Data Processing Agreement

Last updated: 10 November 2026

This Data Processing Agreement ("DPA") applies where CookieChest (a trading name of Dave Wyborn, sole trader, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, "Processor") processes personal data on behalf of a client ("Controller") in the course of providing the CookieChest cookie consent management service ("CMP Service"). It supplements our Terms of Service and is incorporated into the agreement between us from the date the Controller's website first uses the CMP Service. No separately signed copy is required, in the same way clicking to accept our Terms is enough to be bound by them. If you need a signed copy for your own records, request one through cookiechest.com/contact.

This DPA does not apply to CookieChest's compliance monitoring or audit services, where CookieChest does not process personal data on a Controller's behalf in the same way. See our Privacy Policy for how that data is handled.

1. Definitions

• Data Protection Legislation: UK GDPR, the EU GDPR, the Data Protection Act 2018, and any equivalent law applicable to the processing under this DPA.
• Controller / Processor / Personal Data / Processing / Data Subject: as defined in the Data Protection Legislation.
• Site: the Controller's website(s) on which the CMP Service is installed.
• Visitor: a person visiting the Site, i.e. the data subject whose personal data is processed under this DPA.
• Sub-processor: any processor engaged by CookieChest to process Visitor personal data in providing the CMP Service.

2. Roles

The Controller is the data controller for personal data collected from Visitors via the CMP Service on its Site. CookieChest is the data processor, acting only on the Controller's instructions as set out in this DPA and in the CMP Service's own configuration (which the Controller controls).

3. Subject matter, nature, purpose and duration

Subject matter: CookieChest's provision of the CMP Service to the Site.

Nature of processing: automated display of a consent banner; automated recording of each Visitor's consent choice; automated blocking of certain third-party scripts pending that choice; and, only where the Controller has enabled the CMP Service's optional multi-region banner feature, momentary resolution of a two-letter country code for the Visitor at CookieChest's infrastructure provider's network edge.

Purpose: enabling the Controller to obtain, record and demonstrate valid Visitor consent for cookies and similar tracking technologies on the Site, as required by PECR, the Data Protection Legislation, and (where the multi-region feature is enabled) equivalent consent or opt-out regimes such as US state privacy laws.

Duration: for as long as the CMP Service is installed on the Site, plus the retention periods below.

Categories of data subjects: Visitors to the Site.

Categories of personal data:

• A random consent identifier, generated by the Visitor's own browser and stored there, not derived from, or linked to, any other identifier CookieChest holds
• The Visitor's consent choice (accept, reject, or a custom selection by category)
• The date and time of that choice
• The page URL on which the choice was made, and the banner configuration version shown
• Where the Controller has enabled the multi-region banner feature only: a two-letter country code. The Visitor's IP address is used momentarily, at the network edge, to resolve this code. It is never stored, logged, or made available to CookieChest itself, and it is not processed at all for a Controller who has not enabled this feature

No other personal data (no name, email address, device identifier, precise/GPS location, or IP address) is ever processed by the CMP Service.

4. Processor obligations

CookieChest will process Visitor personal data only on the Controller's documented instructions (including this DPA and the Controller's own configuration of the CMP Service), unless required to do otherwise by law, in which case CookieChest will inform the Controller first unless prohibited from doing so. If an instruction appears to CookieChest to breach the Data Protection Legislation, CookieChest may suspend that instruction pending clarification. Anyone at CookieChest with access to this data is bound by confidentiality obligations and access is limited to what is needed to provide the CMP Service.

5. Security of processing

Taking into account the nature of the processing, CookieChest maintains:

• Data minimisation by design: the CMP Service does not read, log, or store a Visitor's IP address, device identifier, name, or email address, so there is nothing of that kind to secure or lose
• Encryption in transit (TLS) for all data between a Visitor's browser and CookieChest's infrastructure
• Access to the underlying infrastructure restricted to authorised CookieChest personnel, protected by unique credentials and, where available, multi-factor authentication
• Automated, schedule-enforced deletion once the retention periods below are reached, rather than relying on a manual process
• Version-controlled change history for the CMP Service's own code and configuration

The CMP Service runs entirely on Cloudflare's infrastructure (see Sub-processors below), which maintains its own independent security certifications and publishes its own security practices at cloudflare.com/trust-hub.

