OneTrueTag Data Processing Agreement

Version: [[VERSION]] · Effective date: [[EFFECTIVE_DATE]] · Last updated: 2026-10-14 (draft)

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Terms") between [[ENTITY_NAME]], [[ADDRESS]] ("OneTrueTag", the "Processor"), and the business that holds the Account (the "Customer", the "Controller"). It applies from the date the Customer accepts the Terms. Capitalised terms not defined here have the meaning given in the Terms.

1. Definitions

1.1 Data Protection Laws: all laws on personal data that apply to the processing under this DPA, including: Regulation (EU) 2016/679 ("GDPR"); the UK GDPR and Data Protection Act 2018 ("UK Law"); the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and its secondary legislation; UAE Federal Decree-Law No. 45 of 2021 ("UAE PDPL"), the DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021; the Saudi Personal Data Protection Law and its implementing and transfer regulations ("KSA PDPL"); Qatar Law No. 13 of 2016; Bahrain Law No. 30 of 2018; the Data Privacy Protection Regulation of Kuwait's Communication and Information Technology Regulatory Authority ("CITRA Regulation"); and Oman Royal Decree No. 6/2022 and its Executive Regulations; each as amended.

1.2 Customer Personal Data: personal data in Customer Data that OneTrueTag processes on the Customer's behalf under the Terms, as described in Annex 1.

1.3 Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

1.4 Sub-processor: a third party engaged by OneTrueTag to process Customer Personal Data, as listed in Annex 3.

1.5 SCCs: the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.

1.6 "Controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR, and the equivalent terms in the other Data Protection Laws (in KVKK, "veri sorumlusu" and "veri işleyen").

2. Roles and scope

2.1 For Customer Personal Data, the Customer is the controller and OneTrueTag is the processor. Where the Customer acts as processor for another controller, OneTrueTag is its sub-processor and the Customer is responsible for passing on this DPA's commitments and for obtaining that controller's authorisations.

2.2 OneTrueTag is a controller, not a processor, for: the account data of the Customer's Members; billing data; support requests to OneTrueTag; the login of an End Customer's optional customer account; and security logs. That processing is described in the privacy policy.

2.3 A Third-Party Service the Customer connects (Annex 3, Part B) is not a Sub-processor. Data sent to it on the Customer's instruction leaves this DPA and is governed by the Customer's agreement with its provider.

3. Customer's instructions and obligations

3.1 The Terms, this DPA, the Customer's configuration of the Service (including the Plan, retention settings, consent mode, connected services and form questions) and the Customer's use of the panel, the API and the MCP server are the Customer's documented instructions. Further instructions must be in writing and consistent with the Terms.

3.2 The Customer is responsible for the lawfulness of the processing it instructs, including: a lawful basis for each purpose; the notices it gives to End Customers (including its own privacy notice, linked from the Scan Pages through the brand settings); consent for news and offers; any registration with an authority that applies to it as controller; and whether custom form questions collect special category data.

4. OneTrueTag's obligations

OneTrueTag will:

4.1 process Customer Personal Data only on the Customer's documented instructions, including for transfers, unless required otherwise by law, in which case it will inform the Customer before processing unless the law prohibits it;

4.2 inform the Customer without delay if, in its opinion, an instruction breaches Data Protection Laws;

4.3 ensure that persons it authorises to process Customer Personal Data are bound by confidentiality;

4.4 implement the technical and organisational measures in Annex 2, and keep them at a level appropriate to the risk;

4.5 follow Section 7 when engaging Sub-processors;

4.6 assist the Customer, taking into account the nature of the processing, with data subject requests (Section 6), security, breach notification (Section 5), data protection impact assessments and prior consultation with authorities, to the extent the information is available to OneTrueTag;

4.7 delete or return Customer Personal Data at the end of the Services under Section 9;

4.8 make available the information needed to demonstrate compliance with this DPA and allow audits under Section 8;

4.9 not sell Customer Personal Data, not use it for its own purposes, and not combine it with data from other customers, except in aggregated form that identifies no person or Customer, to operate and secure the Service.

5. Personal Data Breach

5.1 OneTrueTag will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach, by email to the Account owner and to the Members who manage the Account.

5.2 The notice will describe, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first will be provided in phases.

5.3 OneTrueTag will take reasonable steps to contain the breach and reduce its effects, and will cooperate with the Customer's notifications to authorities and data subjects. Notification by OneTrueTag is not an admission of fault.

