Template notice. This document is a general template provided for convenience and is not legal advice. Please have it reviewed by your own legal counsel and complete any bracketed fields before relying on it.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", the data controller) and Palms Media LLC ("Processor") and applies where the Plugin processes personal data on the Customer's behalf, including under the EU/UK GDPR.
1. Roles
For attribution data the Plugin records about visitors to the Customer's website, the Customer is the controller and Palms Media LLC is a processor acting on the Customer's documented instructions.
2. Subject matter & duration
Processing is for the purpose of providing the Plugin's attribution and reporting functionality, for as long as the Customer's subscription remains active or as required to provide the service.
3. Nature & purpose of processing
Collecting, classifying, storing, and making available marketing-attribution data tied to Contact Form 7 submissions.
4. Categories of data & data subjects
Data subjects: visitors to and form submitters on the Customer's website.
Data: UTM parameters, click IDs, referrer, landing page, classified channel, IP address (anonymizable), approximate geolocation, and form submission metadata.
5. Sub-processors
The Customer authorizes the following sub-processors: Stripe (billing/licensing), ipinfo.io (optional geolocation), and Google (optional Search Console enrichment). We will inform the Customer of material changes to sub-processors.
6. Security
Palms Media LLC maintains reasonable technical and organizational measures appropriate to the risk, including access controls, encryption in transit, and IP-anonymization options provided in the Plugin.
7. Data subject requests
Taking into account the nature of processing, Palms Media LLC will assist the Customer in responding to data subject requests. Because attribution data is stored in the Customer's own database, the Customer can typically fulfill such requests directly within WordPress.
8. Personal data breach
Palms Media LLC will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data within the service we control.
9. Return or deletion
On termination, the Customer may export or delete attribution data from their site; the Plugin also provides automatic retention-based deletion.
10. International transfers
Where personal data is transferred across borders by a sub-processor, appropriate safeguards (such as Standard Contractual Clauses) are relied upon as applicable.
11. Audit
Palms Media LLC will make available information reasonably necessary to demonstrate compliance with this DPA.