Data Processing Agreement

This DPA applies where, and only to the extent that, DCK VISIBILITY 360 processes Customer Personal Data on behalf of the Customer as a processor (or subprocessor) in the course of providing the Services, including through the Platform, the websites operated by DCK VISIBILITY 360, the DCK VISIBILITY 360 mobile applications for iOS and Android when made available (the "Apps"), the APIs, the Tracking Script and the reports generated by the Services.

This DPA does not apply to Personal Data that DCK VISIBILITY 360 processes as an independent controller, as described in clause 4.5. DCK VISIBILITY 360's processing of that Personal Data is governed by the Privacy Policy and Applicable Data Protection Law.

The Customer entering into the Agreement is the party to this DPA. Where the Customer's Affiliates or clients use the Services under the Customer's account, the Customer (a) enters into this DPA on their behalf, (b) remains the sole point of contact with DCK VISIBILITY 360 for all matters under this DPA, and (c) exercises any rights under this DPA on their behalf. Such Affiliates and clients are not third-party beneficiaries of this DPA except where Applicable Data Protection Law or the SCCs require otherwise.

This DPA takes effect on the date the Customer first accepts the Agreement or first uses the Services, whichever is earlier, and replaces any prior data processing terms between the parties relating to the Services.

Capitalised terms used but not defined in this DPA have the meanings given in the Terms of Service. In this DPA:

"Including" means "including without limitation", and references to a law include that law as amended or re-enacted.

This DPA is subject to the Terms of Service. In the event of any conflict or inconsistency between this DPA and the Terms of Service, this DPA prevails, but only to the extent the conflict or inconsistency relates to the processing or protection of Customer Personal Data. In all other respects, including limitation of liability, the Terms of Service prevail.

Where the SCCs (including as modified by the UK Addendum or the Swiss provisions in clause 15) apply, and there is any conflict between the SCCs and this DPA or the Terms of Service, the SCCs prevail to the extent of the conflict. Nothing in this DPA or the Terms of Service is intended to modify or contradict the SCCs or to prejudice the fundamental rights or freedoms of Data Subjects under Applicable Data Protection Law.

Where this DPA is silent on a matter relating to the processing of Customer Personal Data, the Terms of Service apply.

Customer as controller. As between the parties, the Customer is the controller of Customer Personal Data and determines the purposes and means of its processing. DCK VISIBILITY 360 processes Customer Personal Data as the Customer's processor.

Customer as processor (agencies and resellers). Where the Customer uses the Services on behalf of its own clients (for example, as a marketing, SEO or digital agency), the Customer acts as a processor for those clients and DCK VISIBILITY 360 acts as the Customer's subprocessor. In that case the Customer warrants and undertakes on a continuing basis that:

• (a)it has entered into a written agreement with each relevant client that is consistent with, and at least as protective as, this DPA, and that authorises the Customer to engage DCK VISIBILITY 360 and DCK VISIBILITY 360's Subprocessors;
• (b)the Customer's Instructions to DCK VISIBILITY 360, including its appointment of DCK VISIBILITY 360, have been authorised by the relevant client as controller;
• (c)it will promptly pass on to its clients any notices given by DCK VISIBILITY 360 under this DPA that are relevant to them, and DCK VISIBILITY 360 may satisfy any obligation to inform or notify a controller by notifying the Customer; and
• (d)it will be solely responsible for, and handle, all communications with and claims from its clients relating to the processing of their Personal Data.

Malaysian PDPA. For the purposes of the Malaysian PDPA, the Customer is the data controller and DCK VISIBILITY 360 is a data processor that processes Customer Personal Data solely on behalf of the Customer and not for its own purposes. DCK VISIBILITY 360 will comply with the obligations that the Malaysian PDPA imposes directly on data processors, including the Security Principle.

CCPA and Singapore PDPA. For the purposes of the CCPA, DCK VISIBILITY 360 is a "service provider" or "contractor" to the Customer, and clause 16 applies. For the purposes of the Singapore PDPA, DCK VISIBILITY 360 is a data intermediary processing Customer Personal Data on behalf of and for the purposes of the Customer.

DCK VISIBILITY 360 as independent controller. DCK VISIBILITY 360 is an independent controller (and not a processor) of Personal Data that it processes for its own purposes, including:

• (a)account, profile, log-in and authentication data of the Customer's authorised users, and communications with the Customer;
• (b)billing, payment, invoicing, tax and fraud-prevention records;
• (c)data processed to secure, maintain, monitor and protect the Services, DCK VISIBILITY 360 and its users, including security and audit logs, abuse prevention and enforcement of the Agreement and the Acceptable Use Policy;
• (d)the creation and use of aggregated, de-identified or anonymised data derived from the use of the Services (which is not Personal Data) to operate, analyse, benchmark, maintain and improve the Services and develop new products and features, provided that such data does not identify the Customer, any Visitor or any other individual;
• (e)Personal Data processed in connection with DCK VISIBILITY 360's own free HALO Report, the Sales Helper, DCK VISIBILITY 360's partner and referral programme, DCK VISIBILITY 360's own marketing and outbound communications, and the Tracking Script deployed on dckvisibility360.com; and
• (f)data that DCK VISIBILITY 360 is required to process to comply with law, legal process or the requests of a competent authority, or to establish, exercise or defend legal claims.

