Data Processing Agreement

1. Subject matter and duration

The Processor processes personal data on the Customer's behalf and instructions, for the purpose of recording and displaying the cookie-consent choices made by visitors to the Customer's own website. Processing continues for as long as the Customer's site remains registered with AlpineConsent, and ends when the Customer deletes the site or their account.

2. Nature and purpose of processing

Automated, real-time storage of a visitor's consent-category choices (e.g. accepted or rejected marketing/analytics cookies), so that choice can later be shown as evidence of consent — both to the Customer and, on request, to a regulator. The Processor does not use this data for any purpose of its own.

3. Type of personal data processed

• The consent category choices themselves (which categories were accepted or rejected).
• A salted HMAC-SHA256 hash of the visitor's IP address — the raw IP address is never stored, only this one-way hash, so it cannot be reversed back to the original address even if the underlying data were ever exposed.
• A timestamp of when the choice was made.

No names, email addresses, or other directly identifying information about the Customer's visitors is processed under this Agreement.

4. Categories of data subjects

Visitors to the Customer's own website who interact with the AlpineConsent consent banner.

5. Processor obligations

• Instructions. The Processor processes data only as necessary to provide the service as the Customer has configured it, and will inform the Customer if an instruction appears to conflict with the GDPR or other applicable data protection law.
• Confidentiality. Anyone processing this data under the Processor's authority is bound to confidentiality.
• Security. Technical and organizational measures appropriate to the risk, including: encryption in transit (TLS); the salted-hash-only IP handling described in Section 3, which never stores a raw IP address; role-based access control restricting who can view stored consent data; and an automated retention policy (see Section 8) rather than indefinite, unbounded storage.
• Sub-processors. The Customer gives general authorization for the Processor to engage the sub-processors listed in Section 6, and will be informed of any change so they have the opportunity to object.
• Data subject rights. The Processor will assist the Customer, insofar as possible, in responding to a data subject's request to exercise their GDPR rights over data covered by this Agreement.
• Security incidents. The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting data covered by this Agreement, and will assist with the Customer's own notification obligations.
• Deletion or return. On deletion of a Customer's site or account, the corresponding consent data is deleted, subject only to the retention period described in Section 8 still running out for data already collected.
• Demonstrating compliance. The Processor will make available the information reasonably necessary to demonstrate compliance with this Agreement, and will allow for and contribute to reasonable audits — for a service of this size, in practice this means documentation review rather than an on-site audit, unless a specific concern requires more.

6. Sub-processors

The primary processing described in this Agreement (storing and serving consent records) happens on the Processor's own self-hosted infrastructure, located within the EU — no separate third-party sub-processor is involved in that specific storage. Server-side error monitoring (Sentry) could incidentally capture data from this processing activity only if an unexpected error occurs while handling it — this is the same server-side-only error monitoring described in the Privacy Policy's own sub-processor list.

7. International transfers

Data covered by this Agreement is not transferred outside the European Union/European Economic Area.

8. Retention

Consent records are retained for 36 months by default from the date they were created, after which they are automatically deleted — a longer or shorter period may apply depending on the Customer's plan. This is enforced by an automated process, not a manual, best-effort cleanup.

9. Liability

Liability under this Agreement is governed by the same terms as the Terms of Service.

Contact

Questions about this Agreement — use the contact page. See also the Legal Notice for full operator details.