Data processing agreement
When your banner records a visitor’s choice, we process that data for you. This agreement sets out how, as UK GDPR Article 28 requires. It forms part of our terms of service.
Last updated 30 October 2026
1. Roles
You, the customer, are the controller of the personal data your banners collect from visitors to your websites. Parachute Digital Solutions Limited (“we”) is your processor. Words such as “personal data”, “processing” and “personal data breach” have the meanings given in UK GDPR.
2. What we process
| Purpose | Showing your cookie banner, applying your visitors’ choices, and keeping a record of those choices so you can show consent was given. |
|---|---|
| Data subjects | Visitors to your websites. |
| Personal data | A random consent ID, the choices made, when they were made, the page they were made on, your policy version, the visitor’s IP address shortened before storage (the last part of an IPv4 address removed; IPv6 shortened to its first 48 bits) and their browser’s user agent. |
| Special category data | None. |
| Duration | Each record is kept for 24 months from when it was made, then deleted automatically. When this agreement ends, see section 9. |
3. Your instructions
We process this data only on your documented instructions, which are these terms and the way you configure the service, unless the law requires otherwise. If we must process it for a legal reason, we’ll tell you first unless the law forbids it. We’ll tell you if we think an instruction breaks data protection law.
4. Confidentiality
Everyone we authorise to process the data is bound by a duty of confidentiality.
5. Security
We protect the data with measures appropriate to the risk, including:
- encryption in transit (TLS) and at rest
- shortening IP addresses before they’re stored
- keeping each customer’s records separate, and accessible only to that customer’s account and to our staff who need it to run or support the service
- accepting consent records only from the websites you’ve listed, and rate limiting
- automatic deletion when records reach the end of their retention period
6. Subprocessors
You authorise us to use these subprocessors for your visitors’ data:
| Subprocessor | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the website, dashboard and banner, and receiving consent records | United States company. The dashboard and consent recording run in London; requests pass through Vercel’s worldwide network. |
| Neon (a Databricks company) | Database that stores accounts, settings and consent records | London (Amazon Web Services, eu-west-2) |
We have written contracts with each that protect the data at least as well as this agreement. We’ll email you at least 30 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds and we can’t resolve it, you may cancel and we’ll refund any period you’ve paid for but won’t use. We remain responsible for our subprocessors.
7. Transfers outside the UK
Where a subprocessor processes data outside the UK, the transfer is protected by UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to standard contractual clauses.
8. Helping you
- Visitors’ rights. You can find and export records in your dashboard. If a visitor contacts us directly, we’ll pass the request to you rather than answer it ourselves, and help you respond.
- Breaches. We’ll tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
- Assessments. We’ll give you reasonable information to help with data protection impact assessments and consultations with the ICO.
9. When the agreement ends
You can download your records at any time before your account closes. Within 90 days of it closing, we delete your visitors’ data, unless the law requires us to keep it.
10. Audits
We’ll give you the information you reasonably need to show we’re meeting this agreement, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires it.
Contact
Data protection questions: hello@cookiecopilot.com. See also our privacy policy.