6. Data subject requests

6.1 The Service provides tools for the Customer to answer requests itself: viewing customer records, exporting the customer list (CSV) on the Plans that include it, exporting everything held about one End Customer (a JSON file, on every Plan), deleting one End Customer's data (on every Plan), and receiving End Customers' deletion and export requests made through the privacy request feature on the Scan Pages and in the customer account, with a notification to the Members who may delete customer data and a 30-day deadline. The Customer answers each request in the Service (deletion, the copy emailed to the End Customer, or a refusal with a reason), and the End Customer is told the outcome by email. Deletion removes the End Customer's records and files from the Service, keeps non-personal statistics, and leaves a record that the deletion took place (who, when, an internal identifier). Copies the Customer has pushed to a Third-Party Service (such as its CRM) are deleted by the Customer there.

6.2 If OneTrueTag receives a request directly from an End Customer about Customer Personal Data, it will pass it to the Customer without undue delay and will not answer it except to say that it has been passed on, unless the Customer authorises otherwise.

6.3 Where the tools are not enough, OneTrueTag will provide reasonable further assistance on request.

7. Sub-processors

7.1 The Customer gives general authorisation for OneTrueTag to engage Sub-processors. The current list is in Annex 3 and at [[LEGALBASEURL]]/sub-processors.

7.2 OneTrueTag will give at least 30 days' notice of a new or replacement Sub-processor by email to the Account owner and by updating the list.

7.3 The Customer may object in writing on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith. If OneTrueTag cannot offer a reasonable alternative, the Customer may terminate the affected part of the Service before the change takes effect and receive a pro-rata refund of prepaid fees for it.

7.4 OneTrueTag will impose on each Sub-processor, by written contract, data protection obligations that are no less protective than this DPA, and remains responsible to the Customer for its Sub-processors' performance.

8. Audits

8.1 OneTrueTag will answer reasonable written security and privacy questionnaires once a year, and provide on request a description of its measures and its records of processing as they relate to the Customer.

8.2 OneTrueTag holds no third-party security certification at the date of this DPA. If it obtains one, it will provide the report under confidentiality in place of an audit where the report covers the matter.

8.3 Where the information under 8.1 is not enough to demonstrate compliance, or where an authority requires it, the Customer may carry out an audit, by itself or by an independent auditor bound by confidentiality, once in any 12-month period, on at least 30 days' written notice, during business hours, without access to other customers' data, and at the Customer's cost. The parties will agree the scope in advance.

9. Deletion and return

9.1 During the subscription the Customer can export and delete Customer Personal Data with the Service's tools.

9.2 Retention while the Account exists follows the Plan, as described in the Terms (Section 13): automatic deletion of customers inactive for 12 months on the Plans where it applies, and the grace period of 3 months (monthly) or 12 months (annual) after a paid subscription ends.

9.3 When the Account owner deletes the Account, deletion is scheduled for 30 days later and can be undone during that time. After 30 days OneTrueTag deletes Customer Personal Data, except where the law requires it to be kept. Copies in backups are deleted when the backups expire, within [[BACKUPRETENTIONDAYS]] days, and are not restored in the meantime except for disaster recovery, in which case the deletion is applied again.

9.4 A minimal record of the Account, its Brands' names and addresses and its code batches is kept so that printed Codes show a neutral page. It contains no Customer Personal Data. During the 30 days before deletion, the Service stops processing Customer Personal Data for new requests (no forms, chats, pushes to connected systems or messages), while keeping what it holds until the deletion or its undoing.

10. International transfers

10.1 OneTrueTag processes Customer Personal Data in the locations listed in Annex 3. It will not transfer Customer Personal Data to another country except in compliance with Data Protection Laws.

10.2 For transfers subject to the GDPR, the SCCs apply as set out in Annex 4, and are incorporated by reference. For transfers subject to UK Law, KVKK and the GCC laws, the addenda below apply.

10.3 Where a transfer mechanism is invalidated or changed, the parties will cooperate to put an alternative in place.

11. Liability and precedence

11.1 Each party's liability under this DPA is subject to the limitations in the Terms, except where the SCCs or Data Protection Laws do not allow them to be limited.

11.2 If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the SCCs or an addendum conflict with this DPA, the SCCs or the addendum prevail.

