Processing of personal data on behalf of the site owner.

Purpose

This agreement applies when the OpenCookies banner is installed on a site: OpenCookies then processes the personal data of that site’s visitors on behalf of its owner. The site owner is the data controller; OpenCookies (Antoine Bartrolich) is its processor, within the meaning of Article 28 of Regulation (EU) 2016/679 (GDPR).

It applies from the installation of the banner on a site attached to an account and lasts as long as the service is used. It supplements the terms of use.

Description of the processing

• Purpose. Displaying the banner, applying visitors’ choices, keeping proof of their consent, measuring audience without cookies and spotting the third-party services contacted by the site.
• Data subjects. The visitors to the data controller’s sites.
• Data. Random consent identifier, choices by category, date, page, text version; page views, source, device type, performance and errors; with the visitor’s consent, random visitor and session identifier and journeys; names of detected third-party services and cookies (never their content). No IP address is recorded with this data.
• Retention periods. Consent proofs: 3 months (Free plan) or 13 months (Pro and Agency plans). Paths with an identifier: 13 months at most. Aggregated statistics: 25 months at most.

OpenCookies’ obligations

• Process the data only on the documented instruction of the data controller, that is, to provide the service, and inform it if an instruction appears to it to infringe the law.
• Guarantee confidentiality: the people authorized to process the data are bound by a duty of confidentiality.
• Implement the security measures described at the end of the page.
• Help the data controller respond to requests to exercise individuals’ rights, and comply with its security, impact assessment and notification obligations, taking into account the nature of the processing.
• Notify the data controller of any personal data breach as soon as possible and no later than 72 hours after becoming aware of it.
• Delete the data at the end of the service (see below) and provide the information needed to demonstrate compliance with these obligations.

Sub-processors

The data controller authorizes OpenCookies to use the following sub-processors: o2switch SAS (222-224 Boulevard Gustave Flaubert, 63000 Clermont-Ferrand, France), for hosting the service; GitHub, Inc. (Microsoft), only to run tests launched from the United States, for which it receives the tested domain.

OpenCookies imposes the same data protection obligations on its sub-processors and informs account holders of any change before it takes effect. The data controller may object by deleting its account.

Transfers outside the European Union

The data is hosted France (Clermont-Ferrand). For any transfer outside the European Union, the following safeguards apply: les clauses contractuelles types de la Commission européenne ou le cadre de protection des données UE-États-Unis.

End of the service and deletion

When the account or the site is deleted, the data attached to it is deleted from the database. It may remain for up to 14 days in the technical backups before being erased in turn. The data controller can export its consent proofs (CSV) from its customer area before deletion.

Audit

On written request to contact@opencookies.com, OpenCookies provides the information needed to demonstrate compliance with this agreement and allows reasonable audits, announced in advance, carried out by the data controller or by a third party bound by confidentiality.

Responsibilities of the data controller

The data controller remains responsible for the lawfulness of the processing: informing its visitors, choosing the categories and texts of the banner, keeping its privacy policy up to date and configuring the blocking of the third-party services it uses.

Security measures

• Encrypted communications (HTTPS) between the browser, the banner and the servers.
• Minimal collection: no IP address recorded with consent proofs, no cookie for audience measurement at the standard level.
• Data separated by account and by site, hashed passwords, protection against fraudulent form submissions, limits on the number of requests.
• Daily backups of the database, stored outside the site’s public folder, with an integrity check.
• Administration access limited to the people who need it.

Acceptance

This agreement is accepted by using the service. To obtain a signed copy or for any question, write to contact@opencookies.com.