Data Processing Agreement
Last updated:
This Data Processing Agreement (DPA) forms part of the SiteOS Terms of Use between Prime UI, Inc. (SiteOS, we, us) and the organization on whose behalf those Terms are accepted (Customer, you). It applies when we process personal data on your behalf through any SiteOS service. Accepting the Terms includes this DPA; a separate form or signature is not required. The version shown here is preserved with your acceptance record.
1. Scope and roles
You determine the purposes of processing Customer personal data and act as its controller, or as a processor authorized by a controller to appoint SiteOS. We act respectively as processor or subprocessor. If you act for a client, you must have its instructions and authority for this appointment. The roles depend on the actual processing, not just the name of a service or account.
Customer personal data means personal data submitted to, collected by, or otherwise processed through SiteOS on your instructions. Annex I describes the services and processing; only the services you enable and data you instruct us to process apply. This DPA does not authorize unrelated collection or the use of a disabled service.
We separately act as controller for our own account administration, business communications, billing and usage administration, agreement evidence, and necessary security and abuse prevention. The Privacy Policy describes that processing. A visitor's cookie choice is separate from your acceptance of this contract. Information that is genuinely anonymous is not personal data under this DPA.
Applicable data protection law includes the EU GDPR, UK GDPR and other privacy laws to the extent they govern the processing. Terms such as controller, processor, personal data breach and data subject have their meanings under the applicable law.
2. Instructions and your configuration
We will process Customer personal data only on documented lawful instructions to provide, maintain, secure and support the services. These instructions comprise this DPA, your enabled configurations, authorized API actions and written support requests. We will not sell Customer personal data, use it for our advertising or combine it into profiles for our own unrelated purposes.
If law requires other processing, we will inform you before processing unless that law prohibits notice. We will promptly inform you if, in our opinion, an instruction infringes applicable data protection law and may suspend the affected instruction while it is resolved.
You are responsible for lawful collection, the accuracy and necessity of the data you provide, your settings and integration choices, and the notices, permissions and lawful bases your websites require. SiteOS provides technical tools; automated checks, suggested settings and support do not constitute legal advice or guarantee legal compliance. This allocation does not remove SiteOS's own obligations under this DPA or applicable law.
Do not submit special-category data, criminal-offence data, payment-card credentials or other data requiring safeguards beyond this DPA unless we first agree suitable additional terms and measures in writing. Avoid unnecessary personal data in URLs, test scripts, logs, search queries and configuration text.
3. Confidentiality and security
We will limit access to people who need it for the services and ensure they are bound by confidentiality obligations or an appropriate statutory duty. We will maintain technical and organizational measures appropriate to the risks, taking account of the state of the art, implementation costs, processing and risks to individuals. Annex II describes the measures and their scope.
We may improve or replace a measure while maintaining an appropriate level of protection. We will not materially reduce the overall protection of Customer personal data during the agreement. You remain responsible for access you grant, your connected systems and your own copies of data.
4. Subprocessors and connected services
You give general written authorization to the subprocessors and processing activities listed in Annex III. We will require a written contract imposing materially equivalent data protection obligations, including applicable security and transfer duties, on each subprocessor. We remain responsible to you for its performance of those obligations.
We will give at least 30 days' notice of a new or replacement subprocessor before it processes Customer personal data, using the designated organization contact or an in-application notice. You may object during that period on reasonable data protection grounds. We will work with you on a reasonable alternative. If none is available, you may end the affected service before the change takes effect; we will return or delete its data under section 7. An unresolved objection is not treated as approval.
Providers you independently select, such as your Google Analytics account, Slack workspace, email provider or website tags, receive data on your instructions and under your arrangements with them. They are not our subprocessors merely because you connect them or control their tags through SiteOS. Where we engage a provider ourselves to process Customer personal data, this section applies regardless of its label.
5. Requests, assistance and incidents
Taking account of the nature of processing and information available to us, we will assist you with data-subject rights requests, security duties, breach notifications, data protection impact assessments and consultation with supervisory authorities. We will forward requests concerning Customer personal data to you without undue delay and will not respond substantively except on your instructions or as required by law.