DCK VISIBILITY 360's processing as an independent controller is described in the Privacy Policy. Each party will comply with its own obligations under Applicable Data Protection Law in respect of the Personal Data for which it is a controller. Nothing in this DPA makes the parties joint controllers.

The Customer is solely responsible for the accuracy, quality and legality of Customer Personal Data, the means by which it acquired Customer Personal Data, and its Instructions. The Customer represents, warrants and undertakes on a continuing basis that:

• (a)it has, and will maintain throughout the term of the Agreement, a valid lawful basis under Applicable Data Protection Law for the processing of Customer Personal Data by DCK VISIBILITY 360 and its Subprocessors as contemplated by the Agreement;
• (b)it has provided, and will continue to provide, all notices to Data Subjects (including Visitors, leads and prospects) required by Applicable Data Protection Law, including a privacy notice that discloses the use of DCK VISIBILITY 360 as a service provider for website analytics, conversion tracking and content publishing, and, where the Malaysian PDPA applies, a notice in English and Bahasa Malaysia;
• (c)it has obtained, recorded and will honour all consents required by Applicable Data Protection Law, including any consent required under the ePrivacy Directive, PECR or equivalent laws before the Tracking Script is loaded or any information is stored in or read from a Visitor's device, and it will configure its consent management tools so that the Tracking Script does not load where consent is required but has not been given or has been withdrawn;
• (d)it will deploy the Tracking Script, and connect Connected Accounts, only on websites, domains, pages and accounts that it owns or controls or for which it has obtained the authorisation of the owner;
• (e)it will not use the Services to process, and will not configure the Services or upload content in a way that causes DCK VISIBILITY 360 to process, any special categories of Personal Data, "sensitive personal data" under the Malaysian PDPA (including biometric data), data relating to criminal convictions or offences, government identification numbers, financial account or payment card data, health data, or the Personal Data of children under the age of 18 or of any person below the age of digital consent in the relevant jurisdiction, and it will not deploy the Tracking Script on websites or pages directed at children;
• (f)it will not place Personal Data in page URLs, query strings, page titles, structured data or other page content collected by the Tracking Script, except to the extent necessary and lawful;
• (g)its Instructions comply, and will comply, with Applicable Data Protection Law, and DCK VISIBILITY 360's processing of Customer Personal Data in accordance with those Instructions will not cause DCK VISIBILITY 360 or any Subprocessor to breach Applicable Data Protection Law;
• (h)where it uploads contact, lead or prospect lists, or uses the Services to send or publish messages, it has obtained the data lawfully and has all consents and permissions required by anti-spam, direct-marketing and do-not-call laws, and complies with the Acceptable Use Policy; and
• (i)it will keep Customer Personal Data accurate and up to date and will use the tools in the Services to correct or delete Customer Personal Data where required.

The Customer is responsible for its own use of the Services, including configuring the Services, choosing the approval mode for publishing, securing its account credentials and the credentials of its Connected Accounts, and making appropriate use of the Services to ensure a level of security appropriate to the risk. The Customer's use of the Services must comply with the Acceptable Use Policy.

The Customer will notify DCK VISIBILITY 360 without undue delay if it becomes aware that any Customer Personal Data is being processed in breach of Applicable Data Protection Law, or that any of the warranties in clause 5.1 is no longer true.

Indemnity. To the maximum extent permitted by applicable law, the Customer will defend, indemnify and hold harmless DCK VISIBILITY 360, its Affiliates and their respective officers, directors, employees and agents from and against all claims, regulatory investigations, fines, penalties, losses, damages, liabilities, costs and expenses (including reasonable legal fees) arising out of or relating to (a) any breach by the Customer of clause 4.2 or clause 5, (b) any claim by a client of the Customer, a Visitor or another Data Subject relating to processing carried out in accordance with the Customer's Instructions, or (c) the Customer's failure to provide notices or obtain consents required by Applicable Data Protection Law. To the maximum extent permitted by applicable law, and except to the extent the Terms of Service expressly provide otherwise, the Customer's obligations under this clause 5.4 are not subject to any limitation or cap on the Customer's liability.

DCK VISIBILITY 360 will process Customer Personal Data only on the Customer's documented Instructions, including with regard to Restricted Transfers, unless required to do so by a law to which DCK VISIBILITY 360 is subject. In that case, DCK VISIBILITY 360 will inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Customer instructs DCK VISIBILITY 360 to process Customer Personal Data (a) to provide, maintain, secure and support the Services in accordance with the Agreement; (b) as initiated, configured or requested by the Customer and its authorised users through the Services, including through the Customer's settings, its choice of approval mode ("Auto-Publish" or "Review"), its Connected Accounts and its deployment of the Tracking Script; (c) as set out in Annex 1; and (d) to comply with other reasonable written instructions provided by the Customer that are consistent with the Agreement. The Agreement, this DPA and the Customer's configuration and use of the Services constitute the Customer's complete and final Instructions as at the date of this DPA.

