Webeyez Data Processing Addendum

This Addendum (“DPA”) forms part of the Webeyez Terms of Service or other agreement between Webeyez Analytics Ltd. (“Webeyez”, “we”) and the customer named in the Order Form (“Customer”, “you”) (the “Agreement”). It applies whenever we process personal data on your behalf and a data protection law applies to that processing.

Terms we don’t define here have the meaning given in the Agreement or in the GDPR. “Data Protection Law” means the EU GDPR, UK GDPR, Swiss FADP, the Israeli Protection of Privacy Law, and US state privacy laws including the CCPA – whichever apply to the processing.

Accepting the Agreement accepts this DPA. Email [email protected] if you need a countersigned copy.

1. Who does what

You are the controller (or “business”). We are your processor (or “service provider”). You decide what data is collected and why; we process it only for you.

If you’re acting for someone else’s account, an agency running the platform for a client, say you confirm you have that client’s authority to give us these instructions.

Where we’re a controller instead. We’re an independent controller for your account and billing details, your staff’s use of our application, our security and telemetry logs, and aggregated data. Our Privacy Policy covers that, not this DPA.

The details of what we process are in Annex A. This DPA lasts until we’ve stopped processing your data.

2. Your responsibilities

You’re responsible for:

the legal basis. Establishing one, and keeping it valid.
notices and consent. Telling visitors what’s happening and getting consent where the law requires it, including prior consent for cookies and session recording. Note that an anonymous cookie still needs consent under EU ePrivacy rules; anonymity doesn’t remove the obligation.
honouring opt-outs, including Global Privacy Control and similar signals, and responding to data subject requests.
configuration. Setting masking, exclusion and redaction properly. We can’t see what you choose to capture, and we don’t control it.
keeping prohibited data out. No special category data under Article 9, health data, precise geolocation, government ID numbers, payment card data, credentials, or children’s data. We give you the controls; we don’t filter, and we’re not liable if you send it anyway.
lawful instructions. Your instructions won’t put us in breach of Data Protection Law.

Your documented instructions to us are: the Agreement, this DPA, our documentation, and how you configure the platform. Anything else needs to be agreed in writing.

3. Our commitments

Follow your instructions. We process your data only on your documented instructions, unless the law requires otherwise, in which case we’ll tell you first, unless we’re legally barred from doing so.

Tell you if an instruction looks unlawful. We may pause the affected processing until it’s sorted, without liability for the pause.

Keep our people bound. Everyone with access is under confidentiality obligations, trained, and limited to what they need.

Stay within purpose. We don’t use your data for anything other than providing the Services, we don’t use it outside our relationship with you, and we don’t combine it with data from anyone else. We don’t sell or share your data, and we receive nothing of value in exchange for it.

Keep records of what we process for you, as Article 30(2) requires.

4. Security

We maintain security measures appropriate to the risk, as Article 32 requires. They’re set out in Annex B. We hold ISO/IEC 27001, certificates on request.

We may update our measures, but not in a way that materially reduces protection.

You’re responsible for your own configuration, your users’ access and credentials, and your own systems and for deciding whether Annex B meets your requirements.

5. Sub-processors

You give us general authorization to use sub-processors, including our affiliates.

We’ll give you 30 days’ notice before a new Sub Processor starts processing your data, by updating that page and notifying subscribers. Subscribing is up to you.

To object, email [email protected] within the notice period with reasonable, documented grounds. We’ll talk it through and try to find an alternative.

Every sub-processor is bound by written terms no less protective than these, and we remain fully liable to you for what they do, subject to the liability caps in the Agreement.

If we urgently need to swap a sub-processor to keep the platform running or secure, we may, and we’ll tell you as soon as we can. Your objection right still applies.

6. Data subject requests

You can search, export and delete data yourself in the platform, please use that first. Where it isn’t enough, we’ll help, taking into account what’s technically possible. We may charge for excessive or repetitive requests, with notice first.

If a data subject comes to us directly, we won’t answer substantively. We’ll point them to you and forward the request if we can tell which customer it relates to.

We’ll also give you reasonable help with impact assessments and regulator consultations under Articles 35 and 36, mostly by making our documentation, Annex B and our certifications available.

7. If there’s a breach

We’ll tell you without undue delay, and within 72 hours of confirming a personal data breach affecting your data.

We’ll tell you what we know, what happened, roughly how many people and records, likely consequences, what we’re doing about it, and who to contact, and we’ll fill in the gaps as the investigation progresses. We’ll contain and investigate, and help you meet your own notification duties.

Deciding whether to notify regulators or individuals is yours. Please don’t name us publicly without our consent unless the law requires it. Telling you about a breach isn’t an admission of fault.

Where Israeli law requires us to report a severe incident, we’ll comply and let you know if it concerns your data.

8. Where your data goes

We host the platform in Western Europe. Our people access it from Israel, which has an EU adequacy decision, so those transfers need nothing extra. We’ll give you 30 days’ notice before materially changing the hosting region.

