Data processing agreement

Effective 11 October 2026.

This Data Processing Agreement ("DPA") forms part of the Terms of service between the customer and Loopclub Ltd, at 4023 Kennett Pike #50389, Wilmington, DE 19807, USA ("Processor"). It applies to personal data processed on the customer's behalf through Double Agent ("Customer Personal Data"). It takes priority over conflicting service terms about that data. Mandatory transfer clauses take priority over both. Contact legal@doubleagent.so for a completed, countersigned copy.

1. Roles and definitions

"Data Protection Law" means applicable privacy and data-protection law, including the EU GDPR, UK GDPR and Data Protection Act 2018, Swiss FADP, and applicable US state privacy laws, including the CCPA as amended by the CPRA. Defined privacy terms have their meanings under those laws.

The customer acts as controller or, where authorised by its own controller, as processor appointing Loopclub Ltd as subprocessor. References to customer instructions include that authorised chain of instructions. Where applicable, Loopclub Ltd acts as a CCPA service provider or contractor for the specified business purposes below.

Account administration, our own website analytics and our independent processing of public directory sources are described in the privacy policy. This distinction does not permit us to reclassify private customer telemetry as our own data or evade this DPA.

2. Processing instructions and scope

Instructions consist of this DPA, the agreed service, lawful customer configuration and additional written instructions accepted by the parties. Loopclub Ltd will inform the customer immediately if it considers an instruction contrary to applicable data-protection law and may suspend the affected processing pending clarification. Legally compelled processing is notified in advance unless prohibited by law.

3. Security, confidentiality and assistance

Loopclub Ltd will restrict access to authorised persons bound by confidentiality and maintain measures appropriate to the risks, including Annex 2. It will assist the customer, taking account of the processing and information available, with rights requests, security obligations, impact assessments and required consultations with regulators.

Requests received directly concerning Customer Personal Data will be forwarded to the customer where identifiable. We will not disclose customer-controlled data to a requester without authority or a legal obligation. Lookup, available exports and site deletion can assist the response; contact privacy@doubleagent.so for requests requiring manual assistance. Clearing browser storage does not fulfil a server-side deletion request.

We will notify the customer of a personal data breach without undue delay and in any event within 48 hours after becoming aware of it. Available information will include the nature and likely consequences, affected data and subjects where known, mitigation and a contact point. Missing information may follow in phases without delaying the initial notice. We will cooperate with investigation and remediation. Notice is not an admission of liability.

4. Return, deletion and retention

At the customer's choice on termination, we will return Customer Personal Data in an available commonly used format or delete it, and delete remaining copies within 30 days unless law requires retention. Site deletion also triggers this 30-day obligation. It covers linked identifiers, raw records, customer-controlled identity evidence and feedback snapshots, not just ordinary session history. Customers should request return before the retention period expires.

Any legally retained data remains protected, limited to the legal purpose and deleted when that requirement ends. Backup copies must be isolated from ordinary processing and erased under a documented schedule supplied to the customer; if restored for recovery, applicable deletions must be reapplied. An unspecified or unbounded backup cycle is not a licence for indefinite retention. A different backup deadline requires a specific documented arrangement consistent with applicable law.

Independent public blockchains and third-party publications are not copies under our control. That limitation does not excuse deletion of our own customer-specific copies or our response to rights requests about our independent directory processing.

5. Subprocessors and other destinations

The customer generally authorises subprocessors on the subprocessors page for the purposes described there. We will notify affected customers by email and update that page at least 30 days before adding or replacing a subprocessor. Customers can object on reasonable data-protection grounds during that period. The parties will seek a reasonable resolution; if none is available, the customer may terminate the affected service before the new processing begins.

Each subprocessor must have written obligations providing the required level of protection, including appropriate security and transfer safeguards. Loopclub Ltd remains responsible for its subprocessors' performance under this DPA. An optional provider must not receive Customer Personal Data before the applicable authorisation and safeguards are in place.

Customer-selected analytics, advertising, commerce and webhook destinations are instructed by the customer and governed by its arrangements with those recipients. Public-source lookups may disclose the lookup identifier and our connection metadata to an RPC service, gateway or publisher. Calling a source public does not automatically exempt that disclosure from this DPA or transfer requirements; we must assess the recipient's role and use only necessary data.

6. Evaluation, improvement and public aggregates

We may process Customer Personal Data for service security, troubleshooting and detection evaluation only within documented instructions, the purposes in section 2 and applicable law. Session feedback does not confer unrestricted rights to train unrelated or general-purpose models. Cross-customer model improvement involving personal data requires a documented lawful basis and any additional agreement, notice or consent needed; it is not authorised merely by labelling data pseudonymous.

Properly de-identified statistics may be created and published only with safeguards against identification of a person or disclosure of an individual customer's activity. Published groups must contain at least ten distinct websites. The threshold alone does not establish de-identification. We will not attempt re-identification and will require equivalent restrictions where applicable. Customers may opt out at legal@doubleagent.so. Data that remains personal stays subject to this DPA, including its deletion obligations.

7. Customer obligations

The customer must have authority and a lawful basis for its instructions, provide required notices, obtain required consent and minimise submitted data. It is responsible for connected tools and decisions made from results. analytics and security are product modes, not legal determinations or automatic consent exemptions. The customer must validate its consent integration and restrict or delay collection where needed.

