Data Processing Agreement

Effective date: 5 October 2026.

This Data Processing Agreement (“DPA”) is accepted automatically when you agree to the SiteAccessible Terms and Conditions during registration, and forms part of them. It governs how SiteAccessible, a product of QROLLING LLC, a limited liability company registered in Georgia under number B26345195, with its registered office at 75A Erosi Manjgaladze Street, Tbilisi 0159, Georgia (“Processor”), handles personal data processed through the widget on your websites on your behalf.

1. Definitions

Terms not defined here have the meanings given in the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or the Law of Georgia on Personal Data Protection.

• “Controller” means the SiteAccessible customer (an individual or entity) who decides to install the widget on a website and so determines the purposes and means of the processing described here.
• “Processor” means QROLLING LLC, operating SiteAccessible, which processes Personal Data on behalf of the Controller in accordance with the Controller's documented instructions.
• “Personal Data” means any information relating to an identified or identifiable natural person that is processed through the Service on the Controller's behalf.
• “Data Subject” means the natural person to whom Personal Data relates — here, a visitor of a website on which the Controller has installed the widget.
• “Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, erasure or destruction.
• “Sub-processor” means a third party engaged by SiteAccessible to process Personal Data on behalf of the Controller.
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• “Supervisory Authority” means the competent data-protection authority, including the Personal Data Protection Service of Georgia and the relevant EU authorities.

2. Scope and Purpose

2.1 This DPA applies to the Personal Data that SiteAccessible processes on behalf of the Controller in order to deliver the widget to the visitors of the Controller's websites, to verify that the widget is licensed for the domain it runs on, to count usage, and to keep the Service secure.

2.2 The purpose of the processing is limited to providing the Service as described in the Terms and Conditions. SiteAccessible shall not process the Personal Data for any other purpose without the Controller's prior written instruction, except where required by law.

2.3 Processing for which SiteAccessible is itself the controller — the Controller's own account, billing and support data — is outside this DPA and is described in the Privacy Policy.

2.4 Duration. This DPA applies for as long as the Controller uses the Service, plus the retention period in Section 14.

3. Roles of the Parties

• The Controller (you) decides whether and where the widget is installed, which features and analytics are switched on, and is responsible for the lawfulness of the processing.
• The Processor (SiteAccessible) processes the Personal Data solely on the Controller's documented instructions and as described in this DPA. The Controller's configuration of the widget in the panel, and these Terms, are those instructions.

You acknowledge that as Controller you are responsible for:

• having a lawful basis for the processing;
• informing your visitors about the widget where the law requires it, for example in your privacy notice;
• responding to requests from Data Subjects;
• complying with the data-protection laws that apply to you and to your visitors.

4. Categories of Personal Data and Data Subjects

4.1 Personal Data processed

4.2 What is not processed

• No cookie is set on the Controller's website and no visitor identifier is created.
• The visitor's saved settings — the adjustments chosen, the button position and the language — are stored only in the visitor's own browser and are never transmitted. When analytics is on, the name of an adjustment being switched on is reported as described in Section 4.1 and kept only as a daily total.
• No page address, page content, form input or account data of the Controller's visitors is collected.
• No special category of Personal Data is collected: in particular, the Service keeps no record from which the disability or health of an individual could be inferred.

4.3 Data Subjects

Visitors of the websites on which the Controller has installed the widget.

5. Controller's Obligations

• Lawful basis. The Controller warrants that it has a valid legal basis under Article 6 GDPR (and applicable local law) for offering the widget on its website.
• Privacy notice. The Controller shall give its visitors a clear privacy notice that covers the use of the widget where the law requires one.
• Authorised domains. The Controller shall install the widget only on websites it owns or is authorised to manage.
• Data Subject requests. The Controller is primarily responsible for responding to Data Subject requests, with the assistance set out in Section 10.
• Configuration. The Controller shall not use configuration fields of the Service (site names, custom CSS, statement address and similar) to store Personal Data of third parties.

6. Prohibited Uses

The Controller must not use the Service to:

• identify, track or profile individual visitors, or combine usage figures with other data in order to infer the disability or health of an identifiable person;
• inject, through custom CSS or otherwise, content that collects Personal Data from visitors;
• collect payment-card data, government identification numbers, authentication credentials or Personal Data of children under 16.

