Cookie settings

Here you decide which services we may use. You can change or withdraw your choice at any time.

Necessary

Always active

Required for the website to work: selected language, login, security and storing your cookie choice. These cookies cannot be switched off.

Helps us understand which pages are read and which steps lead to a download, beta request or purchase. Google receives pseudonymous usage data for this; Google Analytics 4 does not store IP addresses.

Show details
Provider
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Cookies
_ga and _ga_<ID>: distinguish visitors and sessions, stored for up to 2 years
Data transfer
Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework).

More in our privacy policy

Data Processing Addendum (DPA)

  • Version 1.3

for EZZE WCAG Pro Cloud Features

This Data Processing Addendum (“DPA“) forms part of the agreement between:

(1) the customer / controller, meaning the natural or legal person that accepts this DPA or on whose behalf the Services are used or enabled (“Customer” or “Controller“),

and

(2) Patrick Helms, Neue Heimat 20, 15848 Beeskow, Germany, support@ezze-wcag-pro.com, https://ezze-wcag-pro.com/support/ (“Provider” or “Processor“),

regarding the use of EZZE WCAG Pro and its optional cloud-based features (the “Services“).

Customer accepts this DPA by checking the applicable checkbox, by enabling a cloud feature covered by this DPA, or by otherwise using the Services. The person accepting this DPA represents and warrants that they are authorized to bind Customer to this DPA.

1. Scope and applicability

  1. This DPA applies only to the extent that Provider processes Personal Data on behalf of Customer as a Processor in connection with the optional cloud-based features of EZZE WCAG Pro.
  2. This DPA does not apply to:
    • functionality that operates solely locally on Customer systems without transmission to Provider or Provider subprocessors;
    • processing for which Provider, Freemius, payment providers, or other third parties act as independent Controllers;
    • purely private or household use outside the scope of Applicable Data Protection Law, where relevant.
  3. In case of conflict between this DPA and the main agreement, this DPA prevails with respect to the subject matter of Processing under this DPA.

2. Definitions

For the purposes of this DPA, the terms Personal Data, Controller, Processor, Data Subject, Processing, Personal Data Breach, Supervisory Authority, and Applicable Data Protection Law have the meanings given under the GDPR, UK GDPR, Swiss FADP, and other applicable privacy laws, as relevant.

3. Roles of the parties

  1. Customer acts as the Controller of Personal Data processed under this DPA.
  2. Provider acts as the Processor and processes Personal Data only on Customer’s documented instructions unless otherwise required by applicable law.
  3. The parties acknowledge that certain related services may be provided by third parties acting in their own capacity. Such processing is not governed by this DPA unless and to the extent the third party acts as a subprocessor of Provider.

4. Subject matter, nature, purpose, and duration

4.1 Subject matter

Provider provides optional cloud-based services within EZZE WCAG Pro, including, as configured or enabled by Customer:

  • cloud-based accessibility tests and reports;
  • AI-assisted generation of alternative text;
  • AI-assisted explanations, remediation guidance, or issue summaries;
  • AI-assisted insights, recommendations, or aggregated analysis;
  • support, diagnostics, abuse prevention, and service operations related to such features.

4.2 Nature of Processing

Processing may include collection, transmission, organization, storage, retrieval, analysis, generation of output text, restriction, deletion, and other operations required to provide the Services.

4.3 Purpose of Processing

The purpose of Processing is to provide, secure, maintain, support, and improve the optional cloud-based functionality of EZZE WCAG Pro requested or enabled by Customer.

4.4 Duration

Processing continues for the duration of the main agreement and any limited retention period reasonably required for deletion workflows, backup rotation, legal compliance, fraud prevention, security logging, dispute resolution, or establishment, exercise, or defense of legal claims.

5. Categories of Data Subjects

Depending on Customer’s implementation and use of the Services, Data Subjects may include:

  • website visitors;
  • Customer users, editors, administrators, and support contacts;
  • individuals whose Personal Data appears in website content, media, metadata, test results, screenshots, support tickets, or configuration submitted to the Services.

6. Categories of Personal Data

Depending on the enabled functionality, Personal Data may include:

  • page URLs and related request data;
  • image URLs, media identifiers, filenames, and metadata;
  • accessibility findings, issue descriptions, audit identifiers, DOM or HTML excerpts, CSS-related values, screenshots, and technical test results;
  • language, locale, feature configuration, plugin version, site identifiers, and installation metadata;
  • license, subscription, plan, and site reference identifiers where required for service enablement, abuse prevention, or support;
  • limited log, diagnostic, and security data, including IP address where necessary;
  • prompts, output text, alternative text, explanations, recommendations, and summaries generated through AI-assisted functionality;
  • support communications and related attachments submitted by Customer.

