Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between ConsentEase ("Processor," "we," "us") and the customer ("Controller," "you") who subscribes to and uses the ConsentEase service.

This DPA reflects the parties' agreement with respect to the processing of personal data by ConsentEase on behalf of the Controller in connection with the provision of the ConsentEase consent management platform.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, including collection, storage, and deletion.
• "Data Subject" means the individual to whom Personal Data relates (your website visitors).
• "Sub-processor" means any third party engaged by ConsentEase to process Personal Data.

3. Scope and Purpose of Processing

ConsentEase processes Personal Data solely for the purpose of providing the consent management service as described in our Terms of Service. This includes:

• Collecting and storing consent preferences from your website visitors
• Providing consent analytics and reporting
• Generating audit logs for compliance purposes
• Delivering the consent banner on your website
• Determining approximate visitor location locally for the jurisdiction badge, language fallback, and country-level consent statistics

4. Types of Personal Data Processed

ConsentEase may process the following categories of Personal Data:

• Consent preferences and timestamps
• Anonymized or pseudonymized visitor identifiers
• IP addresses (used temporarily in memory for local location lookup) and pseudonymized IP-derived identifiers for consent evidence
• Approximate location information (country, European regional classification including EU/EEA, and US state where available)
• Browser and device information for banner rendering
• Website domain and page URLs where consent was collected

ConsentEase estimates visitor location on its own server using a local copy of the DB-IP IP to City Lite dataset. The lookup identifies the country, a European regional classification including the EU/EEA, and, where available, a US state, including recognition of California. The European banner classification also includes the United Kingdom and Switzerland.

For this lookup, the full IP address is used only temporarily in server memory. The location lookup does not store or log the full IP address and does not send it to DB-IP, ip-api.com, restcountries.com, or any other external geolocation provider. Country codes may be stored for consent statistics. The banner uses location data only for the optional jurisdiction badge and as a language fallback, not to change consent rules automatically.

DB-IP supplies the dataset and receives no visitor data. For this location processing, DB-IP is a data source, not a sub-processor. IP Geolocation by DB-IP (IP to City Lite, CC BY 4.0).

5. Data Subject Categories

The Personal Data processed concerns the following categories of Data Subjects: visitors to the Controller's website(s) who interact with the consent banner.

6. Duration of Processing

ConsentEase will process Personal Data for the duration of your subscription. Upon termination, Personal Data will be deleted within 30 days, unless retention is required by applicable law or you request immediate deletion.

During your subscription, consent proof records (the individual consent choices recorded from your website visitors) follow the ConsentEase default retention: each record is kept until its scheduled renewal date plus 24 months, and never shorter than the moment of recording plus 365 days plus 24 months. The scheduled renewal date is not the retention period. After that, the record becomes eligible for deletion and is deleted automatically by the ConsentEase daily retention cleanup. Withdrawals and later choices are separate records and follow the same rule from their own moment of recording.

As the Controller, you decide how long you need this evidence. If you need records for longer than this default, you must export them before their retention date. This default does not change the deletion upon termination described above, and deleting a website removes its records earlier.

7. Processor Obligations

ConsentEase shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure that persons authorized to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to Data Subject requests
• Assist the Controller with data protection impact assessments where required
• Delete or return all Personal Data upon termination of the agreement
• Make available information necessary to demonstrate compliance with GDPR

8. Security Measures

ConsentEase implements the following security measures:

• Encryption in transit using TLS 1.3
• Encryption at rest using AES-256
• Access controls and authentication for all systems
• Regular security audits and vulnerability assessments
• Data center security (physical access controls, monitoring)
• Employee security training and background checks
• Incident response and disaster recovery procedures

9. Sub-processors

ConsentEase may engage Sub-processors to assist in providing the service. We maintain a list of current Sub-processors and will notify you of any changes with at least 30 days' notice.

Current Sub-processors include:

• Infrastructure: EU-based cloud hosting providers
• Payment Processing: Stripe (PCI-DSS compliant)
• Email: Transactional email service providers

DB-IP is not a Sub-processor for visitor location lookup: it supplies a dataset used locally by ConsentEase and receives no visitor data.

10. Data Transfers

Local visitor location lookup does not involve transfers of visitor IP addresses to external geolocation providers. ConsentEase does not transfer Personal Data to countries outside the EU/EEA without appropriate safeguards (such as Standard Contractual Clauses) and your prior consent.

11. Data Subject Rights

ConsentEase will assist you in fulfilling your obligations to respond to Data Subject requests, including requests for access, rectification, erasure, data portability, and objection to processing.

12. Data Breach Notification

In the event of a Personal Data breach, ConsentEase will notify you without undue delay (and in any event within 72 hours) after becoming aware of the breach. The notification will include the nature of the breach, categories of data affected, and measures taken to address the breach.

13. Audit Rights

Upon reasonable request and subject to confidentiality obligations, ConsentEase will make available information necessary to demonstrate compliance with this DPA. You may also request an independent audit, conducted at your expense, with reasonable notice and during normal business hours.

14. Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service, except that neither party's liability for breaches of data protection law shall be limited.

15. Contact

For questions about this DPA or to request a signed copy, please contact us at:

Email: privacy@consentease.io
Address: ConsentEase, Belgium, EU