A breach of this Section is a material breach of this DPA and of the Terms. SiteAccessible may suspend or terminate the account, delete data collected in breach, report the matter to a Supervisory Authority where the law requires it, and seek indemnification for resulting damages or fines.

7. Processor's Obligations

SiteAccessible, as Processor, undertakes to:

• Instructions. Process Personal Data only on the Controller's documented instructions, unless required to do otherwise by law, in which case it shall inform the Controller unless the law prohibits this.
• Confidentiality. Ensure that everyone authorised to process Personal Data is bound by appropriate confidentiality obligations.
• Security. Implement and maintain the technical and organisational measures in Section 8.
• Sub-processors. Engage Sub-processors only in accordance with Section 9.
• Data Subject rights. Assist the Controller as described in Section 10.
• Data Breaches. Notify the Controller as described in Section 11.
• Impact assessments. Give reasonable assistance with data-protection impact assessments under Article 35 GDPR and with prior consultations.
• Return or deletion. Delete or return Personal Data at the end of the relationship as described in Section 14.
• Demonstrating compliance. Make available the information necessary to demonstrate compliance with this DPA.
• Unlawful instructions. Inform the Controller if, in its opinion, an instruction infringes data-protection law.

8. Security Measures

8.1 Technical measures

• Encryption in transit: TLS for all data transmitted between browsers and our servers.
• Data minimisation by design: no visitor identifier, no cookie, no per-visitor record; usage is stored only as daily totals.
• Pseudonymisation: values derived from IP addresses for abuse control are hashed and held in memory only.
• Credentials: customer passwords are stored as salted bcrypt hashes; one-time codes as keyed hashes; session cookies are HttpOnly.
• Access control: role-based access with least privilege; each customer can reach only their own data; the database is not exposed to the public internet.
• Domain licensing: the widget is served and runs only for the domains the Controller has registered.
• Abuse protection: rate limiting on authentication, password reset and usage endpoints; protection against network attacks through our content-delivery provider.

8.2 Organisational measures

• Confidentiality obligations for personnel with access to Personal Data.
• Access to production systems limited to the people who need it.
• Incident-response procedures.
• Review of Sub-processors before engagement.

9. Sub-processors

9.1 Authorisation. The Controller grants SiteAccessible a general authorisation to engage Sub-processors, subject to this Section.

9.2 Current Sub-processors:

Our payment provider (Paddle.com Market Ltd) and email provider (Google Workspace) process the Controller's own account and billing data, for which SiteAccessible is controller; they do not process visitors' data. They are listed in the Privacy Policy.

9.3 New Sub-processors. SiteAccessible will give the Controller at least 30 days' notice before engaging a new Sub-processor, by email, in the panel or by updating this DPA.

9.4 Objection. The Controller may object on reasonable grounds within 30 days of the notice. If the objection cannot be resolved, the Controller may terminate the affected Service and receive a pro-rata refund of prepaid fees for the unused term.

9.5 Obligations. SiteAccessible shall ensure that each Sub-processor is bound by obligations no less protective than those in this DPA, and remains liable to the Controller for its Sub-processors' performance.

10. Data Subject Rights

10.1 Assistance. Taking into account the nature of the processing, SiteAccessible shall assist the Controller in responding to requests from Data Subjects exercising their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

10.2 Nature of the data. Because the Service keeps no record that identifies a visitor, SiteAccessible will in most cases be unable to locate data relating to a particular Data Subject, and will confirm this to the Controller. A visitor can erase the widget's locally stored settings themselves by using “Reset” in the widget or by clearing the website's data in their browser.

10.3 Direct requests. If a Data Subject contacts SiteAccessible directly, we will forward the request to the Controller where we can identify the Controller, and will not respond substantively without the Controller's instruction.

11. Data Breach Notification

11.1 SiteAccessible shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Data Breach affecting Personal Data processed on the Controller's behalf.

11.2 The notification shall include, to the extent available:

• the nature of the Data Breach;
• the categories and approximate number of Data Subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address it;
• a contact point for further information.

11.3 SiteAccessible shall cooperate with the Controller in investigating and mitigating the Data Breach and in notifying Supervisory Authorities and Data Subjects where required.

