Data Processing Agreement pursuant to Art. 28 GDPR
Version: April 2026
Between the Client (hereinafter “Controller”) and NLTS Global Analytics s.r.o., Malá 43/6, 301 00 Pilsen, CZ (hereinafter “Processor”), operator of the service forensicprivacy.io.
§ 1 Subject Matter and Duration
(1) This agreement governs the processing of personal data by the Processor on behalf of the Controller in the context of forensic website analysis via the service forensicprivacy.io.
(2) The duration of this agreement corresponds to the duration of the main contract (for the use of the service). It terminates automatically upon termination of the main contract.
§ 2 Nature and Purpose of Processing
(1) The Processor performs technical analyses of websites for data protection compliance.
(2) This includes the collection and evaluation of technical website data: HTTP headers, cookies, trackers, DNS records and TLS configurations.
§ 3 Types of Personal Data
The following categories of personal data are processed:
Controller data:
- Email address
- IP address (stored for 7 days, then anonymised)
- File references / scan references
Scanned website data:
Exclusively publicly accessible technical data. No personal data of third parties is collected.
§ 4 Categories of Data Subjects
Data subjects are the customers and users of the service (Controller and their employees).
§ 5 Obligations of the Processor
The Processor undertakes to:
- Process personal data exclusively on the basis of documented instructions from the Controller (Art. 28(3)(a) GDPR).
- Ensure that all employees with access to personal data are bound by confidentiality obligations (Art. 28(3)(b) GDPR).
- Implement appropriate technical and organisational measures pursuant to Art. 32 GDPR (see TOM documentation).
- Assist the Controller in fulfilling data subject rights (Art. 15–22 GDPR).
- Delete all personal data within 30 days after termination of the contract, unless a statutory retention obligation applies.
- Tolerate and support audits and inspections by the Controller.
§ 6 Sub-Processors
(1) The Controller approves the sub-processors engaged at the time of contract conclusion. The current list is available at forensicprivacy.io/subunternehmer.
(2) The Processor shall inform the Controller prior to any intended change of sub-processors. The Controller may object within 30 days.
§ 7 Third-Country Transfers
(1) Where sub-processors are located in third countries (in particular the USA), transfers are based on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and/or an adequacy decision.
(2) Anthropic (AI-assisted expert reports): Usage is optional and only activated upon explicit request by the Controller. Without activation, no data is transmitted to Anthropic.
§ 8 Technical and Organisational Measures
The Processor implements technical and organisational measures pursuant to Art. 32 GDPR. The full documentation is available at forensicprivacy.io/tom.
§ 9 Deletion and Return
(1) Scan results are retained for 90 days and then automatically deleted.
(2) IP addresses are anonymised after 7 days.
(3) Upon request of the Controller, all personal data will be deleted immediately.
§ 10 Audit Rights
(1) The Controller has the right to conduct audits and inspections or to have them conducted by an appointed auditor.
(2) The Processor shall provide all relevant documentation and information for the audit.
(3) The costs for on-site inspections shall be borne by the Controller.
§ 11 Liability
The liability of the parties is governed by Art. 82 GDPR. Each party shall be liable to data subjects for damage caused by non-GDPR-compliant processing in accordance with the statutory provisions.
§ 12 Final Provisions
(1) Amendments and supplements to this agreement must be made in writing. This also applies to the waiver of this written form requirement.
(2) Czech law shall apply. The place of jurisdiction is Pilsen, CZ.
(3) Should individual provisions of this agreement be or become invalid, the validity of the remaining provisions shall remain unaffected.
Contact for data protection inquiries: [email protected]