Any additional or alternative Instructions must be agreed in writing by the parties and are subject to the Agreement. DCK VISIBILITY 360 may make compliance with any additional Instruction that is not supported by the standard functionality of the Services, or that would impose material additional cost or effort, conditional on the Customer paying DCK VISIBILITY 360's reasonable fees for doing so. If DCK VISIBILITY 360 is unable to follow an Instruction, it will inform the Customer and the Customer may, as its sole remedy, terminate the affected part of the Services in accordance with the Agreement.

DCK VISIBILITY 360 will immediately inform the Customer if, in its opinion, an Instruction infringes Applicable Data Protection Law, and may suspend processing under that Instruction until the Customer confirms or modifies it. DCK VISIBILITY 360 is not obliged to perform a comprehensive legal examination of the Customer's Instructions, and informing or failing to inform the Customer does not constitute legal advice or shift responsibility for the lawfulness of Instructions to DCK VISIBILITY 360.

DCK VISIBILITY 360 will ensure that its employees, contractors and authorised representatives who are authorised to process Customer Personal Data (a) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, (b) process Customer Personal Data only as necessary to perform their duties in connection with the Services, and (c) receive appropriate training on their data protection and security responsibilities.

DCK VISIBILITY 360 will limit access to Customer Personal Data to personnel who need it to provide, secure or support the Services, and will apply the access controls described in Annex 2.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of individuals, DCK VISIBILITY 360 will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against Personal Data Breaches, including the Security Measures in Annex 2.

The Customer acknowledges that the Security Measures are subject to technical progress and development. DCK VISIBILITY 360 may update or modify the Security Measures from time to time, provided that such updates do not result in a material reduction of the overall level of security of the Services.

The Customer has reviewed the Security Measures and agrees that, having regard to the nature of Customer Personal Data and the risks of processing, they provide a level of security appropriate to the risk. No method of transmission or storage is completely secure, and DCK VISIBILITY 360 does not guarantee that Customer Personal Data will be free from unauthorised access, loss or alteration.

The Customer is responsible for the security measures within its own control, including protecting its log-in credentials and those of its authorised users, enabling any available security features, managing authorised users and permissions, securing its websites and Connected Accounts, and backing up any Customer Content that it needs to retain.

General authorisation. The Customer grants DCK VISIBILITY 360 a general written authorisation to engage Subprocessors to process Customer Personal Data in accordance with this clause 9. Where the Customer acts as a processor, the Customer confirms that its controller has granted equivalent authorisation.

Current Subprocessors. The Customer specifically authorises the Subprocessors listed in Annex 3, which is also published at /legal/dpa. Certain providers listed in Annex 3 (for example payment processors and booking tools) process data for which DCK VISIBILITY 360 is an independent controller and are listed for transparency.

Notice of changes. DCK VISIBILITY 360 will give the Customer notice of any intended addition or replacement of a Subprocessor at least 14 days before the new Subprocessor begins processing Customer Personal Data, by updating the list in Annex 3 and, where practicable, by email to the account owner's address or by in-app notice. The Customer is responsible for reviewing the list. In an emergency (for example, where a change is needed urgently to maintain the security, integrity or availability of the Services), DCK VISIBILITY 360 may replace a Subprocessor on shorter notice, and will give notice as soon as reasonably practicable.

Objection. The Customer may object to a new Subprocessor by notifying DCK VISIBILITY 360 in writing at privacy@dckvisibility360.com within the notice period, stating reasonable grounds relating to data protection. If the Customer does not object within the notice period, it is deemed to have authorised the new Subprocessor. If the Customer objects on reasonable data-protection grounds, the parties will discuss the concern in good faith, and DCK VISIBILITY 360 may, at its option, (a) propose a commercially reasonable change to the Customer's configuration or use of the Services to avoid processing by the new Subprocessor, or (b) offer a reasonable alternative.

Sole remedy. If the parties do not resolve the objection within 30 days of DCK VISIBILITY 360's receipt of it, the Customer may, as its sole and exclusive remedy, terminate the affected Services (or the Agreement, if the affected Services cannot reasonably be separated) by written notice to DCK VISIBILITY 360, and DCK VISIBILITY 360 will refund any prepaid fees covering the unused remainder of the then-current subscription term for the terminated Services. No other refund, credit or compensation is payable.

Flow-down. DCK VISIBILITY 360 will enter into a written agreement with each Subprocessor that imposes data protection obligations that offer at least the same level of protection for Customer Personal Data as this DPA, to the extent applicable to the nature of the services provided by that Subprocessor. The Customer acknowledges that certain Subprocessors (including large cloud, AI model, payment and social media platform providers) offer only standard, non-negotiable terms, and agrees that DCK VISIBILITY 360 may rely on those standard terms where they meet the requirements of Applicable Data Protection Law.

