Kliksy Data Processing Agreement

Version 2026-11-07. Effective 7 November 2026.

This Data Processing Agreement, the "DPA", forms part of the Kliksy Terms of Service between the customer, "you" or the "Controller", and EBOOK MEDIA LLC, "Kliksy" or the "Processor". It applies when Kliksy processes personal data on your behalf as a processor under the General Data Protection Regulation, Regulation (EU) 2016/679, the "GDPR". It is accepted together with the Terms and needs no separate signature.

1. Subject matter, duration, nature and purpose

1.1 Subject matter: hosting of your pages and storage of data that your pages, forms, page databases and integrations collect, as described in Annex 1.

1.2 Duration: for the term of the Agreement and the deletion period in Section 9.

1.3 Nature and purpose: storage, hosting, transmission, display, backup, restoration and deletion of personal data, solely to provide the Service to you.

2. Roles

2.1 You are the controller of the personal data described in Annex 1, and Kliksy processes it on your behalf. For account, billing and security data about you and your team, Kliksy is a separate controller under its Privacy Policy.

2.2 You are responsible for the lawfulness of the processing, for having a legal basis and all required consents, for informing your visitors, leads and customers through your own privacy policy, and for the instructions you give.

3. Instructions

3.1 Kliksy processes personal data only on your documented instructions, including with regard to transfers to third countries, unless required by law to which Kliksy is subject. In that case Kliksy informs you before processing unless the law prohibits it.

3.2 The Agreement, your configuration of the Service and the actions you or your AI agent take through the Service are your complete instructions. Additional instructions require written agreement and may be charged.

3.3 Kliksy informs you if, in its opinion, an instruction infringes data protection law. Kliksy is not required to check the lawfulness of your instructions.

4. Confidentiality and security

4.1 Kliksy ensures that persons authorized to process the personal data are bound by confidentiality.

4.2 Kliksy implements the technical and organizational measures described in Annex 2. Kliksy may update these measures as long as the overall level of protection is not reduced.

4.3 You are responsible for the security of your own account, your AI agents, your page code and the data you choose to collect.

5. Sub-processors

5.1 You give Kliksy general authorization to engage sub-processors. The current sub-processors are listed in Annex 3.

5.2 Kliksy informs you of any intended addition or replacement of a sub-processor at least 30 days in advance by e-mail or in the dashboard. You may object on reasonable data protection grounds within that period. If we cannot address the objection, your sole remedy is to terminate the Agreement before the change takes effect and receive a refund of prepaid fees for the unused part of the billing period.

5.3 Kliksy imposes on each sub-processor data protection obligations that provide at least the same level of protection as this DPA and remains responsible to you for the performance of its sub-processors' obligations as required by the GDPR.

6. Assistance

6.1 Taking into account the nature of the processing, Kliksy assists you by appropriate technical and organizational measures, insofar as possible, in responding to requests of data subjects. The Service lets you view, export and delete leads and page data yourself. Kliksy forwards to you any request it receives that relates to your data and does not answer it itself unless you instruct it to.

6.2 Kliksy assists you in ensuring compliance with Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Kliksy. Assistance beyond the self-service features of the Service may be charged at reasonable cost.

7. Personal data breaches

7.1 Kliksy notifies you without undue delay after becoming aware of a personal data breach affecting your personal data and provides the information reasonably available to help you meet your own notification obligations.

7.2 Notification of a breach is not an acknowledgement of fault or liability.

8. Audits and information

8.1 Kliksy makes available to you the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, primarily in writing.

8.2 If written information is not sufficient, you may audit Kliksy once a year, with at least 30 days' notice, during business hours, at your cost, through an independent auditor bound by confidentiality, in a way that does not disrupt the Service or compromise the security or confidentiality of other customers. Audits are performed remotely unless an on-site audit is required by law or by a supervisory authority.

9. Return and deletion

9.1 During the term you can export and delete your data using the Service.

9.2 After the Agreement ends, Kliksy deletes the personal data processed on your behalf within 30 days, unless law requires storage. Data in backups and recovery history is overwritten in the ordinary cycle within a further 30 days and is not used in the meantime. Export your data before the end of the Agreement if you want to keep it.

10. International transfers

10.1 Kliksy is established in the United States and may process personal data in the United States and other countries where it or its sub-processors operate. Customer page databases, files and backups are stored in the European Union where the Service is configured for it.

10.2 To the extent personal data subject to the GDPR is transferred to Kliksy or its sub-processors in a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two, controller to processor, are incorporated into this DPA by reference, with the following choices: Clause 7 does not apply; under Clause 9 option 2 applies with the notice period in Section 5.2; the optional wording in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the one determined by your establishment or, if you are not established in the EU, the one of the Member State of Kliksy's EU representative; under Clause 17 the clauses are governed by the law of the Republic of Estonia; under Clause 18 disputes are resolved by the courts of the Republic of Estonia. Annexes 1 to 3 of this DPA complete the Annexes of the clauses. If this DPA conflicts with the Standard Contractual Clauses, the clauses prevail.

10.3 Where a recipient is certified under the EU-U.S. Data Privacy Framework, the parties may rely on that framework instead.

11. Liability

11.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, to the extent permitted by the GDPR and the Standard Contractual Clauses. Nothing in this DPA limits any party's liability to data subjects where such limitation is not permitted.

11.2 You indemnify Kliksy against claims, fines and costs arising from processing carried out on your instructions or from your breach of data protection law, in accordance with Section 18 of the Terms of Service.

12. Order of precedence

12.1 In matters of personal data protection this DPA prevails over the Terms of Service. In all other matters the Terms of Service apply.

Annex 1. Description of processing

Kliksy's built-in page analytics counts page views and events without cookies and without storing IP addresses, page addresses, query strings, user agents or other personal identifiers.

Annex 2. Technical and organizational measures

1. Encryption in transit with TLS for the dashboard, the API, the MCP connection and hosted pages.
2. Encryption at rest of secrets and credentials you store, with authenticated encryption bound to your workspace and page.
3. Separation of customers: customer page code runs in an isolated environment without access to the platform database, platform credentials or other customers' data. Each page database is separate.
4. Access control: every request is authenticated and checked for ownership. AI agent access uses scoped tokens with short lifetimes that you can revoke. Staff access is limited to persons who need it.
5. Restriction of outbound network access from customer page code to approved destinations.
6. Hard limits on storage, requests, queries and spending to protect availability.
7. Daily backups with a retention of 30 days and recovery history of up to 30 days for page databases.
8. Logging of security relevant events with redaction of secrets.
9. Data minimization in analytics as described in Annex 1.
10. Incident response: investigation, containment, notification under Section 7 and documentation of every incident.
11. Regular review and testing of security measures before features are released.

Annex 3. Sub-processors