If a transfer does need a mechanism, the EU Standard Contractual Clauses (Decision (EU) 2021/914) apply, on this basis:

Module Two where you’re a controller; Module Three where you’re a processor for someone else
You’re the exporter, we’re the importer
Clause 7 (docking) applies; Clause 9 Option 2 (general authorisation), with the notice period in Section 5
Clause 11 optional dispute body: doesn’t apply
Clauses 17 and 18(b): law and courts of Ireland
SCC Annexes I and II are populated by our Annexes A and B

For the UK, the ICO’s International Data Transfer Addendum applies to those Clauses; under Table 4, neither party may end it under Section 19. For Switzerland, the Clauses apply with the FADP substituted, the FDPIC as the authority, and protection extended to legal entities while the FADP requires it.

If an adequacy decision we rely on is withdrawn or invalidated, the mechanism above applies automatically from that date.

Government requests. Where we’re legally allowed, we’ll tell you about binding requests for your data, challenge ones that are unlawful or overbroad, disclose only the minimum required, and keep records.

9. Audits

We’ll give you what you reasonably need to verify our compliance, this DPA, Annex B, our ISO certificates, and summary assessment and penetration test reports where we can share them.

If that isn’t enough, you can audit us once in any 12 months, on [30] days’ notice. In practice: documentation first, then a questionnaire, then a remote or on-site inspection only if still needed. Inspections happen in business hours, don’t disrupt operations, and don’t extend to other customers’ data, our commercial information or our source code. Any third-party auditor must be independent, not a competitor, under confidentiality, and reasonably acceptable to us. You cover your costs and our reasonable costs, unless the audit finds a material breach by us. Findings are confidential.

You can audit again inside 12 months after a confirmed breach affecting your data, or where a regulator requires it. We’ll also cooperate with regulators directly where the law says we must.

10. Retention and deletion

Data expires on its own. Session recordings are deleted one month after collection. Analytics, event and metric data is deleted three months after collection. No action needed from either of us.

When you stop using Webeyez, we purge your data. It’s deleted from live systems within the data retention period starting on your subscription ending, and from backups within a further 30 days. Deletion is permanent.

We’ll certify deletion in writing if you ask.

The only exceptions are aggregated data that identifies nobody, records we’re legally required to keep, and anything needed for a live legal claim, which we isolate from further processing.

These commitments cover our systems. They don’t reach data you’ve sent to an AI Provider under Section 11 we can’t delete or recall that.

11. AI assistants (Webeyez MCP)

This section applies only if you turn the feature on.

Turning it on is an instruction to us. When you connect an AI assistant like Claude, ChatGPT, Gemini or another platform (an “AI Provider”) you’re instructing us to disclose your data to it. We don’t choose, vet or endorse AI Providers, and we act on your instruction without assessing whether that provider suits you. You can revoke the authorisation any time, and it stops future disclosures.

The AI Provider is not our sub-processor. It isn’t covered by Section 5, isn’t subject to the notice-and-objection process, and isn’t something we’re liable for. It’s your processor or an independent controller, engaged by you. Putting the right contract and transfer mechanism in place with it is your job.

Any auth provider we use is ours. If we engage a third party to handle the authorisation handshake, it is a sub-processor, it’s on our list, and Section 5 applies in full.

What can flow out. Only data in the account you authorised, only in response to authenticated requests. It may include session recordings and replay links, error and diagnostic data, analytics, reports, metrics, issues, events, and configuration and recordings may contain visitor personal data your masking didn’t catch.

What flows in. We receive only what the AI service sends us to perform the specific action requested: account and organisation identifiers, authorisation and connection details, the request parameters themselves, and limited technical and security information needed to run and protect the integration. We do not request or retrieve your conversation history with your AI Provider. We use this only to authenticate you, fulfil the request, return the result, keep the integration secure, and meet legal obligations, never for advertising or profiling.

Turning it off. You can disconnect or revoke a connection at any time, through your AI Provider or your Webeyez account settings. That stops future access. It doesn’t delete data already in your Webeyez account, and it doesn’t delete or recall anything already transmitted to your AI Provider.

Once it’s gone, it’s gone. Data at your AI Provider is governed by that provider’s terms, not this DPA. Our retention periods and purge commitments (Section 10), our security measures (Section 4), and our breach obligations (Section 7) don’t follow it. We can’t delete, expire or recall it, and we can’t help with data subject requests about it.

Before you enable it, check your AI Provider’s terms, retention and training practices; check your masking is right for data leaving the platform; make sure your notices and consents actually cover this onward disclosure, consent to analytics on your site isn’t consent to send recordings to a third-party AI service; do any assessment your obligations require; and control who can authorise a connection and who can see the resulting conversations.

What we commit to. We don’t use your data, or anything accessed through MCP, to train AI models. We only reach the account you authorised, never your other platforms. We log authorisations and access for your administrators. We’ll give notice before materially changing how the feature handles data.

Your indemnity in Section 14.2 of the Agreement covers claims arising from your use of this feature.

12. US state privacy laws

Where US state privacy laws apply, you’re the business and we’re a service provider. We process personal information only to provide the Services, which is the business purpose.

