Last updated: 19 October 2026

Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the CookieConsentHQ Terms of Service.

It applies when CookieConsentHQ processes personal data on behalf of a customer in connection with the cookie consent management platform.

1. Parties and scope

This DPA is entered into between:

Controller: The business or organization identified as the customer in its CookieConsentHQ account ("Customer").

Processor: Hamza Ahmad Aslam, operating as CookieConsentHQ, a sole proprietor based in Pakistan, with an address at Apartment 401, 29AA, Bahria Town, Lahore, Pakistan ("Processor").

Contact: support@cookieconsenthq.com

For the purposes of GDPR and UK GDPR, the Customer is the controller and CookieConsentHQ is the processor of personal data collected through the Customer's websites.

Where the Customer acts as a processor for another controller, CookieConsentHQ acts as its sub-processor, and the Customer must have appropriate authority to appoint us.

This DPA applies for the duration of the Customer's use of the relevant services and any subsequent period of authorized processing.

It does not govern information CookieConsentHQ processes independently as controller for its own account management, billing or business operations.

2. Nature and purpose of processing

CookieConsentHQ processes personal data solely to provide the contracted consent management services, including:

• Displaying and managing consent banners.
• Recording and retrieving visitor consent choices.
• Applying consent preferences and supported tracker-blocking rules.
• Processing regional and Global Privacy Control signals.
• Supporting Google Consent Mode v2.
• Providing consent-related analytics and monitoring.
• Maintaining and troubleshooting the service.

Processing may include collection, transmission, storage, retrieval, organization and deletion of relevant personal data.

Data subjects

Visitors to websites operated by or on behalf of the Customer.

Categories of personal data

Stored consent records include:

• Truncated IP address.
• Hashed user agent.
• Consent preferences and choices.
• Timestamp.
• Page path.

Limited technical information, including IP addresses and browser signals, may also be processed transiently for service delivery, geo-targeting, security and troubleshooting.

The service is not intended to process special-category personal data.

The Customer must avoid intentionally submitting unnecessary personal information, including sensitive information embedded in URLs or page paths.

Duration

Processing continues for the subscription term and any period necessary to complete lawful return, deletion or retention obligations under this DPA.

3. Documented instructions

CookieConsentHQ will process Customer personal data only on documented instructions from the Customer, unless applicable law requires otherwise.

Documented instructions include:

• This DPA and the Terms of Service.
• The Customer's configuration of the platform.
• Authorized requests made through the dashboard.
• Other written instructions accepted by CookieConsentHQ.

We will inform the Customer if, in our opinion, an instruction infringes applicable data protection law, unless legally prohibited from doing so.

If applicable law requires processing beyond the Customer's instructions, we will notify the Customer before that processing unless the law prohibits notification.

4. Controller responsibilities

The Customer is responsible for:

• Determining the lawful basis for collecting and processing visitor data.
• Providing required privacy and cookie notices.
• Configuring consent requirements for relevant jurisdictions.
• Identifying and categorizing tracking technologies accurately.
• Ensuring that website tracking integrations respect applicable consent rules.
• Handling data subject requests and regulatory obligations.
• Providing lawful processing instructions to CookieConsentHQ.

CookieConsentHQ provides tools intended to help the Customer meet these responsibilities but does not guarantee legal compliance.

The Customer remains responsible for obtaining appropriate legal advice.

5. Confidentiality

CookieConsentHQ will ensure that individuals authorized to access Customer personal data are subject to appropriate confidentiality obligations.

Access will be limited to those who reasonably require it to deliver, secure or support the service.

Confidentiality obligations continue after an individual's access or engagement ends.

6. Security measures

CookieConsentHQ will implement and maintain technical and organizational measures appropriate to the risks associated with processing personal data, consistent with Article 32 GDPR.

These measures include, as appropriate:

• Encryption for data transmitted between systems.
• Access controls and authentication safeguards.
• Restricted access to production data.
• Protection of stored data and backups.
• Security monitoring and error detection.
• Vulnerability management and security updates.
• Procedures for identifying and responding to incidents.
• Measures designed to maintain service availability and recover data after incidents.

Security measures may evolve as technology and risks change, provided the overall level of protection is not materially reduced.

The Customer acknowledges that no security system can eliminate every risk.

