Data Processing Agreement
Last updated 27 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Ravindra Bisht, trading as LiftCRO (“Processor”) and the Customer (“Controller”). It applies whenever LiftCRO processes personal data of visitors to the Customer's websites, and is designed to meet Article 28 of the GDPR and the UK GDPR. No signature is needed; if your procurement team needs a countersigned copy, email [email protected].
1. Subject matter and details
| Purpose | Assigning website visitors to experiment variations, applying them, and measuring results for the Controller. |
| Data subjects | Visitors to the Controller's websites who enter an experiment. |
| Personal data | Pseudonymous visitor ID, assigned variation, device, browser and OS family, new/returning flag, traffic source, configured conversion events and values. |
| Special categories | None. The Controller must not send special-category data in custom events. |
| Duration | For the term of the agreement plus the retention period of the Controller's plan. |
2. Processor obligations
- Process personal data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's configuration of the service.
- Ensure everyone authorised to process the data is bound by confidentiality.
- Implement the security measures in section 5.
- Help the Controller respond to data subject requests and with data protection impact assessments, taking into account the nature of the processing.
- Notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach.
- Make available the information needed to demonstrate compliance, and allow audits by the Controller or its auditor once a year with 30 days' notice, normally satisfied by written answers and our security documentation.
3. Subprocessors
The Controller authorises the subprocessors listed on the subprocessors page. We give at least 30 days' notice by email before adding or replacing one; the Controller may object on reasonable data-protection grounds and, if we can't resolve the objection, terminate the affected service. We impose the same data protection obligations on every subprocessor and remain liable for them.
4. International transfers
Where personal data is transferred outside the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference.
5. Security measures
- Encryption in transit (TLS 1.2+) for all traffic; database volumes encrypted at rest.
- Pseudonymous visitor IDs; full IP addresses are not stored.
- Role-based access for customer users, optional two-factor authentication, and an audit log of changes and support access.
- Production access limited to authorised staff with two-factor authentication.
- Nightly encrypted backups kept for 30 days, with restore tests.
- Rate limiting, bot filtering, dependency updates and error monitoring.
6. Deletion and return
On termination, the Controller can export results for 30 days. We then delete the Controller's personal data, including from backups within the backup cycle, unless the law requires us to keep it.
7. Controller obligations
The Controller is responsible for having a lawful basis for the processing, for informing visitors and collecting any consent required (the snippet supports consent mode), and for not sending personal data the service isn't designed for.