Identity evidence does not itself establish permission to act for an end user. Public directory discovery does not authorise collecting agent task content or publishing private session evidence. New categories or purposes require an appropriate updated agreement and notices before processing begins.

8. Audit and US state requirements

We will provide information reasonably needed to demonstrate compliance and permit audits by the customer or its independent auditor. Ordinarily audits require 30 days' notice, confidentiality, reasonable business hours and customer payment of its audit costs, at most annually. Those limits do not restrict regulator access or additional audits reasonably necessary following a breach or evidence of non-compliance, or mandatory legal rights. Audit arrangements must protect other customers' data.

Where the CCPA applies, we will not sell or share Customer Personal Data, retain or disclose it outside the direct business relationship or specified purposes, or combine it with other data except as permitted by law. We will provide the same level of privacy protection required by the CCPA and comply with applicable obligations. The customer may take reasonable steps to verify our processing, stop and remediate unauthorised use, and require assistance with consumer requests. We will notify it if we can no longer comply. Where certification is required, we certify that we understand and will comply with these restrictions. Subcontracted processing must meet applicable written-contract requirements. Equivalent mandatory controller/processor obligations apply under other applicable US state privacy laws.

9. International transfers

Elasticsearch is operated by Loopclub Ltd in Canada; other processing includes the United States and Cloudflare's global network. This is not a Canada-only residency commitment. The parties must assess each restricted transfer and onward transfer and apply an appropriate lawful mechanism.

Where applicable to a restricted transfer, the parties incorporate the EU Standard Contractual Clauses in Decision (EU) 2021/914: Module Two when the customer is a controller and Module Three when it is a processor. Clause 7 applies; Clause 9 uses option 2 with 30 days' notice; optional Clause 11 wording is excluded; Clauses 17 and 18 select Ireland. Annex 1 below supplies the transfer description and party information, Annex 2 supplies security measures, and section 5 governs subprocessor authorisation. Missing customer-specific details must be completed before reliance on the clauses.

For UK restricted transfers, the ICO International Data Transfer Addendum, version B1.0, including its mandatory clauses, applies. Table 1 uses Annex 1 parties and the DPA acceptance date; Table 2 uses the SCC modules/options above; Table 3 uses Annexes 1 and 2 and the subprocessor list; Table 4 selects neither party for the Section 19 option. Mandatory Addendum rights remain unaffected.

For Swiss restricted transfers, references are adapted as necessary to the Swiss FADP and the FDPIC is the competent authority insofar as Swiss law applies; rights to bring proceedings where Swiss law requires are preserved. The parties will document required transfer assessments and supplementary measures. A public statement about SCCs does not replace completion, binding acceptance or an assessment of the actual transfer.

10. Term and liability

This DPA lasts while Loopclub Ltd processes Customer Personal Data. Liability follows the service terms only to the extent permitted by law and applicable transfer clauses. It does not limit mandatory data-subject rights.

Annex 1. Parties and transfer details

• Exporter/customer: the contracting customer's legal name, address and privacy contact, recorded in the signed order or completed DPA. An account email alone does not supply missing legal-entity details. Role: controller or authorised processor, as applicable. Activities: operating the websites/services and instructing the processing in section 2.
• Importer: Loopclub Ltd, 4023 Kennett Pike #50389, Wilmington, DE 19807, USA. Contact: privacy@doubleagent.so. Role: processor or subprocessor. Activities: providing Double Agent as described in section 2.
• Acceptance: the parties' binding acceptance of the completed DPA records the signature and date for the incorporated transfer clauses. Additional customer details must be completed where absent from the contracting record.
• Transfer description: subjects, categories, purposes, nature, frequency, duration and retention are in section 2. Subprocessor purposes and locations are on the linked list. No sensitive-data transfer is intended; incidental sensitive information must be restricted and addressed with the customer.
• Competent EU authority: determined under SCC Clause 13 from the exporter's establishment, representative or affected data subjects, as applicable, and recorded in the completed DPA. It is not automatically Ireland because Irish law is selected for the clauses.

Annex 2. Technical and organisational measures

• Transport and credentials: TLS on service endpoints; hashed Double Agent secret API keys and authentication tokens; protected secrets for integrations that require recoverable credentials.
• Access separation: membership and site scoping for private customer records, role-based access, and separate storage permissions for ordinary reads, writes, maintenance and raw access. The public directory is a separate public surface.
• Raw access: raw connection/device records are separated from ordinary session views; customer access is limited to owner/admin roles and reads through that route are audited.
• Minimisation: selected request headers exclude Cookie and Authorization; the standard detection payload contains measurements rather than form values; payment detection reduces some collection. Existing integration cookies can be read where enabled. Enriched session coordinates are rounded; restricted raw provider metadata can be more detailed.
• Lifecycle: time-based retention policies and scheduled deletion for supported stores, with deletion instructions applying to every category, including feedback. Operational deletion completion must be verified; the existence of a job alone is not evidence of completion.
• Abuse controls: validation, rate limits on protected routes, adaptive proof-of-work and quarantine of low-trust submissions, according to the integration.
• Operations: access restricted to authorised personnel; incident investigation, monitoring and failed-write handling; recovery and deletion procedures consistent with sections 3 and 4. Detailed operational evidence and the applicable backup schedule are available for review through legal@doubleagent.so.