Data processing agreement

This agreement is part of the terms. It applies when you (the "controller") use Bot403 on pages that your visitors use and the operator (the "processor") processes their data for you. It follows the structure of Article 28(3) GDPR. A signed PDF is available on request by email.

1. Subject matter and duration

The processor issues proof-of-work challenges to the controller's visitors and checks the answers for the controller. The processing lasts as long as the account exists, plus the deletion period in clause 8.

2. Nature and purpose

Receiving challenge requests from browsers, rate-limiting them, checking solutions on request of the controller's server, and keeping statistics for the controller.

3. Types of data and data subjects

The IP address of the visitor's browser (kept in memory for one minute for rate limits, never stored), the origin host of the page, the difficulty and the result of each verification. Data subjects are the visitors of the controller's websites. The processor never receives the content of a form.

4. Instructions

The processor processes the data only on documented instructions from the controller. The site settings and the terms are those instructions. If the processor thinks an instruction breaks the law, the processor tells the controller.

5. Confidentiality

One person has access to the data. That person is bound to confidentiality.

6. Security

The measures are on the security page: EU hosting, TLS, hashed secrets, per-site signing keys, daily backups, and no third-party scripts.

7. Sub-processors

The controller gives general authorization for the sub-processors listed on the sub-processors page. The processor tells account holders by email at least 14 days before a new sub-processor starts. The controller can object; then the controller can end the account.

8. Deletion and return

Verification records are deleted after the statistics period of the plan. The controller can read the statistics through the API at any time. After the account closes, the processor deletes all data within 30 days, except what the tax law requires to be kept.

9. Assistance

The processor helps the controller to answer data subject requests and to do data protection impact assessments, as far as the data in the service is concerned.

10. Data breaches

The processor tells the controller by email without undue delay, and in any case within 72 hours, after the processor becomes aware of a personal data breach that affects the controller's data.

11. Audits

The processor gives the controller the information that is necessary to show compliance. Audits on site are possible with 30 days notice, once a year, at the cost of the controller.

12. International transfers

The data stays in the EU. The only sub-processors outside the EU are Stripe and Link, which receive no visitor data.