance with Transfon's standard backup rotation and shall remain protected under this DPA until deleted. On request, Transfon shall confirm deletion in writing.

10. General

10.1 Term. This DPA remains in force for as long as Transfon processes Customer Personal Data on Customer's behalf.

10.2 Liability. Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except where such limitations are not permitted by Data Protection Law or the EU SCCs.

10.3 Governing law and jurisdiction. Except as set out in Section 8, this DPA and any dispute or claim arising out of or in connection with it are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

10.4 Changes. Transfon may update this DPA to reflect changes in Data Protection Law or the Service, provided the update does not materially reduce the protection of Customer Personal Data. The "Last Updated" date at the top of this page shows when it last changed.

Schedule I: Description of Processing

Parties

• Data exporter: Customer, as identified in the Agreement. Role: controller (or processor on behalf of its own customers).
• Data importer: Transfon Ltd, United Kingdom. Contact: [email protected]. Role: processor.

Categories of data subjects

• Visitors to and end users of Customer's websites, applications and other digital properties that use the Service
• Customer's employees, contractors and other authorised users of the Service

Categories of personal data

Depending on the Service used and how Customer configures it:

• Identifiers and contact details, such as name, email address and phone number
• Online identifiers, such as IP address, cookie identifiers, device and advertising identifiers
• Device and browser information, such as user agent, operating system, screen and language settings
• Usage and interaction data, such as pages viewed, events, clicks and session information
• Consent and preference records
• Any other personal data Customer submits to the Service

Sensitive data

None. Customer shall not submit special category data or other sensitive personal data to the Service unless agreed in writing with Transfon.

Frequency of transfer

Continuous, for the duration of the Agreement.

Nature and purpose of processing

Collection, storage, organisation, analysis, transmission and deletion of Customer Personal Data for the purpose of providing, securing, maintaining and supporting the Service in accordance with the Agreement and Documented Instructions.

Duration of processing

The term of the Agreement, plus the deletion period in Section 9.

Transfers to Sub-processors

As set out in Schedule III, for the purposes and duration described above.

Competent supervisory authority

The UK Information Commissioner's Office. For the EU SCCs, the supervisory authority determined in accordance with Clause 13 of the EU SCCs. For Swiss data, the Swiss Federal Data Protection and Information Commissioner.

Schedule II: Technical and Organisational Measures

Transfon maintains technical and organisational measures appropriate to the nature of the Service and the risks of the processing, which it reviews and updates from time to time. These include:

• Encryption: encryption of Customer Personal Data in transit and at rest.
• Access control: access to Customer Personal Data limited to authorised personnel who need it to provide the Service.
• Confidentiality: personnel with access to Customer Personal Data are bound by confidentiality obligations.
• Security assessments: periodic review of the security of the Service.
• Incident response: procedures to investigate, contain and notify Security Incidents.
• Sub-processors: Sub-processors are bound by written contracts in accordance with Section 4.

Schedule III: Sub-processors

Sub-processor	Purpose	Data Processing Agreement
Amazon Web Services EMEA SARL	Cloud hosting and infrastructure	AWS DPA
Cloudflare, Inc.	Content delivery, network security and edge computing	Cloudflare DPA
DigitalOcean, LLC	Cloud hosting and infrastructure	DigitalOcean DPA
Stripe	Payment processing	Stripe DPA

Contact

For questions about this DPA, to object to a Sub-processor, or to request a countersigned copy, contact:

Transfon Ltd

Email: [email protected]