We will NOT:

sell or share it, as the CCPA defines those terms;
retain, use or disclose it for anything other than providing the Services, or for any other commercial purpose;
retain, use or disclose it outside our direct relationship with you; or
combine it with personal information from anyone else, except as the law allows for a business purpose.

We certify that we understand these restrictions and will comply with them.

We’ll give the same level of protection the law requires of you, and tell you promptly if we can’t. You can verify this through Section 9. Where we handle de-identified data, we won’t try to re-identify it and we’ll bind anyone we give it to on the same basis. We’ll help with consumer requests as set out in Section 6 – receiving, verifying and answering them is yours, as is honouring opt-out signals. Sub-processors are engaged on equivalent written terms.

13. Israel

Where the Israeli Protection of Privacy Law applies, we comply with our obligations under it and the Privacy Protection (Data Security) Regulations 5777-2017, security measures for the relevant database tier, access restriction and logging, and incident reporting. This includes the changes made by Amendment No. 13, in force since 14 August 2025.

14. Liability, changes and precedence

Liability under this DPA is subject to the exclusions and caps in the Agreement, including the enhanced cap for data protection breaches. It counts toward those caps rather than adding to them. Nothing here limits what either of us owes data subjects under Article 82, or a regulator’s powers, or liability under the SCCs.

This DPA wins over the Agreement on anything to do with personal data. The SCCs and UK Addendum win over this DPA for the transfers they govern.

We may update this DPA where the law, a regulator, a transfer mechanism, our sub-processors or our security measures change, provided protection isn’t materially reduced. Material changes are notified as the Agreement provides.

If any part of this is invalid, the rest stands. Governing law is as stated in the Agreement, unless Data Protection Law or the SCCs require otherwise.

Annex A – What we process

(This populates Annex I of the EU SCCs.)

Exporter / controller: Customer, as named in the Order Form. Contact: the account Administrator. Activity: use of the Webeyez platform on Customer’s websites and applications.

Importer / processor: Webeyez Analytics Ltd., Halamish 15, Caesarea, Israel. Contact:

Subject matter and purpose. Providing the Webeyez digital-experience, error-detection and conversion-analytics platform, so Customer can monitor and improve its digital properties, find technical errors and friction, analyse conversion funnels, replay sessions for diagnosis, and receive alerts.

Duration. The term of the Agreement, plus the periods in Section 10.

Frequency. Continuous and automated.

Data subjects. Visitors to Customer’s websites and applications; Customer’s own users and administrators.

Personal data:

a randomly generated session identifier held in an anonymous cookie, not derived from anything about the visitor, device or network
device, browser, operating system, screen, language and connection attributes
pages and screens viewed, page titles, referrer, links clicked, timestamps, session duration
interaction data – mouse movement, clicks, taps, scrolls, form-field interaction events, rage clicks and other friction signals
session recordings, subject to Customer’s masking configuration
JavaScript, API and network errors; performance and diagnostic data
eCommerce and conversion events, including cart, checkout and transaction events and values
anything else Customer chooses to send via custom events or attributes, which may include a customer ID or email address

Not used, not stored:

We don’t store visitors’ IP addresses. An IP is necessarily present in the network connection, but it isn’t written to any datastore, log or record.
We don’t derive or store geolocation.
We don’t use device or canvas fingerprinting, or anything equivalent.

Sensitive data: none. Customer is contractually barred from sending it (Section 2), and we provide masking and exclusion controls.

Retention. Session recordings: one month. Analytics, event and metric data: three months. Then automatic deletion. Purge on termination per Section 10.

Sub-processors. As listed at SUBPROCESSOR, for the duration of their engagement.

Customer-directed disclosure. Where Customer enables Webeyez MCP (Section 11), data from the authorised account, including recordings and replay links, is disclosed to Customer’s chosen AI Provider. That provider is not our sub-processor, and our retention periods don’t apply once data reaches it.

Annex B – Security measures

Area	Measures
Governance	ISMS certified to ISO/IEC 27001; named security owner; policies reviewed annually
Minimisation	Anonymous randomly generated session identifier; no fingerprinting; IP addresses not stored or used for location; masking and field exclusion available, input fields masked by default; retention capped at 1 and 3 months with automatic deletion
Encryption	[TLS [1.2]+ in transit;
Access control	Least privilege on documented approval; MFA for administrative and remote access; unique named accounts; quarterly access reviews; prompt revocation; privileged access logged
Segregation	Separate production environment; logical tenant separation; separate development, staging and production; production data not used in non-production unless anonymised
Physical	Hosting in Western Europe, certified to ISO 27001 / SOC 2;

Testing	Annual third-party penetration testing; regular vulnerability scanning with severity-based remediation SLAs; periodic external security assessment
Incidents	Documented response plan with severity levels and escalation; 24/7 detection and alerting; post-incident review; notification per Section 7

Suppliers	Security assessment before onboarding; contractual data protection terms; periodic reassessment; maintained sub-processor register
Deletion	Documented retention schedules; automated deletion; secure media sanitisation; certification on request