Data processing agreement
Last updated: 22 October 2026
This Data processing agreement ("DPA") forms part of the contract between the customer ("Controller") and Optimizative Technologies LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States ("Processor"), under our Terms of service. It applies whenever the Processor processes personal data on behalf of the Controller, and it sets out the terms required by Article 28(3) of the EU General Data Protection Regulation (GDPR).
1. Subject matter and duration
The Processor processes personal data only to provide the services described in the Order. This DPA lasts as long as the Processor processes personal data for the Controller. Annex 1 describes the processing.
2. Instructions
The Processor processes personal data only on the documented instructions of the Controller, including with regard to transfers to third countries, unless required to do otherwise by law; in that case the Processor informs the Controller before processing, unless the law forbids it. The contract, this DPA and the Controller's configuration of the services are the Controller's instructions. The Processor will tell the Controller immediately if, in its opinion, an instruction infringes data protection law.
3. Confidentiality
The Processor ensures that the people authorised to process the personal data are bound by confidentiality.
4. Security
The Processor implements the technical and organisational measures in Annex 2, as required by Article 32 GDPR. The Processor may update these measures, as long as the overall level of security is not reduced.
5. Sub-processors
The Controller gives the Processor general authorisation to engage sub-processors. The current list is on our Sub-processors page and in Annex 3. The main sub-processor is Cloudflare, Inc., which provides the infrastructure on which the services run, under its own data processing addendum.
The Processor will notify the Controller at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected services and receive a refund of prepaid fees for the unused period.
The Processor imposes on each sub-processor data protection obligations equivalent to those in this DPA and remains responsible to the Controller for the sub-processor's performance.
6. Location of stored data and international transfers
For personal data stored by the services (databases, files and similar storage), the Controller chooses the storage jurisdiction when the service is set up: European Union or United States. The Processor creates the storage with Cloudflare's jurisdiction setting for that region, which guarantees that the stored data is kept within it. The choice cannot be changed for existing storage; changing it means creating new storage and moving the data.
The Controller acknowledges that, regardless of this choice:
- web traffic is received and processed in Cloudflare data centres worldwide, close to each visitor, unless the Controller's Enterprise plan includes EU-only processing;
- application code is deployed to all Cloudflare data centres, and stored data may be accessed by the services from any of them;
- the Processor and Cloudflare, Inc. are United States companies.
Where personal data subject to the GDPR is transferred to the United States or another third country, the transfer relies on the standard contractual clauses adopted by the European Commission. Onward transfers by Cloudflare rely on the mechanisms described in Cloudflare's data processing addendum.
7. Assistance to the Controller
Taking into account the nature of the processing, the Processor assists the Controller:
- in responding to requests from data subjects exercising their rights, and forwards to the Controller without undue delay any request it receives directly;
- in meeting its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).
8. Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. The notification includes the information available at the time, and further information is provided as it becomes available.
9. Deletion or return
At the end of the services, the Processor makes the personal data available for export for 30 days and then deletes it, including existing copies, unless law requires the Processor to keep it. Backups are deleted in their normal rotation.
10. Audits
The Processor makes available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, by the Controller or an auditor it appoints, with reasonable notice, during business hours, and subject to confidentiality. For Cloudflare's infrastructure, the Processor may provide Cloudflare's independent audit reports and certifications in place of an on-site audit.
11. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms of service, except where the law does not allow limitation. In case of conflict on data protection matters, this DPA prevails over the Terms of service.
12. Governing law
This DPA is governed by the laws of the State of New Mexico, United States, without prejudice to the GDPR and to the law applicable to any standard contractual clauses.
Annex 1 — Description of the processing
| Nature and purpose | Hosting, storage, delivery and operation of the Controller's websites, applications, forms, AI assistants and related services; technical support. |
|---|---|
| Categories of data subjects | Visitors and users of the Controller's websites and applications; the Controller's customers, contacts and staff. |
| Categories of personal data | Determined by the Controller. Typically: contact data, data submitted through forms or bookings, account data, messages and call content handled by assistants, technical data such as IP addresses and logs. |
| Special categories | None, unless the Controller has agreed otherwise with the Processor in writing. |
| Frequency | Continuous, for the duration of the services. |
| Storage location | European Union or United States, as chosen by the Controller (section 6). |
| Retention | As configured by the Controller, and until deletion under section 9. |
Annex 2 — Technical and organisational measures
- Encryption in transit with TLS on all connections; encryption at rest provided by Cloudflare's storage services.
- Access to production systems limited to authorised staff, with multi-factor authentication and individual accounts.
- Administrative interfaces protected by an identity-aware access layer (Cloudflare Access).
- Separation of each customer's data in dedicated databases or storage buckets.
- Logging of administrative access and changes.
- Backups and restore procedure.
- Protection against attacks provided by Cloudflare's network (DDoS mitigation, web application firewall where enabled).
- Security of the underlying infrastructure as described in Cloudflare's certifications and data processing addendum.
Annex 3 — Sub-processors
See the current list at /legal/subprocessors/.