Data Processing Agreement

Parties and scope

This Data Processing Agreement (“DPA”) is between Hence Media Inc., a company incorporated in Ontario, Canada, doing business as Invoker App at invoker.app and invokerapp.com (“Invoker”), and the customer who has accepted our Terms of Service (“Customer”).

It applies to personal data that Invoker processes on the Customer's behalf when providing the service, mainly data about visitors to the Customer's websites. It does not cover data Invoker controls itself, such as account and billing data, which our Privacy Policy covers.

If this DPA and the Terms conflict, this DPA prevails for the processing of personal data.

Definitions

• Data Protection Law means the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, and any other data protection law that applies to the processing.
• Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in the GDPR.
• Customer Personal Data means personal data processed by Invoker on behalf of the Customer under the Terms.
• Sub-processor means a third party engaged by Invoker to process Customer Personal Data.
• SCCs means the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914.

Roles of the parties

The Customer is the controller of Customer Personal Data and Invoker is its processor. Where the Customer is itself a processor for another controller, Invoker is a sub-processor.

The Customer is responsible for:

• having a lawful basis for collecting analytics on its websites
• giving visitors the information required by law, and obtaining consent where its jurisdiction requires it (for example under ePrivacy or PECR rules on storing information on a device)
• configuring the service appropriately, for example Do Not Track and data retention settings
• not sending special categories of data or directly identifying data such as names or email addresses

Details of processing

Processor obligations

In line with Article 28(3) GDPR, Invoker will:

1. Instructions. Process Customer Personal Data only on the Customer's documented instructions, including those in the Terms, this DPA and the Customer's configuration of the service, unless required by law. Invoker will tell the Customer if it believes an instruction breaks Data Protection Law.
2. Confidentiality. Ensure that people authorised to process Customer Personal Data are bound by confidentiality.
3. Security. Implement appropriate technical and organisational measures under Article 32, including those in the annex.
4. Sub-processing. Engage sub-processors only as described in Sub-processors.
5. Data subject requests. Taking into account the nature of the processing, help the Customer respond to requests from data subjects. If Invoker receives a request directly, it will refer the person to the Customer.
6. Assistance. Help the Customer meet its obligations under Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to Invoker.
7. Deletion or return. At the end of the service, delete Customer Personal Data, or return it on request, unless law requires it to be kept. The Customer can export data from the dashboard before closing its account.
8. Audits and information. Make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to audits. Audits will be on reasonable notice, at the Customer's cost, no more than once a year unless required by a supervisory authority or following a breach, and may first be answered with written information.

Sub-processors

The Customer authorises Invoker to use the sub-processors below. Invoker has a written contract with each one that gives at least the same protection as this DPA, and remains responsible for their work.

IP geolocation uses a local copy of the DB-IP Lite database on Invoker's own servers. No data is sent to DB-IP, so it is not a sub-processor. Slack or Discord webhooks the Customer configures for alerts are recipients chosen by the Customer, not sub-processors.

Changes

Invoker will give at least 30 days' notice of a new or replacement sub-processor by updating this page and emailing the account owner. The Customer may object on reasonable data protection grounds by emailing support@invoker.app within that period. If we cannot resolve the objection, the Customer may terminate the affected service.

International transfers

Customer Personal Data is stored in the USA (AWS us-east-1). For transfers of personal data from the EEA, the parties rely on the SCCs: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. The SCCs are incorporated into this DPA by reference, with the details in Details of processing and the annex completing their appendices.

For transfers from the UK, the UK International Data Transfer Addendum to the SCCs applies. Where a sub-processor is certified under the EU-US Data Privacy Framework (or its UK and Swiss extensions), Invoker may also rely on that certification.

For the SCCs, the governing law and courts are those of the Province of Ontario, Canada.

Personal data breaches

Invoker will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, aiming to do so within [48] hours. The notice will include what Invoker knows at the time: the nature of the breach, the likely consequences, the measures taken or proposed, and a contact point. Invoker will provide further information as it becomes available.

Annex: security measures

Data minimisation

• no third-party cookies and no cross-site tracking
• random first-party identifiers rather than personal identifiers
• visitor IP addresses are never stored (not in full, truncated or hashed)
• optional Do Not Track support per site
• IP geolocation done locally, without sending IP addresses to third parties
• retention limits per plan and per site

Encryption

• TLS for all traffic to the website, dashboard and API
• passwords stored only as salted hashes
• encryption at rest provided by our hosting infrastructure [confirm]

Access control

• production access limited to authorised staff on a need-to-know basis
• role-based team permissions so Customers control who can access each site
• API access through revocable API keys
• bot protection on sign-up

Availability and resilience

• hosting on managed infrastructure (Laravel Cloud on AWS)
• regular backups, retained for up to [35] days
• error monitoring for the frontend and API

Organisational

• confidentiality obligations for staff and contractors
• written contracts with sub-processors
• an incident response process for personal data breaches

Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not allow liability to be limited.

Term and termination

This DPA applies for as long as Invoker processes Customer Personal Data. When the Customer closes its account, Invoker deletes Customer Personal Data within [30] days, and backup copies are overwritten within a further [35] days, unless law requires otherwise.

Accepting this DPA

This DPA is incorporated into the Terms of Service. By accepting the Terms, the Customer also accepts this DPA, and no separate signature is needed.

If you need a countersigned copy for your records, email support@invoker.app with your company name, address and account email.