Data processing terms (DPA)

Purpose of this addendum

This addendum applies when CVRLanding processes personal data on your behalf: data about the visitors, leads and customers of the pages you build and publish with us. It forms part of the terms of service and applies when you accept them.

It follows what laws such as the GDPR and UK GDPR require of a processor contract and supports your obligations under comparable rules in Vietnam and North America. It does not by itself make your use of CVRLanding lawful. On personal data, this addendum prevails over the terms.

Who is responsible for what

The controller decides why and how personal data is used; the processor handles it on the controller’s instructions. With CVRLanding, the roles split like this:

Ad platforms use the data you send them under the terms you accepted with them; that relationship is yours to manage.

Subject matter, nature and duration

We process personal data only to provide the service you configure, for as long as you use it plus the deletion period below:

• hosting your published pages, and collecting events and submissions from exported pages that keep managed analytics and forms;

• storing form submissions, booking requests and orders, and showing them in your inbox;

• consent-gated analytics and, if you enable it, masked session replay;

• email notifications, signed webhooks, and the pixel and server events you map;

• CSV files and other exports you request, and AI analysis on aggregated, redacted facts;

• security, backups and support.

Data subjects and categories of data

Visitors to your pages

• pseudonymous visitor and session ids, scoped to the visitor’s consent;

• device, browser and coarse location; the IP address is used to derive location and to block bots and abuse;

• campaign parameters (utm_*), the referring site and click ids such as gclid, fbclid and ttclid, the last only with advertising consent;

• consent choices with their version and time;

• interaction events: sections seen, scroll depth, clicks, form steps and errors, experiment assignment.

Events never contain what visitors type, passwords or payment details. A form error records only the field id and an error code.

Leads and customers

• name, phone number and email address;

• booking and order details, including the delivery address and payment method for cash on delivery;

• messages and answers submitted through your forms;

• status, tags, notes and the campaign each conversion came from.

Session replays

Replay is off by default. When you enable it, a visit is recorded only after the visitor accepts the replay consent category, and we store a masked recording of it. Form values, payment fields, chat widgets and elements you mark as private are masked, and recordings with known sensitive patterns are rejected.

Our obligations

As your processor, CVRLanding will:

• process personal data only on your documented instructions (these terms and your workspace settings) and tell you if an instruction appears to break data protection law;

• not sell the personal data or use it for our own purposes, including our own advertising;

• bind everyone with access to confidentiality and limit access to what each role needs;

• apply the security measures in the annex below;

• help you with data-subject requests, impact assessments and consultations with regulators;

• notify you without undue delay of a personal data breach affecting your data, with what we know and what we are doing about it;

• delete or return the data when the service ends.

Our support staff see read-only metadata by default. Deeper access is granted explicitly, limited in time and logged with a reason.

Sub-processors

You authorize the sub-processors below. Each is bound to data protection terms at least as protective as this addendum, and we remain responsible for their work.

We will publish the full list, with names and processing locations, before launch, and email workspace owners before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using the affected feature or end your subscription.

Paddle, ad platforms and the webhook destinations you configure are not our sub-processors.

International transfers

Our server locations will be stated with the hosting provider before launch. Some sub-processors, such as email and AI providers, may process data in other countries.

For transfers from the EEA or the UK to a country without an adequacy decision, we use the European Commission’s standard contractual clauses and the UK addendum, with extra safeguards where an assessment shows they are needed. Where those clauses apply, they prevail.

Vietnam’s personal data protection law sets its own conditions for transfers abroad, including a transfer impact assessment. We will meet the obligations that apply to us before launch and describe them here.

Your responsibilities

As controller, you decide what your pages collect and why. You are responsible for:

• a lawful basis for each purpose, with consent categories (analytics, advertising, replay) and regional defaults set to match;

• a privacy notice on your pages; the privacy notice builder helps, but the content is yours;

• not collecting special-category data, such as health or biometric data, or children’s data, without a lawful basis and the required safeguards;

• configuring pixels, server events and webhooks lawfully;

• answering requests from your visitors, leads and customers.

Requests from data subjects

Data subjects are the people the data is about. The inbox lets you find, export, correct and delete a person’s records. Deleting a lead removes their contact details and, under the retention rules, the raw events and replays linked to them; aggregated counts stay anonymous.

If someone contacts us about data from your pages, we forward the request to you without undue delay instead of answering it ourselves, unless the law requires otherwise. For help with a request, write to support@cvrlanding.com.

Deletion and return of data

You can export your data at any time, including during a retention period after your subscription ends. After that period, or when you delete your workspace or account, we delete the personal data we process for you from live systems, except what the law requires us to keep. The retention period and the time deletion takes will be stated here before launch.

Encrypted backups rotate on a configurable 7- or 30-day window, so deleted data leaves them as older backups expire.

Audits and information

On request, we provide the information reasonably needed to show that we meet this addendum, such as our security measures and sub-processor list. If that is not enough, you or an independent auditor bound by confidentiality may audit us on reasonable notice, normally no more than once a year, without disrupting the service or exposing other customers’ data.

Annex: security measures

• TLS for data in transit, including on custom domains;

• field-level encryption for phone numbers and email addresses, with keys kept outside the database;

• tenant isolation enforced in the API, database, file storage, analytics and background jobs;

• private files in non-public storage, served through expiring signed links;

• least-privilege access, mandatory two-factor authentication for our administrators, and audit logs;

• masking in session replay, and redaction in logs and AI prompts;

• webhooks signed with HMAC and a timestamp, sent over HTTPS only;

• daily encrypted backups stored off-host, with restores tested periodically;

• rate limits, bot detection and input validation on public endpoints.

We may change these measures over time, but not in a way that lowers the overall level of protection.

Contact

For questions or requests under this addendum, write to support@cvrlanding.com with ‘Privacy request’ in the subject.

The legal entity that operates CVRLanding, its registered address and its registration number will be stated here before launch. The governing law and the venue for disputes are to be confirmed before launch.