Data Processing Agreement

1. Parties and Incorporation

This Data Processing Agreement (the "DPA") is between [Company Legal Name], of [Company Address] ("LinkProfit", "we", "us"), and the customer that has accepted our Terms of Service ("Customer", "you"). It forms part of those Terms, applies wherever we process personal data on your behalf, and prevails on data protection.

"Data Protection Law" means the GDPR (EU) 2016/679, the UK GDPR and Data Protection Act 2018, and any other applicable privacy law. Controller, processor, data subject, personal data, processing and personal data breach carry their GDPR meanings.

2. Roles of the Parties

You are the controller, and we are the processor, for personal data in your Workspaces: the users you invite, the metadata you configure, and the click data generated when someone follows a Short Link you created. A Partner is the controller for the End Customers it provisions, responsible for its own lawful basis, notices and consents and for equivalent terms with them. Nothing here makes us a party to that relationship.

We are an independent controller for account and billing data, security logs and our own business records; that processing is described in our Privacy Policy and falls outside this DPA.

3. Subject Matter, Duration, Nature and Purpose

We process personal data solely to provide the Platform on your instructions: resolving Short Links, producing analytics, operating the dashboards, sending transactional email under your brand, and administering subscriptions and payouts. Processing lasts for your subscription term and the retention periods in Section 10.

4. Categories of Data Subjects and Personal Data

Data subjects. Your personnel and other users you invite into a Workspace; for a Partner, the personnel of its End Customers; and visitors who follow Short Links you operate.

Data about users. Name, email address, password hash, role and Workspace membership, interface preferences, authentication events and support correspondence.

Data about link visitors. Request timestamp, the Short Link and Workspace involved, referrer, browser, operating system and device family, preferred language, an approximate location at country, region and city level, campaign parameters on the link, and a daily visitor hash. Raw IP addresses are not stored (Section 5).

Content you configure. Destination addresses, link titles, tags, folders, custom domains and any tracking pixels you attach, which may themselves reveal personal data.

We do not seek special categories of personal data and the Platform is not designed for them; do not use it for such data without first agreeing additional measures with us in writing.

5. Click Data and IP Addresses

When a request reaches our edge redirector, the visitor IP address is used in memory only, for two derivations, then discarded. We derive an approximate location, retaining only the coarse country, region and city. And we compute a daily visitor hash: a one-way SHA-256 hash of the IP address, the user agent string, the link domain and a secret salt rotated daily at 00:00 UTC, the previous value discarded. The address cannot be recovered from a stored hash, and hashes for one visitor cannot be correlated across days.

This is a property of the service, not an option, and applies to every Workspace on every plan. Where you attach third-party tracking pixels, that third party's processing falls outside this DPA and you control it.

6. Processing Instructions and Confidentiality

We process personal data only on your documented instructions: this DPA, the Terms of Service, the configuration you apply in the dashboards, and use of the interfaces by your authorised users. We will tell you if an instruction appears to infringe Data Protection Law, unless prohibited, and if law requires processing beyond your instructions we notify you first unless that law forbids it.

Persons authorised to process personal data on our behalf are bound by confidentiality obligations surviving their engagement, receive data protection training, and are granted access on a need-to-know basis.

7. Subprocessors

You grant us general authorisation to engage subprocessors. The current list at Subprocessors forms part of this DPA. Each is engaged under a written contract imposing obligations no less protective than these, and we remain liable for their performance.

We give at least thirty (30) days of notice before adding or replacing one, by email and in the dashboard. You may object within that period on reasonable, documented data protection grounds; if we cannot offer a reasonable alternative, you may terminate the affected part of the Platform without penalty as your sole remedy. Where a subprocessor must be replaced urgently to preserve security or continuity, we notify you without undue delay afterwards.

8. Security Measures

We maintain technical and organisational measures appropriate to the risk: encryption in transit using current TLS versions; encryption at rest across our database, analytics and cache providers; account and link passwords stored only as salted one-way hashes; tenant separation enforced at the data access layer by partner and workspace identifiers on every query touching tenant data; role-based access control within Workspaces; production access restricted to authorised personnel with multi-factor authentication and reviewed periodically; audit logging of administrative actions; automated dependency and vulnerability checks; backups with tested restoration; and a documented incident response process.

We may update these measures as technology develops, provided protection is not reduced. A current description is available on request.

9. Personal Data Breach Notification

We notify you without undue delay, and within seventy-two (72) hours, of becoming aware of a personal data breach affecting personal data processed on your behalf. The notification describes its nature, the categories and volume of data and data subjects concerned, the likely consequences, the measures taken or proposed, and a contact point; where the full picture is not available at once, we provide it in phases. We assist with your own notifications to supervisory authorities and data subjects, which remain your responsibility as controller.

10. Assistance, Deletion and Return

Taking into account the nature of the processing, we assist you with data subject rights requests, impact assessments and prior consultations, principally through the export, correction and deletion functions in the dashboards. A request that reaches us directly and concerns data we process on your behalf is forwarded to you without undue delay rather than answered substantively.

On termination you may export your data during a limited export window. Thereafter we delete or anonymise personal data processed on your behalf within thirty (30) days, except where law requires retention, in which case the retained data stays subject to this DPA. Analytics expire with the plan's retention period, up to 730 days, and backups are overwritten on their normal rotation.

11. International Transfers

Personal data may be transferred outside the European Economic Area and the United Kingdom, in particular to United States providers in the subprocessor list. We rely on the European Commission's Standard Contractual Clauses, incorporated here by reference, with the UK International Data Transfer Addendum where the UK GDPR applies, and on supplementary measures including encryption and data minimisation. Module Three applies to transfers from us to a subprocessor; Module Two between you and us where you are established outside the EEA. Copies of the executed mechanisms are available on request.

12. Audit and Information Rights

We make available the information reasonably necessary to demonstrate compliance, including our security documentation and any third-party assessments we hold. Where that is insufficient, you or an independent auditor you appoint, bound by confidentiality, may audit our compliance once in any twelve (12) month period, on thirty (30) days of written notice, during business hours, without unreasonable disruption and at your cost. A further audit may follow a breach affecting your data or a supervisory authority's requirement.

13. Liability, Duration and Contact

The limitations and exclusions of liability in the Terms of Service apply to claims under this DPA so far as Data Protection Law permits. It takes effect when you accept those Terms and continues while we process personal data on your behalf. Requests under it, including for executed transfer mechanisms or a signed counterpart, go to:

• [Company Legal Name]
• [Company Address]
• Email: privacy@linkprofit.com

This document is a template reflecting how the Platform operates and is not legal advice. Have it reviewed by a qualified lawyer and complete the bracketed details before relying on it.