6. Sub-processors

The Controller gives general authorisation for CookieChest to engage the following Sub-processor to provide the CMP Service:

• Cloudflare, Inc.: hosting of the CMP Service (Cloudflare Workers, D1 database, KV store) and network-edge resolution of the country code described above.

If CookieChest intends to add or replace a Sub-processor, it will notify the Controller by email at least 14 days beforehand. If the Controller does not object within that 14-day window, the change is treated as accepted. If the Controller objects on reasonable data protection grounds, CookieChest will work with the Controller to address the concern or, failing that, the Controller may terminate the CMP Service for that Site without penalty. Notice will be sent to the email address associated with the Controller's subscription (as registered at checkout) unless the Controller has told CookieChest to use a different address.

7. International transfers

Cloudflare operates a global network. Where personal data is transferred outside the UK or EEA as a result, CookieChest relies on the safeguards Cloudflare itself provides for this purpose (including the UK International Data Transfer Addendum and EU Standard Contractual Clauses, as applicable), details of which are available from Cloudflare on request.

8. Assistance with data subject requests

CookieChest is not the Controller for Visitor personal data processed via the CMP Service, and a Visitor's data protection rights (such as access, erasure, or objection) run against the Controller, not against CookieChest. Where a Visitor contacts CookieChest directly about a Site they visited, CookieChest will:

• Explain that CookieChest is a processor, not the controller, for that data, and direct the Visitor to the Controller's own privacy policy for the correct contact;
• Where the Site can be identified, pass the enquiry to the Controller as a courtesy (this is a best-efforts step, not a guaranteed turnaround); and
• Where the Controller instructs CookieChest to delete or locate a specific Visitor's data, action this to the extent technically possible; in practice, only by the Visitor's own consent identifier (see section 3), since no other identifying information exists in CookieChest's systems to search against.

CookieChest will otherwise provide the Controller with reasonable assistance to meet its own obligations to respond to Visitor rights requests, and to its obligations under Articles 32 to 36 UK/EU GDPR (security, breach notification, and data protection impact assessments), taking into account the nature of the processing and the information available to CookieChest.

9. Personal data breaches

CookieChest will notify the Controller without undue delay after becoming aware of a breach affecting the Controller's Visitor personal data, and will provide the information reasonably available to CookieChest to help the Controller meet its own notification obligations.

10. Audit

On reasonable written notice (at least 30 days), no more than once in any 12-month period, the Controller may request information demonstrating CookieChest's compliance with this DPA. CookieChest may satisfy this by providing existing documentation rather than permitting an on-site or remote audit, where that documentation reasonably answers the request; any audit beyond that is at the Controller's own cost and must not unreasonably disrupt the CMP Service for other clients.

11. Deletion at end of service

On request following termination of the CMP Service for a Site, CookieChest will delete all Visitor personal data held for that Site within 30 days, except where the Data Protection Legislation or another law requires it to be retained for longer. Absent such a request, data already logged continues to age out automatically under the retention periods below. Termination does not itself trigger early deletion of historical records, since those records exist to evidence consent already given while the Service was live.

Current retention periods: consent records, 3 years from the date of each decision; banner-impression records (page loads where no decision was yet made), 60 days.

12. Liability

Each party's liability under this DPA is subject to the limitations set out in our Terms of Service, except that nothing in this DPA excludes or limits either party's liability to a data subject under Article 82 of the UK/EU GDPR, which cannot be excluded by agreement between the parties.

13. Term

This DPA takes effect when the CMP Service is first used on a Site and continues for as long as that Service is in use, plus any period needed to complete the obligations in sections 9 to 11 above.

14. General

Where this DPA conflicts with our Terms of Service on a data protection matter, this DPA takes precedence. This DPA is governed by the laws of England and Wales, with the courts of England and Wales having exclusive jurisdiction.

Contact

Questions about this DPA, or to report a Visitor data request or a suspected breach? Email [email protected] or use our contact form at cookiechest.com/contact. Post: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA.