1. Parties and Background

This Data Processing Agreement ("DPA") is entered into between:

The Controller has engaged the Processor to provide website analytics and visitor tracking services (the "Services") which require the Processor to process Personal Data on behalf of the Controller.

2. Definitions

3. Scope and Purpose of Processing

3.1 Subject Matter

The Processor shall process Personal Data on behalf of the Controller for the purpose of providing website analytics and visitor tracking services as described in the Terms of Service.

3.2 Nature of Processing

The processing activities include:

• Collection of visitor data through the ScoutVibe tracking script
• Storage of collected data on secure cloud infrastructure
• Analysis and aggregation of visitor behavior data
• Generation of analytics reports and insights
• Provision of dashboard access for data visualization
• Cross-device and cross-session visitor identification

3.3 Purpose of Processing

Personal Data is processed solely for the following purposes:

• Providing the Services as described in the Terms of Service
• Enabling website analytics and visitor tracking functionality
• Generating reports and insights for the Controller
• Technical operation, maintenance, and improvement of the Services
• Compliance with legal obligations

3.4 Duration of Processing

Processing shall continue for the duration of the Terms of Service agreement.

3.4.1 Standard Retention Periods (During Active Service)

The following retention periods apply to data collected during the active service period:

• Event Data: 24 months from collection date
• Session Data (time-on-page, focus events): 12 months from collection date
• Prospect Profiles: Retained while Controller's account is active
• Unclaimed Tracking Tokens: 90 days from creation

3.4.2 Upon Termination

When the Terms of Service agreement is terminated:

• The Controller may request data export within 30 days of termination
• All Personal Data will be permanently deleted within 90 days of termination
• Aggregate, anonymized statistical data may be retained indefinitely
• Data required for legal compliance may be retained as required by law

4. Categories of Data Subjects

The Personal Data processed concerns the following categories of Data Subjects:

• Visitors to the Controller's website(s)
• Users of the Controller's web applications
• Prospects and leads identified through the Controller's marketing activities
• Any other individuals whose data is collected through the ScoutVibe tracking script

5. Types of Personal Data

The following types of Personal Data are processed:

Category	Data Types
Technical Identifiers	Device fingerprints, browser fingerprints, session IDs, prospect IDs, tracking tokens
Device Information	Browser type/version, operating system, screen resolution, device type, language settings, timezone
Behavioral Data	Pages visited, click events, scroll depth, time on page, referrer URLs, session duration
Contact Information	Email addresses (when voluntarily provided by Data Subjects through forms)
Geographic Data (City-Level)	Country, region/state, and city derived from IP address. IP addresses are hashed using SHA-256 with a secure salt and cannot be reversed. Latitude, longitude, and precise coordinates are NOT collected or stored.

6. Processor Obligations

6.1 Processing Instructions

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, including transfers to third countries, unless required by applicable law
• Immediately inform the Controller if any instruction infringes Data Protection Laws
• Not process Personal Data for any purpose other than providing the Services

6.2 Confidentiality

The Processor shall:

• Ensure that personnel authorized to process Personal Data are bound by confidentiality obligations
• Limit access to Personal Data to personnel who need access to perform the Services
• Implement appropriate access controls and authentication measures

6.3 Security Measures

The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Role-based access control, multi-factor authentication
• Infrastructure Security: AWS security best practices, VPC isolation, security groups
• Monitoring: Continuous security monitoring, intrusion detection, log analysis
• Business Continuity: Regular backups, disaster recovery procedures
• Vulnerability Management: Regular security assessments, timely patching

Detailed security measures are described in Annex B.