12. International Data Transfers

12.1 QROLLING LLC is based in Georgia. Personal Data is processed primarily in the European Union and, through the Sub-processors listed above, may be processed in other jurisdictions including the United States.

12.2 Where Personal Data is transferred to a country outside the European Economic Area that has not been recognised as providing an adequate level of protection, the transfer is subject to the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), which are incorporated into this DPA by reference — module two (controller to processor) between the Controller and the Processor, and module three (processor to processor) with Sub-processors — together with the UK International Data Transfer Addendum where the UK GDPR applies.

12.3 Georgia is an EU candidate country whose Law on Personal Data Protection is closely aligned with the GDPR; processing there is overseen by the Personal Data Protection Service of Georgia.

13. Audit Rights

13.1 On at least 30 days' prior written notice, and at most once per calendar year unless there are reasonable grounds to suspect a breach, the Controller may audit SiteAccessible's compliance with this DPA.

13.2 In place of an on-site audit, SiteAccessible may provide written responses and available documentation or third-party reports demonstrating compliance.

13.3 The Controller bears the cost of an audit unless it reveals a material breach of this DPA by the Processor.

14. Data Retention and Deletion

• During the Service. Usage totals are kept for as long as the website and the Controller's account exist; we do not delete them on our own. Values held in memory for abuse control expire within 24 hours.
• Deletion. When the Controller deletes a website, its usage totals and domain records go with it. When the Controller deletes its account in the panel, or asks SiteAccessible to, SiteAccessible deletes the usage totals and domain records of every website in it within 30 days, unless the law requires longer retention. Before deleting, the Controller can download its data from the panel.
• Logs and backups. Server and CDN logs are deleted on their normal rotation, which we aim to keep to 30 days. Any backup copies are deleted on the backup rotation schedule, which we aim to keep to 90 days.

15. Liability and Indemnification

15.1 Each party is liable for its own breaches of data-protection law and of this DPA.

15.2 The Controller shall indemnify and hold harmless SiteAccessible and QROLLING LLC from claims, fines or damages arising from:

• the Controller's failure to have a lawful basis or to give its visitors an adequate privacy notice;
• a prohibited use under Section 6;
• the Controller's use of the Service in breach of applicable law, or instructions that breach applicable law.

15.3 Limitation. The limitations and exclusions of liability in the Terms and Conditions apply to this DPA, except where liability cannot be limited under applicable law and without limiting any Data Subject's rights under the Standard Contractual Clauses.

16. Term and Termination

This DPA enters into force when the Controller accepts the Terms and Conditions, and remains in effect for as long as SiteAccessible processes Personal Data on the Controller's behalf. It ends automatically when the Controller's account is terminated; Section 14 survives termination.

17. Governing Law and Jurisdiction

This DPA is governed by the laws of Georgia, without regard to conflict-of-law principles, and disputes are resolved as provided in the Terms and Conditions — except that, where the Standard Contractual Clauses apply, their provisions on governing law and jurisdiction prevail. Nothing in this Section prevents a Data Subject from exercising their rights before the Supervisory Authority or courts of their habitual residence.

18. Amendments and Precedence

• Amendments. SiteAccessible may update this DPA to reflect changes in law, regulatory guidance or the Service. Material changes are notified at least 30 days in advance by email or in the panel.
• Precedence. If this DPA and the Terms and Conditions conflict on the processing of Personal Data, this DPA prevails. If this DPA and the Standard Contractual Clauses conflict, the Clauses prevail.
• Severability. If any provision is held invalid or unenforceable, the rest remain in full force.

19. Contact

• Data protection: [email protected]
• Processor: QROLLING LLC, operating SiteAccessible — 75A Erosi Manjgaladze Street, Tbilisi 0159, Georgia
• Company registration: B26345195 (National Agency of Public Registry, Georgia)
• Supervisory Authority: Personal Data Protection Service of Georgia

Acceptance. By registering for a SiteAccessible account and accepting the Terms and Conditions, you acknowledge that you have read, understood and agree to be bound by this DPA. Your electronic acceptance constitutes a legally binding signature under applicable electronic-signature laws. A countersigned copy is available on request at [email protected]. Website: siteaccessible.com.