Customer instruction: Customer shall not submit special categories of Personal Data unless explicitly supported by the Service and covered by additional documented safeguards.

7. Customer instructions

  1. Provider shall process Personal Data only on documented instructions from Customer, including this DPA, the main agreement, Customer’s settings and use of the Services, and any additional written instructions accepted by Provider.
  2. Customer instructs Provider to process Personal Data as necessary to provide the specific cloud features selected, enabled, or used by Customer.
  3. If Provider considers that an instruction infringes Applicable Data Protection Law, Provider shall inform Customer without undue delay.

8. Confidentiality

Provider shall ensure that persons authorized to process Personal Data:

  • are bound by confidentiality obligations or are under an appropriate statutory duty of confidentiality;
  • receive appropriate privacy and security training;
  • access Personal Data only to the extent necessary for the performance of their duties.

9. Security measures

  1. Provider shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
  2. Such measures may include, as appropriate:
    • role-based access control and authentication;
    • least-privilege principles;
    • encryption in transit and, where appropriate, at rest;
    • environment separation and logical segregation;
    • logging and security monitoring;
    • vulnerability management and patching;
    • backup and restoration procedures;
    • incident response and business continuity procedures;
    • regular review and testing of security measures.
  3. Provider’s current technical and organizational measures are further described in Annex 2.

10. Assistance to Customer

Taking into account the nature of the Processing and the information available to Provider, Provider shall assist Customer, insofar as reasonably possible, with:

  • responding to Data Subject requests;
  • security of Processing obligations;
  • Personal Data Breach notifications and related documentation;
  • data protection impact assessments;
  • prior consultation with competent authorities where required.

11. Personal Data Breaches

  1. Provider shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.
  2. To the extent available, such notification shall include:
    • the nature of the breach;
    • categories of affected Data Subjects and Personal Data;
    • likely consequences;
    • measures taken or proposed;
    • contact details for follow-up.

12. Subprocessors

  1. Customer grants Provider general written authorization to engage subprocessors for the Processing of Personal Data under this DPA.
  2. Provider shall maintain a current list of subprocessors and make it available at: https://ezze-wcag-pro.com/subprocessors/.
  3. Provider shall notify Customer of material additions or replacements of subprocessors by updating the list and, where appropriate, by additional notice.
  4. Customer may object to a new subprocessor on reasonable data protection grounds within 30 days after notice.
  5. Provider shall impose on subprocessors data protection obligations no less protective than those set out in this DPA, to the extent applicable to the services performed.

12.1 Current list of subprocessors

IONOS Cloud GmbH

OpenAI Ireland Ltd.

  • Role: subprocessor
  • Purpose: AI alt text, AI explanations / solutions, AI Insights, AI Image Accessibility Review
  • Location: Ireland / further processing as governed by the OpenAI contractual framework, where applicable
  • Transfer basis: To the extent Personal Data is transferred outside the EEA, this takes place on the basis of the OpenAI Data Processing Addendum and the transfer mechanisms provided there, including Standard Contractual Clauses where required.
  • Reference: https://openai.com/policies/data-processing-addendum/

Note: The Google PageSpeed Insights API is not listed here as a classic primary subprocessor. It is instead disclosed separately as an external service used for accessibility testing. In particular, the URL submitted by Customer for testing is transmitted to the Google PageSpeed Insights API.

13. International data transfers

  1. Provider may transfer Personal Data outside Customer’s jurisdiction, including outside the EEA, UK, or Switzerland, or have such data processed there only where such transfer or processing is permitted under Applicable Data Protection Law.
  2. As of the current service setup, the following applies in particular to the main external services used:
    • IONOS Cloud GmbH (hosting / server location European Union): Under the current setup, the proxy/cloud infrastructure is hosted within the European Union; there is currently no third-country transfer via IONOS for this hosting.
    • OpenAI Ireland Ltd.: To the extent Personal Data is transferred outside the EEA, this takes place on the basis of the OpenAI Data Processing Addendum and the transfer mechanisms provided there, including Standard Contractual Clauses where required.
  3. Where an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism applies to a specific processing activity, the transfer shall take place on that basis.
  4. Information about applicable transfer mechanisms shall be provided on request, subject to confidentiality and security restrictions.

14. Deletion and return of data

  1. Upon termination or expiry of the Services, Provider shall, at Customer’s choice, delete or return Personal Data processed under this DPA unless retention is required by applicable law.
  2. Provider may retain Personal Data for a limited period where necessary for legal compliance, security logging, fraud prevention, backup rotation, or legal claims handling.
  3. Upon request, Provider shall confirm completion of deletion, unless prohibited by law or technically infeasible with respect to residual backup media, in which case Provider shall continue to protect the data and isolate it from further active Processing.