7. Data storage and location

Customer consent records are stored using Neon Postgres in Frankfurt, Germany, within the European Union.

Other technical processing may occur through Cloudflare, Vercel and authorized service providers in additional locations.

Access from Pakistan or other countries may constitute an international transfer even where the primary database remains in the EU.

Such transfers must comply with applicable international data protection requirements.

8. Sub-processors

The Customer grants general written authorization for CookieConsentHQ to engage the sub-processors identified below for the relevant contracted services.

Current providers

Only providers processing personal data on CookieConsentHQ's behalf in connection with Customer visitor data are sub-processors for that processing.

Paddle may act as an independent controller for billing information. Anthropic is not a sub-processor of visitor personal data for the described cookie-name-only classification.

CookieConsentHQ will:

1. Require relevant sub-processors to provide appropriate data protection commitments.
2. Impose obligations that provide a level of protection consistent with this DPA and applicable law.
3. Remain responsible to the Customer for relevant sub-processor performance as required by Article 28 GDPR.
4. Notify the Customer in advance of intended additions or replacements of relevant sub-processors.
5. Provide a reasonable opportunity to object on legitimate data protection grounds.

Where the applicable Standard Contractual Clauses require a defined notice period, the parties agree to 30 days' advance notice for sub-processor changes under their general authorization.

If an objection cannot reasonably be resolved, the Customer may terminate the affected service, subject to applicable law and contractual rights.

9. Assistance with data subject rights

Taking into account the nature of processing and the information available to us, CookieConsentHQ will reasonably assist the Customer in responding to requests concerning:

• Access.
• Correction.
• Erasure.
• Restriction of processing.
• Data portability.
• Objection.
• Other applicable statutory rights.

If CookieConsentHQ receives a request directly from a Customer's website visitor concerning Customer-controlled data, we will refer the request to the Customer where reasonably possible, unless legally required to respond otherwise.

We will not independently decide the validity of a Customer's legal basis for processing.

10. Personal data breaches

CookieConsentHQ will notify the Customer without undue delay and, in any event, within 72 hours after becoming aware of a personal data breach affecting Customer personal data.

Notification will include, to the extent reasonably available:

• The nature of the incident.
• Categories of affected information.
• Known or estimated scope.
• Likely consequences.
• Measures taken or proposed.
• Available contact information for follow-up.

We may provide information in stages as an investigation progresses.

CookieConsentHQ will take reasonable steps to contain, investigate and mitigate the incident.

We will reasonably assist the Customer with required breach notifications and related obligations under Articles 33 and 34 GDPR.

The Customer remains responsible for determining whether and when to notify supervisory authorities or affected individuals.

The contractual notification period above does not extend any shorter deadline imposed by applicable law or the mandatory Standard Contractual Clauses.

11. Data protection assistance

Taking into account the nature of processing and available information, CookieConsentHQ will provide reasonable assistance with the Customer's obligations under Articles 32 through 36 GDPR, including:

• Security of processing.
• Personal data breach assessments.
• Data protection impact assessments.
• Prior consultation with supervisory authorities where required.

Assistance may be subject to reasonable reimbursement for substantial work beyond ordinary service functionality, unless applicable law requires otherwise.

12. International transfers and Standard Contractual Clauses

Where Customer personal data is transferred outside the EEA or United Kingdom and applicable law requires additional safeguards, the parties will use appropriate transfer mechanisms.

EU transfers

Where applicable, the parties incorporate by reference the European Commission's Standard Contractual Clauses adopted under Implementing Decision (EU) 2021/914.

For transfers from a Customer acting as controller to CookieConsentHQ acting as processor, Module Two (Controller to Processor) applies.

For relevant onward transfers from a processor to a sub-processor, Module Three applies where legally appropriate.

The parties select general written authorization for sub-processors, with the notice arrangement described in Section 8.

The parties will complete the applicable SCC annexes using the processing details, party information, technical safeguards and sub-processor information in this DPA and the Customer's account records.

Unless otherwise agreed in the applicable SCCs, the parties select the law of Ireland and the competent courts of Ireland for the purposes of the EU SCC governing-law and jurisdiction clauses.

The competent supervisory authority is determined under the applicable SCCs based on the exporter's circumstances.

Official EU SCC text: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

United Kingdom transfers

Where required by UK GDPR, the parties will use the UK International Data Transfer Addendum to the EU SCCs or the UK International Data Transfer Agreement, as applicable.