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer personal data. We will provide available information about its nature, affected data and individuals, likely consequences, measures taken or proposed, and a contact point. We may provide information in phases without undue delay. We will investigate, contain and remediate the breach and cooperate with your lawful notification duties.
Use help@primeui.com for data protection requests or to report a suspected incident. Keep the contact details for your organization current. This DPA does not promise an uninterrupted service or a separate incident-response service level.
6. Information and audit
We will make information necessary to demonstrate compliance with our processor obligations available to you and allow and contribute to audits, including inspections, by you or an auditor you mandate. The parties may agree reasonable confidentiality, security, scheduling and scope arrangements that do not prevent an audit required by law or a supervisory authority.
Existing reports and documentation may be used where adequate; they do not replace mandatory audit rights. We will promptly tell you if we consider an audit instruction unlawful. Any reasonable assistance costs must be agreed in advance and must not obstruct our mandatory duties or the exercise of protected rights.
7. Duration, return and deletion
Processing continues while the applicable service is active and during the limited return and deletion periods below. You can use available export and deletion controls or send an authenticated request to help@primeui.com. We will verify the requester's authority without requesting unnecessary identity information.
At the end of the applicable service, we will, at your choice, return or delete Customer personal data and delete existing copies, unless law requires retention. Tell us if you want a return before deletion. We will complete the return or deletion from active systems within 30 days after the service ends or an agreed earlier deletion instruction, except to the extent retention is legally required. During that period we will restrict processing to return, deletion, protection of the data and lawful retention. If an instruction needs clarification, we will contact you promptly rather than silently extending retention.
Database backups are isolated from ordinary product use and expire under Annex II. Deleted data may therefore remain in an existing backup until that copy expires. We will not restore it to ordinary use; outstanding deletion instructions must be reapplied before a restored system resumes processing. If a failure prevents scheduled deletion, we will restrict the affected copies, investigate and complete deletion without undue delay, and inform you of a material delay affecting your request.
Any data retained by law will remain protected and restricted to that purpose and will be deleted when the requirement ends. Minimal deletion markers prevent late deliveries from recreating deleted records. Our separate, limited retention of account, security or contract evidence is not a reason to retain unrelated Customer personal data. We will confirm completion and any applicable retention exception on request.
8. International transfers
SiteOS is provided by a United States company. European hosting does not by itself prevent a restricted transfer, including through remote access. Annex III describes our suppliers and locations; SiteOS is not an EU-only service and does not claim a transfer certification.
We will make a restricted transfer only with an applicable lawful mechanism and required supplementary safeguards. Where no applicable adequacy decision covers a transfer from the EEA to SiteOS and the approved clauses are available for that transfer, the parties incorporate the European Commission Standard Contractual Clauses in the Annex to Decision (EU) 2021/914 of 4 June 2021 (SCCs) in full and without modification, with the selections below. The official SCC text is part of this agreement by reference.
- Module Two applies where you are a controller and SiteOS a processor; Module Three applies where you are a processor and SiteOS a subprocessor. Each applies only to the relevant transfer.
- Clause 7 (docking) applies. Clause 9(a) uses Option 2, general written authorization, with the 30-day notice period in section 4. The optional independent dispute-resolution provision in Clause 11(a) does not apply.
- Clause 17 uses Option 1 and the law of Ireland. Clause 18(b) specifies the courts of Ireland. These choices do not limit the SCCs' rights of individuals or competent authorities.
- Annex I below supplies the parties, transfer description and competent supervisory authority. Annex II supplies the measures. Annex III identifies the authorized subprocessors. The Customer's acceptance date and authenticated representative record identify its execution; SiteOS offers and agrees to these terms as part of providing the service.
For restricted transfers governed by the UK GDPR, the parties incorporate the UK International Data Transfer Addendum, version B1.0, in force 21 March 2022 (UK Addendum). Its official text applies with these completed Part 1 Tables:
The following is incorporated as the Alternative Part 2: Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.
The applicable transfer clauses prevail over conflicting provisions of this DPA or the Terms. The parties will perform the transfer assessments and supplementary measures required by applicable law and the clauses, and provide relevant information and cooperation. Inclusion of the clauses does not assert that every transfer assessment has already been completed. If the selected mechanism is unavailable or ceases to protect a transfer, we will implement a valid alternative or suspend that transfer and apply the return/deletion provisions. Onward transfers must receive the protection required by the applicable clauses.