Liability for Subprocessors. DCK VISIBILITY 360 remains responsible for the performance of its Subprocessors' obligations to the extent required by Applicable Data Protection Law, subject to clause 17.

Customer-chosen third parties. Third-party services that the Customer chooses to connect or publish to (including its website hosting, content management system, e-commerce platform, social media accounts, messaging channels and search-engine tools accessed through Connected Accounts) are not Subprocessors of DCK VISIBILITY 360 when they receive Customer Personal Data from the Services at the Customer's direction. The Customer's relationship with those third parties is governed by its own agreements with them, and DCK VISIBILITY 360 is not responsible for their processing.

Taking into account the nature of the processing, DCK VISIBILITY 360 will assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests by Data Subjects to exercise their rights under Applicable Data Protection Law (including rights of access, correction, deletion, restriction, objection, portability and to opt out of the sale or sharing of personal information).

The Customer acknowledges that the Services include self-service functionality that allows it to access, export (where available), correct and delete Customer Personal Data, and the Customer will use that functionality first. Where the Customer cannot fulfil a request using the self-service functionality, DCK VISIBILITY 360 will, on written request, provide reasonable additional assistance. Assistance beyond the self-service functionality is provided at the Customer's cost, at DCK VISIBILITY 360's then-current professional services rates, except where the request results from DCK VISIBILITY 360's breach of this DPA.

If DCK VISIBILITY 360 receives a request directly from a Data Subject relating to Customer Personal Data and is able to identify from the request that it relates to the Customer, DCK VISIBILITY 360 will promptly forward the request to the Customer and will not respond to the Data Subject other than to confirm receipt, direct the Data Subject to the Customer, or as required by law. The Customer is responsible for responding to the request.

Because the Tracking Script uses pseudonymous identifiers and anonymises IP addresses before storage, DCK VISIBILITY 360 may be unable to identify the Visitor data that relates to a particular individual. DCK VISIBILITY 360 is not required to collect additional information to identify a Data Subject solely in order to respond to a request.

Taking into account the nature of the processing and the information available to DCK VISIBILITY 360, DCK VISIBILITY 360 will provide reasonable assistance to the Customer with any data protection impact assessment, transfer impact assessment or prior consultation with a Supervisory Authority, the Commissioner or the PDPC that the Customer is required to carry out under Applicable Data Protection Law in relation to the Customer's use of the Services.

DCK VISIBILITY 360 will first meet this obligation by making available this DPA, the Security Measures, the Subprocessor list and other documentation that DCK VISIBILITY 360 makes generally available to its customers. Any further assistance is subject to the Customer paying DCK VISIBILITY 360's reasonable fees, unless Applicable Data Protection Law requires otherwise.

If DCK VISIBILITY 360 receives a request from a Supervisory Authority, the Commissioner, the PDPC or another regulator relating to Customer Personal Data, DCK VISIBILITY 360 will, where legally permitted, notify the Customer and will co-operate reasonably with the Customer in responding. DCK VISIBILITY 360 may respond directly where it is legally required to do so or where the request concerns DCK VISIBILITY 360's own obligations.

Notification. DCK VISIBILITY 360 will notify the Customer of a Personal Data Breach without undue delay, and in any event within 48 hours after becoming aware of it. Notification will be sent to the email address of the account owner and/or any security or privacy contact designated by the Customer in the Services, and the Customer is responsible for keeping those contact details current.

Content of notice. DCK VISIBILITY 360's notice will, to the extent the information is then available to DCK VISIBILITY 360, describe:

• (a)the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and Personal Data records concerned;
• (b)the name and contact details of DCK VISIBILITY 360's contact point from whom more information can be obtained;
• (c)the likely consequences of the Personal Data Breach; and
• (d)the measures taken or proposed to be taken by DCK VISIBILITY 360 to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

Phased information. Where, and insofar as, it is not possible to provide all of the information at the same time, DCK VISIBILITY 360 may provide it in phases without undue further delay as it becomes available.

Containment and co-operation. DCK VISIBILITY 360 will take reasonable steps to contain, investigate and mitigate the effects of the Personal Data Breach, and will provide reasonable co-operation and assistance to the Customer to enable the Customer to meet its own breach notification and record-keeping obligations, including:

• (a)under the Malaysian PDPA, notifying the Commissioner as soon as practicable and, where the breach causes or is likely to cause significant harm, within 72 hours after becoming aware of it, and notifying affected Data Subjects without unnecessary delay;
• (b)under the Singapore PDPA, assessing whether the breach is notifiable and, if so, notifying the PDPC no later than 3 calendar days after that determination, and affected individuals where required;
• (c)under the GDPR and UK GDPR, notifying the competent Supervisory Authority within 72 hours and Data Subjects where required; and
• (d)under the CCPA and US state breach laws, giving any notices the Customer is required to give.

