Data Processing Agreement

1. Parties and roles

The Customer is the controller of the personal data it collects or submits through OneLence, for example data about visitors to its websites and apps, its buyers and its affiliate partners (“Customer Personal Data”). Crelora processes Customer Personal Data as the Customer’s processor.

Crelora is a controller, not a processor, for its own processing described in the Privacy Policy, such as account administration, billing, security and support. This DPA does not cover that processing.

Crelora GmbH, Ernst-Thälmann-Straße 41, 06686 Lützen, Germany. Commercial register: HRB 35614, Amtsgericht Stendal. Contact for data protection matters: [email protected].

2. Subject matter, duration and details

We process Customer Personal Data to provide OneLence under the Agreement, for its duration and until deletion under section 10. The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3. Instructions

We process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless Union or Member State law requires otherwise. In that case we will inform the Customer of the legal requirement before processing, unless that law prohibits it. The Agreement, this DPA and the Customer’s configuration and use of OneLence are the Customer’s instructions.

We will tell the Customer promptly if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law.

4. Confidentiality

We ensure that everyone we authorise to process Customer Personal Data is bound by confidentiality, by contract or by law, and processes it only as needed to provide, secure and support OneLence.

5. Security

We implement the technical and organisational measures required by Art. 32 GDPR, described in Annex 2. We may update these measures as technology develops, as long as the overall level of protection is not reduced.

6. Sub-processors

The Customer gives us general authorisation to engage sub-processors. The current list, with each sub-processor’s purpose, location and transfer mechanism, is on our Sub-processors page.

We will inform the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the workspace owner and by updating that page. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may terminate the affected service before the change takes effect.

We impose on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA. We remain liable to the Customer for the performance of our sub-processors’ obligations.

7. International transfers

Our primary database and analytics storage are hosted in the European Union. Where a sub-processor processes Customer Personal Data outside the European Economic Area, we transfer it only under a mechanism recognised by Chapter V GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or the European Commission’s Standard Contractual Clauses (2021/914). The mechanism for each sub-processor is listed on the Sub-processors page.

8. Requests from authorities

If we receive a request from a public authority for Customer Personal Data, we will inform the Customer unless the law prohibits it, ask the authority to address the Customer directly where possible, and disclose only what we are legally required to disclose.

9. Assistance

Taking into account the nature of the processing, we assist the Customer:

• with appropriate technical and organisational measures, in responding to requests from data subjects exercising their rights under Chapter III GDPR. If a data subject contacts us directly about Customer Personal Data, we will refer them to the Customer;
• in meeting its obligations under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), using the information available to us.

10. Personal data breaches

We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Where not all information is available at once, we provide it in phases.

11. Deletion and return

At the end of the services, and at the Customer’s choice, we delete or return Customer Personal Data and delete existing copies, unless Union or Member State law requires us to store it. The Customer can make this request at [email protected]. Backups are deleted on the providers’ regular backup cycles.

12. Information and audits

We make available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. Audits require reasonable prior notice, take place during business hours, must not disrupt our operations or compromise other customers’ data, and are subject to confidentiality.

13. Precedence and governing law

If this DPA conflicts with the Agreement on the protection of personal data, this DPA prevails. Liability is governed by the Agreement. This DPA is governed by the laws of the Federal Republic of Germany.

Annex 1: Details of processing

• Nature and purpose: collecting, hosting, analysing and reporting marketing and website data so the Customer can measure its channels, attribute conversions, review affiliate partners and receive recommendations, plus the related support and security.
• Data subjects: visitors to the Customer’s websites and apps; the Customer’s buyers and leads; the Customer’s affiliate partners and creators; the Customer’s users of OneLence.
• Types of personal data: pseudonymous visitor and session identifiers; IP addresses, which are hashed at our edge before storage, and coarse location derived from them; browser, device and user-agent data; page URLs, referrers and campaign parameters; events and conversions, including order values and coupon codes; email addresses and phone numbers the Customer chooses to send, which are stored hashed; affiliate partner details; names and email addresses of the Customer’s users.
• Special categories: none intended. The Customer must not send special categories of personal data to OneLence.
• Frequency: continuous, for the duration of the Agreement.

Annex 2: Technical and organisational measures

• Hosting: the primary database runs in the EU (Stockholm, Sweden) and analytics storage in the EU (Frankfurt, Germany), on managed services with provider backups.
• Encryption in transit: all traffic to OneLence and between our services uses TLS.
• Data minimisation: IP addresses are hashed at the edge; email addresses and phone numbers sent for identification are hashed and the raw values discarded; location is kept at a coarse level.
• Credentials: secret API keys are stored encrypted with AES-256-GCM; access and refresh tokens are stored only as hashes; access tokens for connected apps expire after one hour.
• Access control: each workspace’s data is isolated by database-level access rules; users get owner, admin or member roles; administrative access is limited to the staff who need it.
• Logging: requests from connected apps and the API are logged for security, rate limiting and support, and kept for up to 90 days.
• Resilience: managed infrastructure with provider backups, and an ingestion queue that keeps events when a downstream service is unavailable.
• Data subject requests: a dedicated endpoint lets the Customer pass on access and deletion requests for its visitors.
• Sub-processors: engaged only under written data protection terms, as listed on the Sub-processors page.

Annex 3: Sub-processors

See the Sub-processors page.