Data Processing Addendum

This DPA sets out the terms on which UpWeb Pty Ltd (ABN 85 613 036 918, ACN 613 036 918), trading as LeadGuard, processes personal information on behalf of the customer.

The customer acts as the controller (or the equivalent business role under Australian Privacy Principles or US-state privacy laws) for personal information collected through the site tag on the customer's website. LeadGuard acts as the processor or service provider for that data. UpWeb remains the controller for account, support, billing, abuse-prevention and security administration data.

The subject-matter, duration, nature, purpose and data categories are described in Annex 1. LeadGuard processes the data to provide the service and to comply with the customer's documented instructions and applicable law.

LeadGuard will process customer personal information only on the customer's documented instructions, including as set out in the Terms of Service, this DPA and the customer's configuration of the service. Where LeadGuard is required by law to process outside those instructions, it will inform the customer where legally permitted.

The customer authorises LeadGuard to engage the subprocessors listed in Annex 3 and on the public Subprocessors page. Where reasonably practicable, LeadGuard will give at least 30 days notice before a material new subprocessor begins processing customer personal information, by updating the public list and, on request, by email to a nominated address.

LeadGuard maintains the technical and organisational measures described in Annex 2 and on the Security page. Access to customer personal information is limited to personnel who need it for the service.

LeadGuard will provide reasonable assistance to help the customer respond to individual rights requests (access, correction, deletion, restriction, objection, portability and consent withdrawal) and to meet the customer's own data-protection obligations, taking into account the nature of the processing and the information available.

LeadGuard will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data. The notification will describe the nature of the breach and, where available, the affected categories and approximate volumes of data, the likely consequences and the measures taken or proposed.

Where LeadGuard or an authorised subprocessor processes customer personal information outside the customer's country, LeadGuard will rely on lawful transfer mechanisms where required. LeadGuard does not actively market to customers in the European Economic Area or the United Kingdom at initial publication and has not executed EU Standard Contractual Clauses or the UK International Data Transfer Addendum on this account. Customers requiring those terms should contact team@upweb.com before using LeadGuard for visitor tracking that requires them.

On termination or at the customer's written request, LeadGuard will delete customer personal information within a reasonable period, subject to legal, billing, security, fraud-prevention and dispute retention requirements. Provider-managed backups may retain deleted data for up to 35 additional days before routine overwrite.

LeadGuard will make available information reasonably necessary to demonstrate compliance with this DPA and will allow reasonable audits, conducted at the customer's cost and subject to confidentiality and reasonable scheduling.

This DPA remains in effect while LeadGuard processes customer personal information. Where a term of this DPA conflicts with the Terms of Service, the DPA prevails for customer personal information processed on the customer's behalf.

Subject-matter

Provision of the LeadGuard service, including pathway discovery, monitoring, alerts and conversion insights for the customer's website.

Duration

The term of the customer's LeadGuard subscription or trial, plus the retention periods described in the Privacy Policy.

Nature and purpose

Collecting and processing pseudonymous visitor and pathway activity, running synthetic monitoring checks, generating alerts and analytics, and providing related support.

Categories of data subjects

Visitors to the customer's website; the customer's authorised users.

Categories of personal information

Pseudonymous visitor and session identifiers; page URLs, titles, referrers and campaign parameters; browser and device information; pathway view and interaction events; confirmed-outcome events; monitoring evidence; alert delivery records; authenticated-user account details for the customer's authorised users.

Measures include: HTTPS in transit; Postgres row-level security with role separation between anonymous, authenticated and service contexts; a private storage bucket for support attachments served via short-lived signed URLs; signed webhook verification for payment events; HMAC-SHA256 hashing of abuse-prevention identifiers; authentication managed by our provider; restricted administrative roles; application and security logging; and Stripe-hosted card handling so LeadGuard does not receive or store payment-card numbers. See Security.

The current authorised subprocessor list is maintained at Subprocessors and is incorporated into this DPA.