Privacyboard
Start free

Data processing terms

Last updated 5 November 2026

These data processing terms (the “DPA”) form part of the Terms of use between you, the customer (“Controller”), and Antoine Milkoff, Entrepreneur individuel (sole trader), SIREN 832 251 805, 3ter Avenue Jeanne d’Arc, 94170 Le Perreux-sur-Marne, France, trading as Privacyboard (“Processor”). They apply automatically, without signature, from the moment you create an account, and meet the requirements of Article 28 of the GDPR, the UK GDPR and the Swiss FADP. If they conflict with the Terms of use on the processing of personal data, these terms prevail.

1. Subject, nature and purpose

The Processor processes personal data on behalf of the Controller only to provide the Service: hosting the Controller’s workspace, receiving and storing privacy requests sent through the Controller’s privacy center, recording cookie banner choices, sending the emails the Controller triggers, and running the website scans the Controller asks for. Annex 1 describes the processing.

2. Instructions

The Processor processes personal data only on the Controller’s documented instructions, including on transfers outside the European Economic Area, unless EU or Member State law requires otherwise; in that case it informs the Controller first, unless the law forbids it. The Terms of use, these terms and the Controller’s use and settings of the Service are its instructions. The Processor tells the Controller promptly if, in its opinion, an instruction infringes data protection law.

3. Confidentiality

Everyone the Processor authorises to process the personal data is bound by confidentiality. Access is limited to what is needed to run, secure and support the Service.

4. Security

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, described in Annex 2, and may update them as long as the overall level of protection does not decrease.

5. Personal data breaches

The Processor notifies the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data. It gives the information available to help the Controller meet its own obligations (nature of the breach, categories and approximate number of people and records, likely consequences, measures taken or proposed), and completes it as it learns more.

6. Subprocessors

The Controller gives general authorisation for the subprocessors listed in Annex 3. The Processor informs the Controller at least 30 days before adding or replacing a subprocessor, by email or through the vendor list on its privacy center (which anyone can subscribe to). The Controller may object on reasonable grounds within that period; if no solution is found, the Controller may end its subscription and receive a refund of the unused prepaid period. The Processor imposes on each subprocessor data protection obligations equivalent to these terms and remains liable for their performance.

7. International transfers

Where personal data is transferred outside the European Economic Area, the United Kingdom or Switzerland, the Processor relies on an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or on the standard contractual clauses approved by the European Commission, with the UK and Swiss addenda where needed.

8. Assistance

Taking into account the nature of the processing, the Processor helps the Controller, mainly through the features of the Service, to answer requests from people exercising their rights, and to meet its obligations on security, breach notification, impact assessments and prior consultation. If the Processor receives a request directly from a person concerned, it forwards it to the Controller and does not answer it itself, except to say it has been forwarded.

9. Return and deletion

The Controller can export its records at any time from the Service. When the account or a workspace is deleted, the Processor deletes the related personal data within 30 days; copies in backups are overwritten in their normal rotation. This does not apply to data the law requires the Processor to keep.

10. Audit and information

The Processor makes available the information needed to show compliance with these terms. The Controller may, at its own cost and with 30 days’ notice, audit compliance once a year, by itself or through an independent auditor bound by confidentiality, in a way that does not disrupt the Service or expose other customers’ data. Written answers and documentation are used first where they are enough.

11. Duration and liability

These terms apply for as long as the Processor processes personal data for the Controller. The limitations of liability in the Terms of use apply, except where the law does not allow them.

Annex 1: Details of the processing

  • People concerned: the Controller’s users and teammates; people who send a privacy request through the Controller’s privacy center; visitors of the Controller’s websites who answer its cookie banner; people named in records the Controller enters (such as contacts at its providers).
  • Personal data: names, email addresses and account identifiers; the content of privacy requests and the replies to them; cookie banner choices with a random visitor identifier, the date and the banner version (no IP address or user agent is stored with a choice); any other personal data the Controller chooses to enter.
  • Sensitive data: none is required. The Controller should not enter special categories of data unless a privacy request contains them.
  • Frequency and duration: continuous, for the duration of the subscription, then deletion as in section 9.

Annex 2: Security measures

  • Encryption of data in transit (TLS) and at rest.
  • Separation of customers’ data enforced in the database (row level security), with automated tests.
  • Optional two-factor authentication for users; two-factor authentication on all administrative access to infrastructure.
  • Role-based access within workspaces (owner, admin, editor, viewer).
  • Daily backups, rate limiting of public endpoints, hardened server-side fetching for website scans.
  • Minimal staff access, limited to running, securing and supporting the Service.

Annex 3: Subprocessors

  • Supabase: Database, authentication and file storage. Location: European Union (data stored in the EU; Supabase Inc. is a US company). Transfer safeguard: Standard contractual clauses.
  • Vercel: Application hosting and delivery. Location: United States and global edge network. Transfer safeguard: EU-US Data Privacy Framework.
  • Resend: Transactional emails (notifications, privacy request replies). Location: United States. Transfer safeguard: EU-US Data Privacy Framework.
  • Cloudflare: Website scans in a real browser, bot protection on forms. Location: United States and global network. Transfer safeguard: EU-US Data Privacy Framework.
  • Google Workspace: Support mailbox (messages you send us). Location: European Union and United States. Transfer safeguard: EU-US Data Privacy Framework.
  • Anthropic: AI assistance used by our team for development, maintenance and support. Location: United States. Transfer safeguard: Standard contractual clauses.

Questions about these terms: hello@privacyboard.io.