15. Audits and information rights

  1. Provider shall make available information reasonably necessary to demonstrate compliance with this DPA.
  2. Where reasonably required, Customer may conduct an audit itself or through an independent auditor bound by confidentiality obligations, provided that:
    • reasonable prior notice is given;
    • the audit is limited in scope to matters relevant to this DPA;
    • the audit does not unreasonably disrupt Provider’s operations;
    • Customer bears its own audit costs unless the audit reveals a material breach by Provider.
  3. Provider may satisfy audit obligations in part by providing current certifications, audit reports, penetration summaries, questionnaires, or security attestations, where appropriate.

16. Liability

  1. To the extent the parties have entered into a separate main agreement containing liability provisions, those provisions shall also apply to this DPA insofar as and for so long as such application is permitted under Applicable Data Protection Law.
  2. To the extent no separate main agreement with deviating liability provisions exists, the liability of the parties shall be governed by the applicable statutory provisions.

17. Governing law

This DPA shall be governed by the laws of the Federal Republic of Germany, excluding conflict-of-law rules, provided that mandatory data protection rules protecting Data Subjects remain unaffected.

Annex 1 – Description of Processing

Product: EZZE WCAG Pro
Services covered: cloud-based accessibility testing, AI-generated alt text, AI explanations and remediation guidance, AI insights, support-related processing, and related service operations.
Purpose: provision, maintenance, support, security, and abuse prevention of the requested Services.
Data Subjects: website visitors, Customer users and admins, support contacts, and persons whose data appears in Customer content submitted to the Services.
Categories of Personal Data: URLs, content fragments, image data or image URLs, diagnostics, site/license identifiers, configuration data, support content, AI input/output data, and usage, log, and security data (for example timestamps, event type, IP address, provider/model metadata, and token/cost estimates) to the extent processed in connection with the Services.
Additional processing notes: Usage and quota data may be logged server-side in connection with the Services. Based on the current technical setup, image files are not persistently stored on the proxy as a product feature. Extended debug/error logging is enabled only when needed, such as for troubleshooting or support. For accessibility testing, the Google PageSpeed Insights API may additionally be used as an external service to analyze the URL submitted by Customer.
Special categories: not intended unless explicitly supported and separately safeguarded.

Annex 2 – Technical and organizational measures (TOMs)

Based on the current implementation, Provider maintains the following measures in particular:

  • hosting of the proxy/cloud infrastructure with IONOS Cloud GmbH, with server location within the European Union;
  • encrypted transmission of all relevant proxy endpoints via HTTPS/TLS;
  • encryption at rest based on the current hosting setup;
  • protection of administrative access through multi-factor authentication;
  • restriction of administrative access to a single administrative account;
  • logging of usage, security, and error events; extended debug/error logging is enabled only when needed, such as for troubleshooting or support;
  • encrypted offsite backups of the proxy/cloud infrastructure with a backup provider operated in Germany;
  • change management and patching as needed;
  • incident handling and escalation through internal organizational procedures;
  • management and contractual onboarding of subprocessors.

Availability, recovery, and organizational security measures

Backups / recovery
Provider operates encrypted technical offsite backups of the proxy/cloud infrastructure. The backups are stored with a backup provider in Germany. Access is restricted to authorized administrative restoration, security, and emergency purposes and is protected by technical access controls. Backup retention is limited and rotating; older restore points are removed in accordance with the backup concept. Data contained in backups is not actively processed; after a restoration, the regular deletion and retention rules are applied again.

Restore tests
An initial restore test from the production offsite repository has been completed successfully. Restoration tests are intended to be repeated and documented at appropriate intervals.

Test and production environments
Provider does not currently operate a separate test environment. Changes to the proxy and service infrastructure are therefore made in a controlled manner and with particular caution in the production environment. A multi-level role model is not currently in place; access to administrative functions is restricted to a single administrative account protected by multi-factor authentication.

Incident response / security incidents
Provider does not currently maintain a formal written incident response plan. Security incidents, outages, and data protection-relevant events are nevertheless handled internally on a case-by-case basis, including detection, containment, remediation, root-cause analysis, and, where required, notification of affected customers. Further formal documentation of this process is planned.

Annex 3 – Subprocessor list reference

Current list available at: https://ezze-wcag-pro.com/subprocessors/

The list contains, where applicable:

  • subprocessor name;
  • service description;
  • location;
  • applicable international transfer mechanism;
  • relevant privacy/security reference URL.
Focused reading view

Reading mode