11.3 This DPA lasts as long as OneTrueTag processes Customer Personal Data.

Addenda by jurisdiction

Addendum A: United Kingdom

A.1 For transfers of personal data subject to UK Law to a country without UK adequacy regulations, the parties agree the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner (version B1.0, or its successor), which is incorporated by reference. Table 1 is completed with the parties' details in this DPA; Table 2 refers to the SCC modules in Annex 4; Table 3 refers to Annexes 1 to 3; in Table 4, either party may end the Addendum as permitted by its Section 19.

A.2 References to the GDPR are read as references to UK Law, and to supervisory authorities as references to the Information Commissioner.

Addendum B: Turkey (KVKK)

B.1 Roles. The Customer is the data controller (veri sorumlusu) and OneTrueTag the data processor (veri işleyen) within the meaning of KVKK Art. 3. Under KVKK Art. 12(2), OneTrueTag is jointly responsible with the Customer for taking the technical and administrative measures for data security.

B.2 Customer's duties. The Customer is responsible for: informing data subjects under Art. 10 and the Communiqué on the Obligation to Inform; relying on a processing condition in Art. 5 or Art. 6, and asking for explicit consent (açık rıza) only where no other condition applies, separately from other terms; registering with VERBIS where required; and answering applications under Art. 11 within 30 days under Art. 13.

B.3 Breach. OneTrueTag will notify the Customer under Section 5 so that the Customer can notify the Personal Data Protection Board within 72 hours of becoming aware of the breach and inform data subjects, as the Board's decision requires.

B.4 Transfers abroad. Where Customer Personal Data subject to KVKK is transferred outside Turkey, the transfer will follow KVKK Art. 9 as amended by Law No. 7499: on the basis of an adequacy decision of the Board; failing that, by appropriate safeguards, in particular the standard contract published by the Board, which the parties (or OneTrueTag and its Sub-processor, as applicable) will sign in the published form and which the transferring party will notify to the Personal Data Protection Authority within five business days of signature; or binding corporate rules or a written undertaking approved by the Board. The exceptions for incidental transfers in Art. 9(6), including explicit consent, are used only where the conditions above cannot be met and the transfer is incidental.

B.5 Destruction. Deletion under Section 9 is carried out in a way consistent with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

B.6 Representative. Where KVKK requires it, OneTrueTag's data controller representative in Turkey for its own processing is [[TRDATACONTROLLER_REPRESENTATIVE]].

Addendum C: United Arab Emirates

C.1 Onshore UAE. For processing subject to the UAE PDPL, OneTrueTag will meet the processor obligations of Art. 8 of the UAE PDPL, including processing only on the Customer's instructions, applying appropriate security measures, keeping a record of processing carried out for the Customer, and notifying the Customer without delay of any breach so that the Customer can notify the UAE Data Office and data subjects as Art. 9 requires.

C.2 Transfers. Transfers outside the UAE will be made to countries with adequate protection or under the conditions of Art. 22 and 23 of the UAE PDPL, including through this DPA's contractual obligations, which require the recipient to apply protections no less than those of the UAE PDPL.

C.3 DIFC and ADGM. Where the Customer, or the processing, is subject to the DIFC Data Protection Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021, OneTrueTag will meet the processor requirements of that regime (DIFC Art. 24; ADGM Section 26). Transfers out of the DIFC or ADGM will use that regime's adequacy list or its standard contractual clauses, which are incorporated by reference where required.

Addendum D: Kingdom of Saudi Arabia

D.1 For processing subject to the KSA PDPL, OneTrueTag will process Customer Personal Data only as instructed by the Customer and in line with the KSA PDPL's requirements for processors, and the Customer remains responsible as controller.

D.2 Breach. OneTrueTag will notify the Customer under Section 5 so that the Customer can notify the Saudi Data and AI Authority (SDAIA) within 72 hours of becoming aware of an incident and notify data subjects where the implementing regulations require.

D.3 Transfers. Transfers outside the Kingdom will follow the Regulation on Personal Data Transfer outside the Kingdom: to a country SDAIA has found adequate; failing that, under appropriate safeguards (SDAIA's standard contractual clauses, which the parties will sign in the published form where required, binding common rules or certification), after a transfer risk assessment where the regulation requires one, limited to the minimum data needed; or under an exception the regulation allows.

D.4 Records. OneTrueTag will help the Customer keep the records of processing the KSA PDPL requires and, where the Customer must register on SDAIA's National Data Governance Platform, will provide the information it holds that the Customer needs.

Addendum E: Qatar

E.1 For processing subject to Qatar Law No. 13 of 2016, OneTrueTag will process Customer Personal Data only on the Customer's instructions, apply the precautions required by Art. 13 of that law, and notify the Customer of any breach under Section 5 so that the Customer can notify the competent authority and the data subjects as the law requires.

