Data processing agreement (dpa) — CookieYes

Cited by

Facts read from this source

• Processor entity Report an error

  “means CookieYes Limited Address: 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.”

• Company number Report an error

  “Official registration number (if any) (company number or similar identifier): 13074037.”

• UK addendum Report an error

  “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses VERSION B1.0, in force 21 March 2022”

• Governing law Report an error

  “this DPA shall be governed by the laws of England and Wales. The courts of England shall have exclusive jurisdiction for the settlement of all disputes arising under this DPA.”

• EU scc governing law Report an error

  “In Clause 17 of the EU SCCs, Option 1 applies and the EU SCCs shall be governed by Irish law; (vii) In Clause 18(b) of the EU SCCs, disputes shall be resolved by the courts of Ireland”

• Breach notification Report an error

  “The Processor shall notify the Controller without undue delay after becoming aware of (and in any event within 72 hours of discovering) any accidental or unlawful destruction, loss, alteration or unauthorised disclosure or access to any Personal Data”

• Subprocessor notice Report an error

  “the Processor shall provide the Controller with 30 days prior notification, via email, of any changes to the List of Sub-Processors before authorising any new or replacement Sub-Processor”

• Data deletion Report an error

  “The Processor shall in any event delete all copies of Personal Data in its systems within 60 days of the effective date of termination of the Agreement”

• Encryption at rest Report an error

  “The Controller's data is encrypted at rest using AES256 bit encryption and LUKS”

• Encryption in transit Report an error

  “Data in transit is protected by Transport Layer Security ("TLS").”

• Pen test Report an error

  “Additionally, we perform annual third-party penetration tests and industry security audits”

• Datacenter certifications Report an error

  “The Processor utilises third party data centres that maintain current ISO 27001 certifications and/or SSAE 16 SOC 1 Type II or SOC 2 Attestation Reports.”

• Aws hosting Report an error

  “Personal Data is only retained internally, and on the third party data centre servers, which are covered by AWS certifications.”

• Audit reports on request Report an error

  “Upon the Controller's written request (no more than once in any 12 month period), the Processor shall provide within a reasonable time, a copy of the most recently completed certification and/or attestation reports”

• Backup frequency Report an error

  “Backups are maintained hourly and daily in accordance with our backup procedures.”

• Data portability tools Report an error

  “The Services have built-in tools that allows the Controller to export and permanently erase data.”

• No sensitive data Report an error

  “Sensitive Data: No sensitive data special category data will be processed or transferred”

• Subprocessor refund Report an error

  “The Processor will refund the Controller any prepaid fees covering the remainder of the term of the Agreement following the effective date of termination with respect to such terminated Services.”

• Assistance fees Report an error

  “some instructions from the Controller, including destruction or return of data, the Processor assisting with audits, inspections, DPIAs or providing any assistance under this DPA, may result in additional fees.”

• Data retention period Report an error

  “for the duration of the Agreement, subject to clause 14 of the DPA.”

• Dpiassistance Report an error

  “The Processor shall reasonably assist the Controller in meeting the Controller's obligation to carry out data protection impact assessments (DPIAs)”

• Supervisory authorities Report an error

  “Where the EU GDPR applies, the Irish Data Protection Authority – Data Protection Commission, ("DPC"). Where the UK GDPR applies, the UK Information Commissioner's Office, (ICO). Where the FDPA applies, the Swiss Federal Data Protection and Information Commissioner, (FDPIC).”

• Sensitive data handling Report an error

  “In the event that the Processor receives a request from a Data Subject in relation to Personal Data, the Processor will refer the Data Subject to the Controller unless otherwise prohibited by law.”

• Subprocessor list Report an error

  “The Controller authorises the Processor to use the Sub-Processors included in the List of Sub Processors to process the Personal Data.”

3 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer Consent records & proof
• The Agency Developer European sovereignty
• The Data Protection Officer European sovereignty
• The In-House Lawyer Consent records & proof
• The In-House Lawyer European sovereignty
• The Publisher Marketing Lead European sovereignty
• The Skeptic European sovereignty
• The WordPress Webmaster Consent records & proof
• The WordPress Webmaster European sovereignty