Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between Web Cue LLC (“TrackCrown”) ("we", "us", "Processor") and the customer that uses the TrackCrown Service ("Customer"). It applies whenever we process Customer Personal Data on Customer's behalf. It is incorporated into the Agreement by reference and needs no separate signature; if you need a countersigned copy, contact us using privacy@trackcrown.com.

1. Definitions#

"Applicable Data Protection Law" means the laws on data protection and privacy that apply to the processing of Customer Personal Data under the Agreement, including Regulation (EU) 2016/679 ("EU GDPR"); the EU GDPR as it forms part of UK law ("UK GDPR") and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection ("FADP"); and US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
"Customer Personal Data" means personal data in Customer Data that we process on Customer's behalf to provide the Service.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by us or our Sub-processors.
"Standard Contractual Clauses" or "SCCs" means the clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022).
"Sub-processor" means a third party we engage that processes Customer Personal Data.

"Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR; "business", "service provider", "sell" and "share" have the meanings given in the CCPA. Other capitalised terms have the meanings given in the Agreement.

2. Roles and scope#

2.1 Roles. Customer is the controller of Customer Personal Data, or a processor acting for its own clients (for example an agency acting for advertisers), and we are its processor or sub-processor. Where Customer acts as a processor, it confirms that its instructions, including our appointment, are authorised by the relevant controller, and Customer remains our single point of contact.

2.2 Our own processing. We act as an independent controller for account administration, billing, keeping the Service secure, preventing fraud and abuse across the Service, and investigating abuse reports, as described in our Privacy Policy. That processing is outside this DPA, but we apply the same security measures to it.

2.3 Details. The subject matter, duration, nature and purpose of the processing and the types of personal data and categories of data subjects are set out in Annex I.

3. Instructions#

3.1 Documented instructions. We process Customer Personal Data only on Customer's documented instructions, which are: the Agreement and this DPA; Customer's configuration and use of the Service, including the links, postbacks, feeds and API calls that Customer and its Authorised Users set up; and other reasonable written instructions consistent with the Agreement. We may process Customer Personal Data otherwise only where the law to which we are subject requires it; we will tell Customer about that requirement first unless the law prohibits it.

3.2 Unlawful instructions. We will inform Customer promptly if, in our opinion, an instruction infringes Applicable Data Protection Law, and we may suspend the affected processing until the instruction is confirmed or changed.

3.3 Customer's obligations. Customer is responsible for the lawfulness of its instructions; for having a legal basis for the processing; for giving the notices and obtaining the consents that tracking on its campaigns and websites requires, including for any click-ID cookie it enables or landing-page script it installs; and for not sending special categories of personal data or direct identifiers in clear text through link parameters, sub IDs or postbacks.

4. Confidentiality#

We ensure that our personnel authorised to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty, and access it only as needed to provide, support and secure the Service.

5. Security#

We implement and maintain the technical and organisational measures in Annex II, which are appropriate to the risk of the processing. We may update them, provided we do not reduce the overall level of protection. Customer is responsible for the security choices it makes in the Service, including managing Authorised Users and their roles, two-factor sign-in, API keys, postback tokens and approved destinations.

6. Sub-processors#

6.1 Authorisation. Customer gives us general authorisation to engage Sub-processors. Our current Sub-processors are listed on our Sub-processors page and in Annex III.

6.2 Notice of changes. At least 30 days before a new Sub-processor starts processing Customer Personal Data, we update the Sub-processors page and notify Customer's account owners by e-mail or in the panel.

6.3 Objection. Customer may object in writing on reasonable data-protection grounds within 30 days of our notice. We will discuss the objection in good faith and, where possible, offer a way to use the Service without the new Sub-processor. If we cannot resolve the objection within 30 days, Customer may terminate the affected part of the Service by written notice and we will refund prepaid fees for it for the remainder of the term.

6.4 Urgent replacement. If we must replace a Sub-processor urgently to keep the Service secure or available — for example because a provider stops its service — we may do so at once and will notify Customer promptly; the objection right in section 6.3 then runs from that notice.

6.5 Obligations. We impose on each Sub-processor, by written contract, data protection obligations that are no less protective than this DPA to the extent they apply to its services, and we remain responsible to Customer for its performance.

7. Data subject requests#

7.1 Assistance. Taking into account the nature of the processing, we assist Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects. Customer can find click and conversion records in the Service and through the API by click ID, advertising click ID, sub ID and time, and export them. On Customer's written request we will locate and delete records that Customer cannot delete itself, such as individual click records.

7.2 Requests we receive. If a data subject contacts us directly about Customer Personal Data, we will not respond on the substance of the request, except to tell the data subject that we have passed it on, and we will forward it to Customer without undue delay where we can identify Customer from the request.

8. Assistance with compliance#

Taking into account the nature of the processing and the information available to us, we assist Customer with its obligations on security, Personal Data Breach notification, data protection impact assessments and prior consultation with supervisory authorities, by providing this DPA, Annex II, our Security page and reasonable further information on request. We may charge reasonable fees for assistance that goes beyond what the Service and our documentation provide, unless the need for it results from our breach of this DPA.

