Data Processing Addendum (DPA)
Last updated: December 1, 2025
This Data Processing Addendum (“DPA”) is an integral part of the agreement between you (the “Controller”) and TrackBranded (the “Processor”). It applies whenever we process personal data on your behalf under the main Terms of Service or other agreement.
1. Definitions
Controller: the individual or legal entity that determines the purposes and means of processing personal data and enters into the master agreement with TrackBranded.
Processor: TrackBranded (and its affiliates or agents) when acting on behalf of the Controller to process personal data.
Sub-processor: any third-party engaged by Processor to process personal data under the terms of this DPA (e.g., hosting providers, payment processors, analytics tools).
Personal Data: any information relating to an identified or identifiable natural person.
Data Subject: the natural person to whom the Personal Data relates.
Processing: any operation performed on Personal Data (collection, storage, transmission, use, deletion, etc.).
2. Subject-Matter, Nature, Purpose, Duration, and Scope of Processing
Subject-Matter & Duration
The subject matter of processing is the provision of TrackBranded services to the Controller (account maintenance, authentication, billing, service delivery, analytics, support, etc.).
The duration of the Processing is the term of the Controller’s agreement with TrackBranded, plus any legally required retention period after termination unless otherwise requested by the Controller.
Nature and Purpose
Provide and maintain the service (subscription management, account maintenance, feature access).
Billing, invoicing, payment processing (via payment providers).
Service analytics, usage tracking, performance measurement, debugging, quality improvement.
Customer support, communications, security, fraud prevention, compliance.
Categories of Personal Data and Data Subjects (as relevant for the Controller) — may include, but are not limited to:
Contact information (name, email address, billing address, phone number)
Payment / billing data (payment tokens, transaction history), provided to or processed by payment processors — subject to PCI compliance as relevant.
Account credentials / authentication data (usernames, hashed passwords or credentials, login metadata, IP addresses)
Usage data and log data (service usage metrics, timestamps, feature usage, anonymized or pseudonymized identifiers)
Customer support data (communication logs, support requests, metadata)
Any other data the Controller elects to supply to the Processor in connection with use of the service.
Data Subjects may include: Controller’s end users, clients, customers, employees, or other individuals whose data is submitted to or processed by TrackBranded per the Controller’s instructions.
3. Controller Obligations
By using TrackBranded’s services, the Controller warrants that:
It has all necessary rights, consents, or legal basis required under applicable law to provide the Personal Data to the Processor.
It provides required privacy notices and obtains all consents from Data Subjects where required by law prior to submitting their Personal Data.
It ensures that submission and processing of Personal Data via TrackBranded comply with applicable data protection laws.
It uses the service in compliance with the Terms of Service and this DPA.
It may instruct the Processor to delete or return data in accordance with Section 9 (“Return or Deletion of Personal Data”).
4. Processor Obligations
TrackBranded agrees to:
Process Personal Data only on documented instructions from the Controller (including as set forth in this DPA and the main agreement).
Ensure that persons authorized to process the data are subject to confidentiality obligations (by contract or law), and limit access to those who need it for performance of the service.
Implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk — e.g. access controls, encryption, pseudonymization or anonymization where feasible, secure data storage, regular security reviews.
If sub-processors are engaged:
Require that each sub-processor enters into a written agreement imposing data protection obligations not less stringent than this DPA. Sprinto+1
Maintain a list of sub-processors (current and past), and make it available to the Controller on request.
Provide notice to the Controller of any intended changes to sub-processors and offer the opportunity to object (or request alternatives) before allowing new sub-processors.
Assist the Controller in fulfilling data-subject rights (access, correction, deletion, export, restriction) in a timely manner upon verified request from the Controller or Data Subject, subject to law.
Notify the Controller without undue delay upon becoming aware of any Personal Data breach affecting Controller’s data; provide relevant details (nature of breach, categories of data affected, number of data subjects, mitigation steps, contact point for further information).
Provide reasonable cooperation to the Controller in case of audits by regulatory authorities or lawful requests, or to demonstrate compliance, including providing records of processing activities, security measures, access logs, and sub-processor agreements — subject to confidentiality constraints. evidenceprime.com+1
5. Sub-Processors
The Controller hereby authorizes Processor to engage Sub-processors (e.g. hosting providers, payment processors, analytics services) to assist in providing the service.
Processor shall ensure any Sub-processor is bound by written contract containing obligations no less protective than those in this DPA.
The current list of Sub-processors is available to the Controller on request. Processor will provide prompt notice before onboarding any new Sub-processor and allow Controller to object within a reasonable timeframe.
6. International Data Transfers
Personal Data may be transferred to or processed in jurisdictions outside the European Economic Area (“EEA”) if necessary to provide the service (e.g., hosting, backups, third-party services).
In doing so, Processor will apply appropriate safeguards such as standard contractual clauses (SCCs) or other mechanisms recognized under applicable law to ensure lawful and secure transfer. gdprregister.eu+1
7. Data Subject Rights & Controller Support
At the request of the Controller or Data Subject (forwarded to [email protected]), Processor will assist to the extent reasonably possible in fulfilling:
right of access;
right to rectification;
right to erasure (deletion);
right to data portability (export);
right to restriction of processing.
Processor will maintain records of requests and responses, and cooperate with Controller to meet lawful deadlines under relevant data-protection laws.
8. Security, Confidentiality & Audit Rights
Processor implements appropriate technical and organizational security measures (encryption, access controls, secure storage, logging, regular review) suitable to the risk.
Personnel, contractors, and Sub-processors handling Personal Data are contractually bound to confidentiality and subject to access restrictions.
Upon the Controller’s request, Processor will provide evidence (e.g. security practices summary, compliance report, audit logs) sufficient to demonstrate compliance with this DPA and applicable law — provided confidentiality is maintained.
9. Return or Deletion of Personal Data
Upon termination or expiration of the Agreement (or earlier at Controller’s written request), Processor shall, at Controller’s option:
Return to the Controller all Personal Data processed under the Agreement in a common machine-readable format (if feasible), or
Permanently delete all Personal Data and irrecoverable copies from its systems and any Sub-processor systems (unless retention is required by law).
Any backup copies will also be deleted or retained only to the extent legally required, and otherwise rendered inaccessible. Processor will confirm completion of return or deletion within a reasonable timeframe (e.g. ≤ 30 days after request or contract end).
10. Liability, Indemnification & Misc
The Processor shall indemnify the Controller for any damages or losses caused by Processor’s breach of this DPA, subject to limitations agreed in main Terms of Service.
If any provision of this DPA is found unenforceable under applicable law, the remainder shall remain in effect.
11. Governing Law & Changes to This DPA
This DPA shall be governed by the law specified in the main agreement.
Processor may update or modify this DPA (e.g. to reflect changes in law or services). Updates will be posted publicly; continued use of the service after update constitutes acceptance by the Controller.