9. US state privacy requirements
Where applicable US state privacy law treats SiteOS as your processor, service provider or contractor, we will process Customer personal data only for the limited business purposes specified in this DPA. We will not sell or share it for cross-context behavioral advertising, retain, use or disclose it outside those purposes or the direct business relationship, or combine it with personal data from other sources except as permitted by the applicable law.
We certify that we understand and will comply with these restrictions and will provide the level of protection required by applicable law. You may take reasonable steps to verify compliant use and, on notice, stop and remediate unauthorized use. We will notify you if we determine that we can no longer meet these obligations. Subcontracting, assistance and audit obligations in this DPA also apply to this processing.
10. Priority and responsibility
This DPA prevails over inconsistent Terms concerning Customer personal data. Mandatory law and applicable transfer clauses prevail over both. The Terms' liability provisions apply only to the extent lawful and consistent with those provisions; they do not waive data-subject rights or our own mandatory processor obligations.
This DPA covers all enabled SiteOS modules through one organizational agreement. It does not make SiteOS your legal adviser or transfer your configuration duties to SiteOS. Changes requiring renewed acceptance are versioned and presented through the service agreement flow. Previous acceptance records continue to identify the documents actually accepted at that time.
Annex I — parties and processing
Parties and contacts
Exporter / Customer: the organization identified in the accepted SiteOS Terms and associated account, order or written instructions. Its representative and contact email are recorded in the authenticated acceptance. Its business address and designated data protection contact are those supplied in its account/order or subsequently notified to SiteOS. The Customer must keep these details accurate and may supply or correct them at help@primeui.com. Its role is controller or processor as described in section 1; its relevant activity is using the selected services for its websites, applications or clients.
Importer / SiteOS: Prime UI, Inc., 1111b South Governors Ave STE 28388, Dover, DE 19904, United States; contact help@primeui.com. Role: processor or subprocessor. Activity: providing and supporting the services below. Start date: the Customer's acceptance of this version, or the later start of the relevant processing.
The competent EU supervisory authority is determined by Clause 13 of the SCCs: the authority for the exporter's relevant establishment, its designated representative where applicable, or an authority in a Member State in which affected individuals are located where that clause permits it. The exporter will identify the applicable authority on request. For the UK Addendum, the competent authority is the Information Commissioner's Office.
Processing description
Processing involves collection, receipt, validation, organization, storage, retrieval, analysis, configured disclosure or delivery, restriction, return, deletion and backup. Transfers occur as visitors use enabled features, tests and synchronization run, or authorized people give instructions. Duration follows section 7 and Annex II.
Data subjects may include your website visitors, form respondents, contacts appearing in indexed or tested content, and your personnel or clients represented in configurations and service results. Special categories and criminal-offence data are excluded unless separately agreed under section 2.
Optional Analytics recognition and profiles
In addition to baseline website events, enabled Analytics recognition processes a resource-scoped pseudonymous browser context, its grant and expiry evidence and links to later events. Optional identification processes a customer-backend-asserted opaque account or accepted-submission identifier and only the selected, permitted profile fields: email, display name and, for an account with email, the customer's verification assertion. Recognition is not proof of a logged-in account; a contact submission is not proof of the author's identity. Email alone does not merge profiles. Earlier cookieless history is not retroactively associated with an account.
The Customer determines whether to enable these purposes, configures matching consent and notices, and secures its backend signing key and identity source. SiteOS validates the signed assertion and current selected permission but does not independently audit the Customer's authentication or mailbox verification. Profile list, history, export and erasure access is restricted to authorized Customer owners and administrators; ordinary aggregate CLI/MCP access does not expose profile fields. The processing remains scoped to the selected Project environment, without cross-customer identity combination.