6.4 Sub-processing

The Processor shall:

• Not engage another processor (Sub-processor) without prior written authorization from the Controller
• The Controller hereby provides general authorization for the Sub-processors listed in Annex C
• Inform the Controller of any intended changes to Sub-processors, giving the Controller the opportunity to object
• Ensure Sub-processors are bound by data protection obligations no less protective than this DPA
• Remain fully liable for Sub-processor compliance

6.5 Data Subject Rights

The Processor shall:

• Assist the Controller in responding to Data Subject requests (access, rectification, erasure, portability, restriction, objection)
• Promptly notify the Controller of any Data Subject request received directly
• Not respond directly to Data Subject requests unless authorized by the Controller
• Provide technical capabilities to enable the Controller to fulfill Data Subject requests

6.6 Personal Data Breach

In the event of a Personal Data Breach, the Processor shall:

• Notify the Controller without undue delay, and in any event within 48 hours of becoming aware
• Provide sufficient information to enable the Controller to meet its breach notification obligations
• Cooperate with the Controller's investigation and remediation efforts
• Document all breaches, including facts, effects, and remedial actions taken

6.7 Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller with:

• Data Protection Impact Assessments (DPIAs) where required
• Prior consultations with supervisory authorities where required

6.8 Audit Rights

The Processor shall:

• Make available all information necessary to demonstrate compliance with this DPA
• Allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller
• Audits shall be conducted with reasonable notice (minimum 30 days), during normal business hours, and subject to confidentiality obligations
• The Controller shall bear the costs of any audit unless the audit reveals material non-compliance

7. Controller Obligations

The Controller warrants and agrees that:

• It has a lawful basis for processing Personal Data through the Services
• It has provided appropriate notice to Data Subjects regarding the use of analytics tracking
• It has obtained any required consents from Data Subjects where applicable
• Its instructions to the Processor comply with Data Protection Laws
• It will maintain an appropriate privacy policy disclosing the use of ScoutVibe
• It will respond to Data Subject requests within statutory timeframes
• It will not use the Services to process special categories of Personal Data
• It will not use the Services to knowingly track children without appropriate parental consent

8. International Data Transfers

8.1 Transfer Locations

Personal Data may be transferred to and processed in:

• United States: AWS infrastructure hosting
• Morocco: Company operations
• Other locations: As specified for Sub-processors in Annex C

8.2 Transfer Mechanisms

For transfers outside the EEA/UK to countries without an adequacy decision, the following mechanisms apply:

• Standard Contractual Clauses: The parties agree to be bound by the EU Commission's Standard Contractual Clauses (Module Two: Controller to Processor) as set forth in Commission Implementing Decision (EU) 2021/914
• UK Addendum: For transfers from the UK, the UK Addendum to the SCCs applies
• Supplementary Measures: Additional technical and organizational measures as described in Annex B

8.3 Transfer Impact Assessment

The Processor has conducted a transfer impact assessment and determined that the safeguards in place provide an adequate level of protection for transferred Personal Data.

9. Liability and Indemnification

9.1 Liability

Each party shall be liable for damages caused by processing that infringes Data Protection Laws or this DPA, subject to the limitations set forth in the Terms of Service.

9.2 Indemnification

The Controller agrees to indemnify and hold harmless the Processor from claims, damages, and expenses arising from:

• The Controller's breach of this DPA
• The Controller's failure to have a lawful basis for processing
• The Controller's failure to provide required notices or obtain required consents
• Claims by Data Subjects resulting from the Controller's instructions or use of the Services

10. Term and Termination

10.1 Term

This DPA shall remain in effect for the duration of the Terms of Service agreement.

10.2 Effects of Termination

Upon termination:

• The Processor shall cease processing Personal Data except as necessary to return or delete data
• The Controller may request return of Personal Data in a standard format within 30 days
• The Processor shall delete all Personal Data within 90 days, unless retention is required by law
• The Processor shall certify deletion upon Controller's request

11. General Provisions

11.1 Precedence

In the event of conflict between this DPA and the Terms of Service regarding data protection matters, this DPA shall prevail.

11.2 Amendments

This DPA may be amended by the Processor to reflect changes in Data Protection Laws. Material changes will be notified to the Controller with 30 days' notice.

11.3 Governing Law

This DPA shall be governed by the laws of the Kingdom of Morocco, without regard to conflict of law principles. For matters relating to GDPR compliance, the relevant provisions of EU law shall apply.

11.4 Severability

If any provision of this DPA is found invalid, the remaining provisions shall continue in effect.

12. Contact Information

This Data Processing Agreement is designed to meet the requirements of GDPR Article 28 and provide a clear framework for the processing of Personal Data.