Responsibility for notifications. The Customer is solely responsible for determining whether to notify, and for notifying, any regulator, Data Subject or other third party of a Personal Data Breach affecting Customer Personal Data, and for the content of any such notice. DCK VISIBILITY 360 will not notify regulators or Data Subjects of a Personal Data Breach affecting Customer Personal Data on the Customer's behalf unless the Customer instructs it to do so in writing and the parties agree the terms, or unless DCK VISIBILITY 360 is itself required to do so by law. The Customer will, where practicable and lawful, consult DCK VISIBILITY 360 before any public statement or notice that names or refers to DCK VISIBILITY 360.

No admission. DCK VISIBILITY 360's notification of, or response to, a Personal Data Breach is not an acknowledgement by DCK VISIBILITY 360 of any fault or liability with respect to the Personal Data Breach.

Export window. For 30 days after the termination or expiry of the Agreement (the "Export Window"), the Customer may export Customer Content that the Services make available for export, using the export tools then available in the Services (where available). DCK VISIBILITY 360 is not obliged to provide data in any format other than those supported by the Services, or to provide export assistance beyond those tools except at DCK VISIBILITY 360's then-current rates. During the Export Window DCK VISIBILITY 360 may suspend all other functionality of the Services.

Deletion. After the Export Window, DCK VISIBILITY 360 will delete Customer Personal Data from its active production systems, and will in any event complete deletion within 90 days after termination or expiry of the Agreement. Copies held in backups will be overwritten or deleted in the ordinary course as backups roll off, within 35 days after deletion from the active systems. Until they roll off, backups remain subject to this DPA and are not used for any purpose other than disaster recovery.

Deletion during the term. During the term of the Agreement, Customer Personal Data is retained and deleted in accordance with the retention periods in Annex 4 and the Customer's own deletions using the Services. The Customer may disconnect Connected Accounts and remove the Tracking Script at any time; Connected Account tokens are revoked or deleted within 7 days after disconnection.

Retention required by law. DCK VISIBILITY 360 may retain Customer Personal Data to the extent and for as long as required by applicable law, regulation, a court order or a legal hold, or to establish, exercise or defend legal claims, in which case DCK VISIBILITY 360 will continue to protect it in accordance with this DPA, limit processing to the purposes for which it is retained, and delete it when the requirement ends. This clause does not apply to data for which DCK VISIBILITY 360 is an independent controller, which is retained as described in the Privacy Policy.

Certification. On the Customer's written request made to privacy@dckvisibility360.com within 12 months after termination, DCK VISIBILITY 360 will provide written certification that it has deleted Customer Personal Data in accordance with this clause 13 (subject to clause 13.4). This certification satisfies any obligation under the SCCs to certify deletion.

DCK VISIBILITY 360 will make available to the Customer, on written request, information reasonably necessary to demonstrate DCK VISIBILITY 360's compliance with the obligations in this DPA and Article 28 of the GDPR (and equivalent provisions of Applicable Data Protection Law). DCK VISIBILITY 360 will meet this obligation first by providing (a) this DPA, the Security Measures and the current Subprocessor list, (b) written responses to the Customer's reasonable information-security and privacy questionnaires, not more than once in any 12-month period, and (c) where available, summaries of relevant internal or third-party security assessments.

The Customer agrees that the information in clause 14.1 will be used to satisfy its audit and inspection rights. The Customer (or an independent auditor appointed by it) may conduct an on-site audit or inspection of DCK VISIBILITY 360's processing of Customer Personal Data only where:

• (a)the information provided under clause 14.1 is not sufficient to demonstrate DCK VISIBILITY 360's compliance with this DPA and an audit is expressly required by Applicable Data Protection Law;
• (b)an audit is formally requested or required by a Supervisory Authority, the Commissioner, the PDPC or another competent regulator with jurisdiction over the Customer; or
• (c)a Personal Data Breach affecting Customer Personal Data has occurred, and the audit is limited to the matters relevant to that Personal Data Breach.

Any audit under clause 14.2 is subject to the following conditions:

• (a)it may take place no more than once in any 12-month period, except where required by a regulator or following a Personal Data Breach;
• (b)the Customer must give DCK VISIBILITY 360 at least 30 days' prior written notice, together with a proposed audit plan describing the scope, duration and start date, which the parties will agree in good faith;
• (c)it must be conducted during DCK VISIBILITY 360's normal business hours in Malaysia, in a manner that minimises disruption to DCK VISIBILITY 360's business, and may not exceed two business days;
• (d)the auditor must be independent, must not be a competitor of DCK VISIBILITY 360, and must enter into a confidentiality agreement acceptable to DCK VISIBILITY 360 before the audit begins;
• (e)the audit does not extend to DCK VISIBILITY 360's Subprocessors' facilities, to data of other customers, to DCK VISIBILITY 360's legally privileged material, or to information whose disclosure would compromise the security of the Services or breach DCK VISIBILITY 360's obligations to third parties;
• (f)the Customer bears all its own costs of the audit and reimburses DCK VISIBILITY 360 for its reasonable costs and time spent supporting the audit at DCK VISIBILITY 360's then-current professional services rates, unless the audit reveals a material breach of this DPA by DCK VISIBILITY 360; and
• (g)the Customer will provide DCK VISIBILITY 360 with a copy of the audit report free of charge, and all audit information and findings are DCK VISIBILITY 360's Confidential Information.