E.2 Transfers outside Qatar are made in line with Art. 15 of that law and will not take place where they would breach it or cause serious damage to the data subject. Where the Customer is in the Qatar Financial Centre, the QFC Data Protection Regulations apply in place of this Addendum to the extent they govern.

Addendum F: Bahrain

F.1 For processing subject to Bahrain Law No. 30 of 2018, OneTrueTag acts as the Customer's processor under a written contract (this DPA), applies the technical and organisational measures in Annex 2, and processes only on the Customer's instructions.

F.2 Transfers outside Bahrain will be made only to countries on the list issued by the Personal Data Protection Authority, with the Authority's authorisation, or under one of the exceptions in the law (such as the data subject's consent or the performance of a contract with the data subject).

Addendum G: Kuwait

G.1 Where the CITRA Regulation applies to the processing, OneTrueTag will process Customer Personal Data only on the Customer's instructions, apply the security measures in Annex 2, notify the Customer of a breach under Section 5 so that the Customer can notify CITRA and data subjects within the periods the CITRA Regulation sets, and support the Customer in meeting the Regulation's conditions for transfers outside Kuwait.

Addendum H: Oman

H.1 For processing subject to Royal Decree No. 6/2022 and its Executive Regulations, OneTrueTag will process Customer Personal Data only on the Customer's instructions, apply the security controls in Annex 2, and notify the Customer of a breach under Section 5 so that the Customer can notify the Ministry of Transport, Communications and Information Technology and the data subjects within the periods set by the Executive Regulations.

H.2 Transfers outside Oman will be made only under the conditions of the law and its Executive Regulations. The Customer is responsible for any permit the Ministry requires for its processing, including for any sensitive data it chooses to collect.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

The measures below are those implemented in the Service on 2026-10-14. OneTrueTag may change them provided that the overall level of protection is not reduced.

2.1 Access control and authentication

1. Sign-in uses short-lived signed access tokens (RS256, 15 minutes) and refresh tokens (up to 30 days) that are rotated on use and stored only as hashes.
2. Session tokens are kept in HttpOnly cookies set by the panel's own server; they are never stored where page scripts can read them.
3. Optional two-factor authentication (TOTP) with hashed recovery codes; the TOTP secret is stored encrypted.
4. Rate limits on sign-in, two-factor codes, password reset, sign-up, invitations and sensitive profile changes.
5. Email, password and two-factor settings can be changed only from the person's own account, after re-entering credentials where applicable.

2.2 Tenant isolation and authorisation

1. Every Account's data is separate. Every request is scoped to the Account the session acts for; an identifier belonging to another Account is answered as not found.
2. Within an Account, role-based permissions control each action, and the server refuses an action even if the interface is bypassed.
3. Suspended or removed Members lose access at once.
4. API keys act as the Member who created them, limited by their scopes and by that Member's current permissions, stop when the Member is suspended, and are deleted when the Member is removed. Keys are stored only as one-way hashes (the last 4 characters are kept readable) and can be limited to IP addresses. Panel sessions are not accepted on the API, and API keys are not accepted on the panel.
5. MCP connections use OAuth 2.1 with OneTrueTag's own consent page, or a personal token shown once; they act within the connecting Member's permissions and can be disconnected at any time.
6. End Customers can open a request only with its tracking code or from their own signed-in account. Tracking codes are stored as hashes.

2.3 Encryption

1. Traffic to the Service uses HTTPS; the API sends HTTP Strict Transport Security.
2. Credentials the Customer gives for connected services (Telegram bot tokens, WhatsApp provider credentials, store tokens, CRM tokens, AI provider keys, webhook secrets) and two-factor secrets are encrypted in the database with AES-256 application-level encryption. They are write-only through the interface: no response returns them.
3. Passwords are stored with a one-way password hashing algorithm.
4. Encryption at rest of database and storage volumes: as provided by [[HOSTINGPROVIDER]] and [[STORAGEPROVIDER]] (to be confirmed when the providers are chosen).

2.4 Data minimisation in scan analytics

1. The End Customer's IP address and user agent are used during the request to derive country, city, device type and operating system, and are not stored in the scan history, queued or logged.
2. Country and city are looked up in a locally hosted database; no address is sent to an outside service.
3. The browser's visitor id is stored only as a keyed hash.
4. No browser fingerprinting is used.