Analytics delivery buffer
Where durable Edge delivery is enabled, Cloudflare Workers, Durable Objects, private R2 storage and reference-only queues support delivery to the Analytics database. The buffer contains strict, minimized event envelopes: resource and event references, acceptance and expiry times and, where permitted, allowlisted page/event details, daily visitor pseudonyms, approximate country, region and city where available, device categories and scoped permission metadata or recognition lookup digests. Minimal pageview envelopes omit paths, technology, geography and visitor references. Raw IP addresses, User-Agent headers, recognition credentials, customer identity assertions, account subjects, emails, names and profile field values are not persisted in these envelopes. Identity and privacy lifecycle requests are forwarded without durable event buffering.
Delivery is revalidated against current resource settings, permissions and revocation before import. A buffer acknowledgement confirms persistence for delivery, not inclusion in a report. Queue messages contain references rather than visitor payloads. Storage location and global network processing are distinct; Annex III's location limits apply.
Annex II — safeguards and lifecycle
Technical and organizational measures
- Access: authenticated accounts, organization membership and roles; scoped API and agent permissions; service-specific authorization and organization isolation. Production administrative access and recovery material are restricted to authorized operators. Personnel must use access only for the authorized purpose.
- Transmission and credentials: HTTPS for public application and delivery endpoints; private database networking; secrets kept out of public configuration. Stored provider credentials use service encryption where implemented. Public website configurations are intentionally deliverable to website visitors and must not contain secrets.
- Integrity and change control: versioned source and releases, reviewed migrations and tests, bounded request validation, explicit publication of visitor-facing configurations, and recorded acceptance with exact document versions and integrity hashes.
- Availability and recovery: operational health checks, failure records, daily database/configuration backups and pre-release copies. Off-host copies are encrypted before upload to a separate private Cloudflare R2 EU repository. Recovery material is also held outside the production server. Database restoration is rehearsed in an isolated environment.
- Minimization and deletion: module-owned retention, customer deletion controls, restricted handling of incidents and support evidence, and retirement markers preventing stale requests from recreating deleted service data. Restoration includes reapplying outstanding deletion instructions before ordinary processing resumes.
These measures describe their stated scope. They do not represent a security certification, local-disk encryption, immutable storage, a guarantee against every failure, or a backup of every separate provider object. In particular, the coordinated database/configuration backup does not contain separate product R2 objects. Contact us before use if you require additional measures or a specific recovery or residency commitment.
Retention
The following service periods determine expiry eligibility; bounded maintenance removes expired records. Temporary processing failures may delay a pass and must be investigated. A legal hold or separately agreed requirement may apply only to the necessary data. The end-of-service deletion duties in section 7 apply even where an active-service record otherwise follows a longer lifecycle.
Analytics profile erasure removes directly identifying fields from active product use, hides the affected history and revokes linked contexts before bounded physical cleanup. It retains a resource-scoped subject digest and minimal deletion metadata to prevent delayed data or assertions from recreating the erased profile. The fence is eligible for removal after both 97 days from erasure and 97 days beyond the generation's original history deadline, and only when no linked contexts remain. This is restricted deletion/security metadata, not a claim of anonymization or permission to retain usable profile history. Expired identity challenges and signing-key metadata become eligible for bounded cleanup 24 hours after expiry or revocation. Browser cleanup storage and a visitor's full-opt-out preference have the purposes described in the Privacy Policy; they are not an extension of profile history. The backup and end-of-service duties above remain applicable.
Ask help@primeui.com for the settings applicable to your organization, a shorter supported period or help returning/deleting data. Network/security records processed for SiteOS's own purposes are described in the Privacy Policy; a product's content-retention setting does not change a network provider's independent security records.
Annex III — subprocessors and locations
The following are authorized for the stated services. A supplier receives only the data needed for its role. Locations distinguish the supplier's establishment and delivery/storage scope; they are not a promise that every request or support activity remains in one country.
Service login emails are delivered by Plus Five Five, Inc. (Resend), with primary processing in the United States, as described in our Privacy Policy. When an email-delivery feature uses SiteOS's Resend account to transmit Customer personal data on your instructions, Resend is also authorized as a subprocessor for that delivery under its DPA. See also Resend's Privacy Policy. Your own connected email or notification provider follows section 4 instead.
SiteOS remains responsible for maintaining the required supplier arrangements and safeguards. Contact help@primeui.com for further subprocessor or transfer information.