Where the SCCs apply, the Customer agrees that its audit rights under Clause 8.9 of the SCCs will be exercised in accordance with this clause 14, to the extent consistent with the SCCs.

Location of processing. The Customer acknowledges that DCK VISIBILITY 360 is operated by a business registered in Malaysia, and that DCK VISIBILITY 360 and its Subprocessors may process Customer Personal Data in Malaysia (where the Platform is hosted), in the United States, in the location of DCK VISIBILITY 360's hosting provider identified in Annex 3, and in the other countries identified in Annex 3. The Customer authorises those transfers, subject to this clause 15.

EEA transfers. To the extent that the Customer's transfer of Customer Personal Data to DCK VISIBILITY 360 is a Restricted Transfer under the GDPR, the SCCs are incorporated into this DPA by reference and apply as follows:

• (a)Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor;
• (b)the Customer is the "data exporter" and DCK VISIBILITY 360 is the "data importer";
• (c)Clause 7 (docking clause) does not apply;
• (d)in Clause 9(a), Option 2 (general written authorisation) applies, and the time period for prior notice of Subprocessor changes is 14 days, as set out in clause 9.3;
• (e)in Clause 11(a), the optional language does not apply;
• (f)in Clause 13, the competent supervisory authority is the supervisory authority determined in accordance with Clause 13(a) by reference to the data exporter's establishment or, where applicable, its representative under Article 27 of the GDPR; where the data exporter is not established in the EEA and has not appointed a representative, the competent supervisory authority is the Irish Data Protection Commission;
• (g)in Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland;
• (h)in Clause 18(b), disputes are resolved before the courts of Ireland;
• (i)Annex I.A of the SCCs is completed with the details of the parties in the Agreement (with the Customer's account details and DCK VISIBILITY 360's details in this DPA); the parties' acceptance of the Agreement constitutes their signature of the SCCs; Annex I.B is completed by Annex 1 of this DPA; Annex I.C is completed by sub-paragraph (f) above; Annex II is completed by Annex 2 of this DPA; and Annex III is completed by Annex 3 of this DPA;
• (j)for Module Three, where the Customer is a processor, DCK VISIBILITY 360 will inform the Customer (rather than the controller) of matters requiring notice under the SCCs, and the Customer will forward such notices to the relevant controller; and
• (k)the certification of deletion referred to in Clause 8.5 and Clause 16(d) of the SCCs will be provided only on the Customer's written request in accordance with clause 13.5, and the audits described in Clause 8.9 of the SCCs will be carried out in accordance with clause 14.

UK transfers. To the extent that the transfer of Customer Personal Data to DCK VISIBILITY 360 is a Restricted Transfer under the UK GDPR, the SCCs apply as modified by the UK Addendum, which is incorporated into this DPA by reference. For the purposes of the UK Addendum: Table 1 is completed with the parties' details in the Agreement and this DPA; Table 2 is completed by reference to the Modules and options selected in clause 15.2; Table 3 is completed by Annexes 1 to 3 of this DPA; and in Table 4, DCK VISIBILITY 360 as data importer may end the UK Addendum in accordance with its Section 19. The Mandatory Clauses of the UK Addendum apply.

Swiss transfers. To the extent that the transfer of Customer Personal Data to DCK VISIBILITY 360 is a Restricted Transfer under the FADP, the SCCs apply as set out in clause 15.2 with the following modifications: references to the GDPR are to be read as references to the FADP to the extent the transfer is subject to it; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" must not be interpreted so as to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence; and the governing law and forum in clauses 15.2(g) and 15.2(h) remain unchanged.

Malaysian PDPA. Where DCK VISIBILITY 360 transfers Customer Personal Data out of Malaysia (including to Subprocessors), it will do so only in accordance with section 129 of the Malaysian PDPA, as amended, including where the destination has a law that is substantially similar to the Malaysian PDPA or ensures an adequate level of protection at least equivalent to it, or where another ground permitted by section 129 applies, including the transfer being necessary for the performance of the Agreement. DCK VISIBILITY 360 will take reasonable steps to ensure that Customer Personal Data transferred will not be processed in a manner that would contravene the Malaysian PDPA if processed in Malaysia.

Singapore PDPA and other jurisdictions. Where Customer Personal Data subject to the Singapore PDPA is transferred outside Singapore, DCK VISIBILITY 360 will provide it a standard of protection comparable to that under the Singapore PDPA, including through legally enforceable obligations on Subprocessors. Where the law of another jurisdiction requires a transfer mechanism, the SCCs apply with the modifications that law requires, or the parties will co-operate in good faith on a reasonably required alternative.

Onward transfers and transfer impact assessments. DCK VISIBILITY 360 will ensure that Restricted Transfers to Subprocessors are subject to an appropriate transfer mechanism (such as the SCCs or an adequacy decision, including the EU-US Data Privacy Framework where a Subprocessor is certified). On request, DCK VISIBILITY 360 will provide reasonable information, to the extent available to it, to assist the Customer with any transfer impact assessment.

