Data Processing Agreement

1. Scope and Applicability

This Data Processing Agreement ("DPA") supplements the EveryVisitor Terms of Service and applies to the extent that EveryVisitor Ltd. ("Processor") processes Personal Data on behalf of the Customer ("Controller") in the course of providing the EveryVisitor accessibility monitoring and scan engine services.

This DPA complies with the requirements of Article 28 of Regulation (EU) 2016/679 ("GDPR") and the UK General Data Protection Regulation ("UK GDPR").

2. Processing of Customer Personal Data

Subject Matter & Nature: Provision of automated website accessibility scanning, regression analysis, reporting, and issue collaboration.

Duration: For the term of the Customer's subscription, plus up to thirty (30) days after termination for deletion.

Categories of Data Subjects: Customer employees, contractors, agency clients, and authorized users who access the EveryVisitor platform.

Categories of Personal Data: Name, professional email address, organization affiliation, IP address, user account identifiers, and public HTML snippets extracted during automated page scans (with form values, email addresses and phone numbers removed before storage).

Instructions: Processor shall process Customer Personal Data solely in accordance with documented instructions from Controller, including with respect to transfers of personal data outside the UK or European Economic Area.

3. Technical and Organizational Security Measures (TOMs)

Processor implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption in Transit: All web traffic and API communications are encrypted using modern Transport Layer Security (TLS 1.3/1.2).
• Encryption at Rest: All database storage, object storage, and automated backups are encrypted. Webhook URLs and other secrets are additionally encrypted with AES-256-GCM; API keys are stored only as SHA-256 hashes.
• Multi-Tenant Isolation: Logical separation of data by organization identifier enforced across all database queries and repository layers. Cross-organization access attempts return 404 Not Found to prevent data enumeration.
• Access Controls: Role-based access control, mandatory time-based one-time passwords (TOTP) for administrative personnel, read-only and audited support access, and session revocation controls.
• Audit Logging: Append-only audit trail of administrative and security actions.

4. Subprocessors

Controller grants general authorization to Processor to engage the third-party subprocessors listed in our Subprocessors Registry (/legal/subprocessors).

Processor remains fully liable to Controller for the performance of each subprocessor's obligations. Processor shall notify Controller of any intended changes concerning the addition or replacement of subprocessors at least thirty (30) days in advance, providing Controller with the opportunity to object.

5. Data Subject Rights & Breach Notification

Assistance with Requests: Processor shall provide reasonable assistance to Controller to enable Controller to fulfill its obligations to respond to data subject requests under applicable Data Protection Laws. Users can export their own personal data and delete their accounts from their account settings.

Security Incident Notification: Processor shall notify Controller in writing without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

6. Deletion or Return of Personal Data

Upon termination of the Service or deletion of the Customer's organization, Processor shall, at the choice of Controller, return Customer Personal Data (through the available exports) and delete all Customer Personal Data from its systems, including backups on their normal rotation, within thirty (30) days, unless applicable statutory law requires retention of such data.