Data processing agreement

1. Roles

For the conversion and visitor data your website sends through Convultra, you are the controller and Further Forward Innovation Ltd, trading as Convultra, is the processor. We collect that data on your instruction, hash any personally identifiable fields with SHA-256 before transmission to an advertising platform, and forward it only to the platforms you have connected. We do not use it to train models, build cross-customer audiences, or for any purpose other than delivering the service.

2. What the DPA covers

• The subject matter, duration, nature and purpose of processing.
• The categories of data subjects and personal data.
• Our obligations as processor, including confidentiality, security measures, sub-processor management, assistance with data subject requests, breach notification, and deletion or return of data at the end of the service.
• International transfers, including the UK International Data Transfer Addendum and EU Standard Contractual Clauses where they apply.
• Audit and information rights.

3. Sub-processors

We use a small set of infrastructure and service providers, each with a defined function. The current list is available on request and is provided with the DPA. We give thirty days' notice before adding a sub-processor, and customers on annual contracts may object.

4. Retention and deletion

Conversion and analytics records are kept for the history period of your plan and then deleted. When you delete a project or close your account, its data is deleted within 30 days. Data subject deletion requests from your end users are actioned on your instruction.

5. How to get it

Email privacy@convultra.com with your company name and the email address on your Convultra account. We send the DPA for e-signature and return the countersigned copy. The DPA is available on every plan at no charge. Enterprise customers can also negotiate custom terms and a service level agreement.