Alternative mechanisms. If any transfer mechanism relied on under this clause 15 is invalidated, amended or replaced, DCK VISIBILITY 360 may adopt a compliant replacement mechanism by notice to the Customer (including by updating this DPA), and the Customer will execute any documents reasonably required to give effect to it.

This clause 16 applies to the extent that Customer Personal Data includes "personal information" of California "consumers" (as defined in the CCPA) that DCK VISIBILITY 360 processes on behalf of the Customer. The Customer discloses that personal information to DCK VISIBILITY 360 only for the limited and specified business purposes of providing the Services as described in the Agreement and Annex 1 (the "Business Purposes").

DCK VISIBILITY 360 will not:

• (a)"sell" or "share" (as those terms are defined in the CCPA) the personal information, including for cross-context behavioural advertising;
• (b)retain, use or disclose the personal information for any purpose (including any commercial purpose) other than the Business Purposes, or as otherwise permitted for service providers and contractors by the CCPA;
• (c)retain, use or disclose the personal information outside the direct business relationship between DCK VISIBILITY 360 and the Customer; or
• (d)combine the personal information with personal information that DCK VISIBILITY 360 receives from or on behalf of another person, or collects from its own interactions with the consumer, except as permitted for service providers and contractors by the CCPA and its regulations (including to detect security incidents, protect against fraudulent or illegal activity, and build or improve the quality of the Services without building or modifying household or consumer profiles for another business).

DCK VISIBILITY 360 will comply with the obligations applicable to it under the CCPA and will provide the same level of privacy protection to the personal information as required of businesses by the CCPA. DCK VISIBILITY 360 will notify the Customer if it determines that it can no longer meet its obligations under the CCPA.

The Customer may, on reasonable written notice, take reasonable and appropriate steps to ensure that DCK VISIBILITY 360 uses the personal information in a manner consistent with the Customer's obligations under the CCPA, and to stop and remediate any unauthorised use of the personal information, in each case in accordance with the procedures in clauses 10 and 14.

DCK VISIBILITY 360 will assist the Customer in responding to verifiable consumer requests as described in clause 10. DCK VISIBILITY 360 may engage Subprocessors as service providers or contractors in accordance with clause 9, under written contracts that comply with the CCPA.

DCK VISIBILITY 360 certifies that it understands the restrictions in this clause 16 and will comply with them.

Each party's liability arising out of or related to this DPA (including the SCCs to the extent permitted by the SCCs), whether in contract, tort (including negligence), breach of statutory duty or under any other theory of liability, is subject to the exclusions and limitations of liability in the Terms of Service.

The limitation of liability in the Terms of Service (being, as at the date of this DPA, an aggregate cap equal to the fees paid by the Customer for the Services in the 12 months preceding the claim) applies in the aggregate to all claims under the Agreement and this DPA together, and is not a separate or additional cap for this DPA. Any reference in the Terms of Service to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together.

To the maximum extent permitted by applicable law, nothing in this DPA creates any separate, additional or uncapped liability of DCK VISIBILITY 360, including for regulatory fines or penalties imposed on the Customer, which remain the Customer's responsibility except to the extent they result directly from DCK VISIBILITY 360's breach of this DPA and cannot lawfully be excluded.

Nothing in this DPA limits either party's liability to Data Subjects under Clause 12 of the SCCs or any other liability that cannot be limited or excluded under applicable law.

This DPA remains in effect for as long as DCK VISIBILITY 360 processes Customer Personal Data on behalf of the Customer, notwithstanding the expiry or termination of the Agreement, and terminates automatically when DCK VISIBILITY 360 has deleted all Customer Personal Data in accordance with clause 13.

The Customer may not terminate this DPA separately from the Agreement, except as provided in clause 9.5. Termination of the Agreement for any reason terminates the Customer's right to use the Services under this DPA.

Clauses 5.4, 12.5, 12.6, 13, 17, 19 and any other provisions that by their nature are intended to survive, survive termination or expiry of this DPA.

Except as provided in clause 15 in relation to the SCCs (and the UK Addendum and Swiss provisions), this DPA is governed by the law that governs the Terms of Service, and the governing law and dispute-resolution provisions of the Terms of Service apply to any dispute arising out of or in connection with this DPA.

Where Applicable Data Protection Law requires that this DPA be governed by the law of a particular jurisdiction or that disputes be resolved in a particular forum, that requirement applies only to the extent mandatory and only to the provisions concerned.

Changes. DCK VISIBILITY 360 may update this DPA from time to time, including to reflect changes in Applicable Data Protection Law, guidance from regulators, the Services or its Subprocessors. DCK VISIBILITY 360 will publish the updated DPA at /legal/dpa and, for material changes, notify the Customer by email or in-app notice at least 14 days before they take effect, unless a shorter period is required by law or a regulator. No update will (a) reduce the overall level of protection for Customer Personal Data under this DPA, or (b) modify the SCCs other than to adopt a valid replacement mechanism under clause 15.8. The Customer's continued use of the Services after the effective date constitutes acceptance of the updated DPA.