2.5 File security

Every uploaded file passes a pipeline that cannot be skipped:

1. size limits per place of upload and a maximum of 50 files per batch;
2. file-name checks (no control characters or path tricks, at most 200 characters);
3. type checks against an allow-list for each place, verified against the file's actual content; names with a hidden executable part are refused;
4. image dimension limits (12,000 pixels per side, 40 megapixels) against decompression attacks;
5. images re-encoded from their pixels, which removes metadata such as GPS location (animated GIFs excepted); SVG files cleaned of anything that is not drawing instructions, including external references;
6. images checked again after cleaning for embedded code;
7. files sent by End Customers and support attachments are delivered as downloads, never displayed inside a page;
8. stored files are reached only through signed links that expire after about 5 minutes;
9. uploads not attached to a record are deleted after 24 hours.

No antivirus scanner is connected at the date of this DPA; the pipeline is designed so that one can be added.

2.6 Outbound connections

1. Addresses the Customer configures (AI assistant endpoints, WooCommerce stores, webhook endpoints) are checked so that the Service does not connect to private or internal networks, and webhooks are sent only to public HTTPS addresses.
2. Webhooks are signed and carry only the event type and record ids, never personal data.
3. Fixed provider addresses are set in configuration, not chosen by the Customer, for the AI model providers and CRMs.

2.7 Inbound connections

1. Messages from Telegram are accepted only with the per-bot secret Telegram echoes back; messages from Meta's WhatsApp platform only with a valid HMAC-SHA256 signature; each is matched to the exact channel it belongs to.
2. Connecting a store or CRM ties the provider's redirect to the browser that started it.

2.8 Application security

1. A per-request Content Security Policy with a nonce on the customer panel.
2. Spreadsheet exports neutralise cell values that would be read as formulas.
3. Customer exports and report exports are logged with who, which Account and which filters, and are rate-limited.
4. Rate limits on every public form and on the API and MCP server.
5. API, MCP and webhook logs keep only metadata (never search terms, bodies or answers), for 30 days.

2.9 Retention and deletion

1. A daily job applies each Plan's customer data retention.
2. Test codes and everything made with them are deleted after 7 days.
3. AI assistant conversations are held in temporary memory and forgotten after 2 hours of inactivity unless handed over as a ticket.

2.10 Organisational measures

1. Access to production systems is limited to personnel who need it, under confidentiality obligations.
2. Changes to the Service go through automated tests, static analysis and dependency audits before release.
3. Backups are kept for [[BACKUPRETENTIONDAYS]] days.
4. Security reports can be sent to [[SECURITY_EMAIL]].

OneTrueTag holds no ISO 27001, SOC 2 or other third-party certification at the date of this DPA.

Annex 3: Sub-processors

Part A, Sub-processors, and Part B, services the Customer connects (not sub-processors), are as listed in sub-processors.md, which forms part of this Annex.

Annex 4: Standard Contractual Clauses

4.1 Module choice. The SCCs apply only to the extent a transfer is a restricted transfer under the GDPR. OneTrueTag is established in [[ENTITY_COUNTRY]]. The modules apply as follows:

4.2 Options selected.

• Clause 7 (docking clause): applies.
• Clause 9: Option 2 (general written authorisation), with the notice period in Section 7.2 of this DPA (30 days).
• Clause 11: the optional language does not apply.
• Clause 13: the supervisory authority of the Customer's establishment in the EU, or, if it has none, of its EU representative, or [[LEADSUPERVISORYAUTHORITY]].
• Clause 17: the law of [[SCCGOVERNINGLAW]] (an EU Member State that allows third-party beneficiary rights).
• Clause 18: the courts of [[SCC_COURTS]] (the same Member State).

4.3 Annexes to the SCCs. Annex I.A (parties): the parties to this DPA; Annex I.B (description of transfer): Annex 1 of this DPA; Annex I.C (competent authority): as in Clause 13 above; Annex II (measures): Annex 2 of this DPA; Annex III (sub-processors): Annex 3 of this DPA.

4.4 Supplementary measures. The measures in Annex 2, in particular encryption in transit, encryption of stored credentials, data minimisation in scan analytics and tenant isolation, and OneTrueTag's commitment to challenge any government request for Customer Personal Data that is not lawful and to disclose only the minimum required, are the supplementary measures for transfers.

Signed for the Customer by accepting the Terms, or by signature on request.

[[ENTITYNAME]] · [[ADDRESS]] · [[LEGALEMAIL]] · Data protection contact: [[DPO_CONTACT]]