9. Personal Data Breaches#

9.1 Notification. We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. We notify Customer's account owners by e-mail and in the panel.

9.2 Content. The notification will describe, as far as then known, the nature of the breach, including the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point. Where we cannot provide all the information at once, we will provide it in phases without undue further delay.

9.3 Response. We will take reasonable steps to contain, investigate and mitigate the breach and keep Customer informed. Unsuccessful attempts that do not compromise the security of Customer Personal Data, such as pings, port scans or failed sign-in attempts, are not Personal Data Breaches. Our notification is not an acknowledgement of fault or liability.

10. Audits#

10.1 Information. We make available to Customer the information necessary to demonstrate compliance with Article 28 GDPR and this DPA: this DPA and its annexes, our Security page, and written answers to a reasonable security questionnaire once a year.

10.2 Audits. If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, Customer or an independent auditor bound by confidentiality (and not a competitor of ours) may audit our compliance on at least 30 days' written notice, no more than once in any 12 months unless following a Personal Data Breach or required by a supervisory authority. Audits take place during business hours, follow a scope agreed in advance, must not disrupt the Service or put other customers' data or our security at risk, and are at Customer's expense. Audits of Sub-processors' facilities are satisfied by the audit reports and certifications those Sub-processors make available. This section also governs audits under the SCCs.

11. Return and deletion#

11.1 During the term. Customer can export Customer Personal Data at any time as CSV reports and through the API. Click and impression records are deleted automatically 13 months after collection; other Customer Personal Data is kept for the term of the Agreement unless Customer deletes it.

11.2 After termination. For 30 days after the Agreement ends, Customer may request an export of its Customer Personal Data. After that period we delete Customer Personal Data from our live systems within 30 days; deleted data is removed from backups as they expire, within 21 days. On written request we will confirm the deletion in writing.

11.3 Legal retention. If the law requires us to keep any Customer Personal Data, we will keep it confidential and process it only for that purpose.

12. International transfers#

12.1 Location. Customer Personal Data is hosted in India (see Annex III) and may be accessed from the United States and other countries where we or our Sub-processors operate.

12.2 EU transfers. To the extent that our processing involves a transfer of Customer Personal Data from the European Economic Area to a country that is not subject to an adequacy decision, the SCCs are incorporated into this DPA as follows: Module Two (controller to processor) applies where Customer is a controller and Module Three (processor to processor) where Customer is a processor; Clause 7 (docking clause) applies; under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period in section 6.2; the optional wording in Clause 11(a) does not apply; under Clause 13, the competent supervisory authority is determined as described in Annex I.C; under Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; under Clause 18(b), disputes are resolved by the courts of Ireland; and Annexes I, II and III of the SCCs are completed by Annexes I, II and III of this DPA.

12.3 UK transfers. For transfers subject to the UK GDPR, the UK Addendum is incorporated: Table 1 is completed with the parties' details in Annex I; Table 2 with the modules and options in section 12.2; Table 3 with the annexes of this DPA; and for Table 4 both the importer and the exporter may end the UK Addendum in accordance with its Section 19.

12.4 Swiss transfers. For transfers subject to the FADP, the SCCs apply as set out in section 12.2 with these changes: the Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; references to the GDPR include the FADP; and "Member State" includes Switzerland, so that data subjects there can bring claims where they habitually reside.

12.5 Onward transfers and precedence. We ensure that transfers to Sub-processors are protected by appropriate safeguards where Applicable Data Protection Law requires them. If the SCCs conflict with this DPA or the Agreement, the SCCs prevail.

13. US state privacy laws#

Where the CCPA or a similar US state law applies, we act as Customer's service provider or processor and we will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose, including a commercial purpose, other than the business purposes set out in the Agreement, or outside our direct business relationship with Customer; or (c) combine it with personal information we receive from others or collect from our own interactions, except as the law permits (for example to secure the Service and prevent fraud). We will comply with the obligations of a service provider or processor under those laws, provide the same level of privacy protection they require, and notify Customer if we can no longer meet them. Customer may take reasonable and appropriate steps to ensure that we use Customer Personal Data in line with those laws, including under section 10, and to stop and remediate unauthorised use. We certify that we understand and will comply with these restrictions.

14. Liability and precedence#

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Applicable Data Protection Law or the SCCs do not allow them to apply. As regards the processing of Customer Personal Data, this order of precedence applies: the SCCs, then this DPA, then the Agreement.

15. Term#

This DPA lasts for as long as we process Customer Personal Data on Customer's behalf.

Annex I — Details of processing#

A. Parties#

Data exporter: Customer, as identified in its account or Order Form; contact: Customer's account owner; role: controller (or processor acting for its clients); activities: use of the Service under the Agreement.
Data importer: Web Cue LLC (Delaware State File No. 7576591), 16192 Coastal Highway, Lewes, DE 19958, USA; contact: privacy@trackcrown.com; role: processor (or sub-processor); activities: providing the Service under the Agreement.