Notices. Notices to DCK VISIBILITY 360 under this DPA must be sent by email to privacy@dckvisibility360.com, addressed to DCK VISIBILITY 360's data protection officer (the DCK VISIBILITY 360 Data Protection Officer (privacy@dckvisibility360.com)). DCK VISIBILITY 360 may give notices to the Customer by email to the account owner's address, through the Services or by updating this page where this DPA permits.

Severability and third parties. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force. Except as provided in the SCCs or required by Applicable Data Protection Law, no person other than the parties may enforce this DPA.

Entire agreement. This DPA, together with the Agreement, constitutes the entire agreement between the parties regarding the processing of Customer Personal Data and supersedes any prior agreements, proposals or communications on that subject, including any data processing terms proposed by the Customer, which do not apply unless expressly agreed in writing and signed by an authorised representative of DCK VISIBILITY 360.

Encryption and credential protection.

• (a)Data in transit between browsers, the Apps, the Tracking Script and the Services is encrypted using TLS 1.2 or higher.
• (b)OAuth tokens, API keys and other Connected Account credentials are encrypted at rest at field level using authenticated symmetric encryption (Fernet, AES-based with HMAC authentication), with keys held separately from the encrypted data.
• (c)Customer passwords are stored only as salted one-way hashes using an industry-standard adaptive hashing algorithm, never in plaintext.
• (d)Identifiers needed only for rate-limiting, abuse prevention or audit (such as IP addresses in admin audit logs) are stored only as salted hashes (such as salted SHA-256).

Data minimisation by design.

• (a)The Tracking Script never reads or transmits form field values; conversion events record only the form action URL, page, referrer and UTM parameters.
• (b)Visitor IP addresses are anonymised (truncated) at ingestion; country is derived before truncation and the full IP address is not retained.
• (c)Visitors are identified only by pseudonymous identifiers stored in their browser.

Access control.

• (a)Role-based access control and least privilege apply to administrative access to the Platform and infrastructure, granted on a need-to-know basis and revoked promptly when no longer required.
• (b)Platform administrator accounts require two-factor authentication (TOTP), with single-use recovery codes stored only in hashed form.
• (c)Authentication tokens have limited lifetimes; restricted functions such as the Sales Helper use hashed access codes, lockouts and rate limits.

Tenant isolation.

• (a)Each Customer's data is logically separated by account, organisation and site identifiers, with access controls enforced in the application layer on every request.
• (b)Hosted blog content is isolated by hostname and associated only with the relevant Customer site.

Logging and monitoring.

• (a)Administrative actions are recorded in an audit log that stores salted IP hashes rather than raw IP addresses.
• (b)System, job and error logs are monitored to detect failures, anomalies and suspicious activity, and rate limiting and abuse detection protect public endpoints, including Tracking Script ingestion and free report forms.

Network, infrastructure and physical security.

• (a)The Platform is served behind Cloudflare's CDN, DDoS mitigation and web application firewall.
• (b)Production servers are accessed only by authorised personnel using key-based authentication, with firewalls limiting exposed services and separation of production and development environments.
• (c)Physical and environmental security of data centres is provided by DCK VISIBILITY 360's hosting and infrastructure Subprocessors.

Secret management.

• (a)Secrets, encryption keys and API credentials are kept outside source code in restricted configuration stores and are rotated where compromise is suspected or personnel with access leave.

Backups and resilience.

• (a)Databases are backed up on a rolling basis (retained up to 35 days) under access controls, and restoration procedures are maintained and periodically tested.

Vulnerability management and secure development.

• (a)Operating systems, frameworks and dependencies are kept up to date, with security patches applied in a timeframe proportionate to severity.
• (b)Code changes are reviewed and tested before deployment; inputs are validated and HTML in published content and Backlink Network placements is sanitised to mitigate injection and cross-site scripting.
• (c)Vulnerabilities may be reported responsibly to privacy@dckvisibility360.com and are triaged and remediated according to severity.

Incident response.

• (a)DCK VISIBILITY 360 maintains an incident response process covering detection, containment, recovery, notification (within the timelines in clause 12) and post-incident review, and documents incidents and remedial actions.

Personnel and vendors.

• (a)Personnel with access to Customer Personal Data are bound by confidentiality and receive role-appropriate security guidance; breaches of security requirements attract disciplinary or contractual measures.
• (b)Subprocessors are selected having regard to their security practices, bound by written terms under clause 9, and given only the access they need.

Retention, deletion and controller support.

• (a)Data is retained and deleted in accordance with Annex 4 and clause 13, including automated clean-up of crawled page content and logs; Connected Account tokens are revoked or deleted within 7 days after disconnection.
• (b)The Services provide tools to access, export (where available), correct and delete Customer Personal Data, disconnect Connected Accounts and remove the Tracking Script, supporting Data Subject requests under clause 10.