The relevant mandatory provisions and completed transfer details must form part of the binding transfer arrangement.

UK transfer guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/

Transfer assessments

Where required, the parties will complete applicable transfer assessments and adopt supplementary safeguards.

The parties will supply or confirm any missing exporter details, annex information or mandatory transfer documentation before relying on an SCC-based mechanism for a restricted transfer.

This DPA does not replace any mandatory SCC text, annex information or transfer assessment that must be completed for a valid transfer.

Where applicable SCCs conflict with this DPA, the mandatory SCC provisions prevail.

13. California service-provider commitments

To the extent the California Consumer Privacy Act and its regulations apply, CookieConsentHQ acts as a service provider for Customer personal information processed under this DPA.

The limited and specified business purposes are delivering consent banners, applying consent and tracker-blocking rules, recording consent decisions, managing regional privacy signals, providing consent analytics and monitoring, and maintaining the security and operation of those functions.

The Customer provides personal information to CookieConsentHQ only for those business purposes.

CookieConsentHQ will not:

• Sell or share Customer personal information as defined by the CCPA.
• Retain, use or disclose it for purposes outside the specified business purposes, except as expressly permitted by law.
• Use it for unrelated commercial purposes.
• Use it outside the direct business relationship with the Customer, except as legally permitted.
• Combine it with personal information from other sources except as permitted by the CCPA and its regulations.

CookieConsentHQ will provide the privacy protections required of applicable service providers, cooperate with reasonable compliance requests and enable the Customer to address applicable consumer rights.

The Customer may take reasonable and appropriate steps to verify compliance and, upon notice, stop and remediate unauthorized processing.

CookieConsentHQ will notify the Customer if it determines that it can no longer meet its applicable CCPA obligations.

Relevant subcontractors must receive required contractual restrictions.

14. Audits and compliance information

CookieConsentHQ will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR.

We will allow and contribute to audits, including inspections, conducted by the Customer or an auditor authorized by the Customer, as required by applicable law.

Audits will be coordinated on reasonable notice, subject to necessary security and confidentiality protections that do not prevent the exercise of mandatory audit rights.

Existing security documentation or independent audit reports may be used where appropriate to satisfy information requests.

The Customer may not access other customers' confidential information or personal data during an audit.

15. Return and deletion of data

Upon termination of the services involving personal data, CookieConsentHQ will, at the Customer's choice, return or delete Customer personal data and delete existing copies, unless applicable law requires continued retention.

The Customer may communicate its choice through an authorized account request or by contacting support@cookieconsenthq.com.

Where data is retained under a legal obligation, it will remain protected and processed only for the permitted purpose.

Residual copies in backups will be protected and removed according to applicable backup expiration and deletion procedures, subject to legal requirements.

CookieConsentHQ will confirm completion of deletion upon reasonable request.

16. Liability and precedence

Liability arising under this DPA is subject to the limitation of liability in the Terms of Service, including the aggregate cap of fees paid during the preceding 12 months, to the extent legally permitted.

Nothing in this DPA limits:

• Statutory rights that cannot legally be excluded.
• The rights of data subjects or supervisory authorities.
• Liability that cannot legally be limited.
• Obligations or liabilities that mandatory Standard Contractual Clauses prohibit limiting.

If this DPA conflicts with the Terms of Service concerning personal data processing, this DPA prevails.

Mandatory Standard Contractual Clauses take precedence over conflicting provisions of both documents.

17. Governing law

Except where applicable SCCs, UK transfer instruments or mandatory privacy laws require otherwise, this DPA is governed by the laws of Pakistan.

Mandatory supervisory authority jurisdiction and data subject rights remain unaffected.

18. Acceptance and contact

This DPA becomes effective when the Customer accepts the Terms of Service and uses CookieConsentHQ to process personal data covered by this agreement.

The Customer's account registration details identify the Customer for contractual purposes.

CookieConsentHQ
Processor: Hamza Ahmad Aslam
Address: Apartment 401, 29AA, Bahria Town, Lahore, Pakistan
Email: support@cookieconsenthq.com
Website: https://cookieconsenthq.com

This DPA establishes contractual data processing obligations. It does not constitute legal advice or guarantee that a Customer's website complies with applicable privacy laws.