B. Description of the processing#

Item	Description
Categories of data subjects	People who view or click Customer's ads and tracking links or convert on Customer's (or its advertisers') websites; Customer's Authorised Users (staff, partners and advertisers using the Service); contacts of Customer's partners and advertisers recorded in the Service
Categories of personal data	IP address and the approximate location (country, region, city) and network operator derived from it; user agent and the device type, operating system, browser, device brand and model derived from it; browser language; referring page; tracking domain, link and destination address; click identifiers (our click ID; Google gclid, gbraid and wbraid; Meta fbclid; Microsoft msclkid; TikTok ttclid); campaign parameters, sub IDs and other link parameters; fraud and quality signals; conversion events (type, time, status, transaction reference, sale amount, revenue, payout, currency, advertiser values) and the IP address that reported them; postback delivery logs; for Authorised Users: name, e-mail address, role, sign-in sessions and audit-log entries (with keyed hashes of IP addresses); partner and advertiser contact and payout details entered by Customer
Sensitive data	None. Customer must not send special categories of personal data or data relating to criminal convictions
Frequency of transfer	Continuous, for the term of the Agreement
Nature of the processing	Collection through tracking endpoints, recording, storage, derivation of approximate location and device information, matching of conversions to clicks, aggregation into reports, transmission to the destinations, postback addresses and feeds Customer configures, retrieval through the panel and API, and deletion
Purpose	Providing the Service to Customer: click and conversion tracking, attribution, invalid-traffic detection, postbacks and feeds, reporting, billing calculations and support
Retention	For the term of the Agreement and as described in section 11; click and impression records 13 months; postback delivery logs 90 days (180 days for failed deliveries); backups 14 days (off-site copies up to 21 days)
Transfers to Sub-processors	As listed in Annex III, for hosting the Service, for the term of the Agreement

C. Competent supervisory authority#

Where Customer is established in an EU Member State, the supervisory authority of that Member State. Where Customer is not established in the EU but is subject to the EU GDPR under its Article 3(2) and has appointed a representative, the supervisory authority of the Member State where the representative is established; otherwise, the supervisory authority of the Member State in which the data subjects concerned are located. For transfers under the UK GDPR, the Information Commissioner's Office; under the FADP, the Federal Data Protection and Information Commissioner.

Annex II — Technical and organisational measures#

Area	Measures
Encryption in transit	HTTPS with TLS on every tracking domain, website, panel and API hostname, with certificates issued automatically for each hostname; HTTP Strict Transport Security; plain-HTTP requests are redirected to HTTPS at the same address
Network separation	Databases, cache and analytics store are reachable only on a private network; only the web front end is exposed to the internet
Authentication	Passwords hashed with argon2id, minimum 10 characters; optional TOTP two-factor sign-in with secrets encrypted using AES-256-GCM; session tokens and API keys stored only as SHA-256 hashes; session cookies are HttpOnly, SameSite=Lax and Secure; sign-in attempts rate-limited per IP address and account; sessions expire after 30 days of inactivity
Access control	Role-based access in every workspace (owner, admin, manager, analyst); partners and advertisers restricted on the server to their own records; API keys carry the same roles and restrictions; every query scoped to the signed-in workspace; reporting runs under a read-only analytics account with query time and size limits
Personnel	Access to production systems limited to personnel who need it and bound by confidentiality; production secrets kept out of source code and logs
Logging and monitoring	Audit log of changes to offers, partners, conversions, users, API keys and settings; IP addresses in security logs stored as keyed hashes; alerts for repeatedly failing postbacks
Data minimisation and retention	No cookies on tracking links by default; click and impression records deleted automatically after 13 months; expired sessions and one-time links purged automatically
Availability and resilience	Daily backups of the databases, retained for 14 days (database dumps are checked before they are kept), with optional off-site copies; documented restore procedure with a non-destructive restore drill; clicks are written to a local disk queue when the analytics store is unavailable so that tracking does not stop
Change management	Code is covered by automated unit and integration tests; releases are health-checked after deployment and can be rolled back to the last healthy version
Transparency and abuse prevention	Transparent links redirect only to approved destinations and otherwise show an error page; no cloaking or conditional-destination features; bot and data-centre traffic flagged; abuse reports investigated
Incidents	Personal Data Breach response and notification as described in section 9
Sub-processors	Contracts with data protection terms; hosting in professionally operated data centres (physical security provided by the hosting provider)

Annex III — Sub-processors#

Sub-processor	Service	Personal data	Location
DigitalOcean, LLC (United States)	Cloud infrastructure: virtual servers, storage and, where enabled, object storage for off-site backups	All Customer Personal Data processed by the Service	India (Bangalore data centre, BLR1)

The current list, including the optional sub-processors we use only where we have configured them and the providers that receive no personal data, is kept on our Sub-processors page.

Contact#

Web Cue LLC
16192 Coastal Highway, Lewes, DE 19958, USA
Registration: Delaware State File No. 7576591
Country of incorporation: United States
Privacy enquiries: privacy@trackcrown.com

Questions about this document?

Write to privacy@trackcrown.com or use our contact form.