Data processing agreement

This Data Processing Agreement ("DPA") forms part of the Terms of use between Joined Up Intelligence Limited, trading as useMo ("we", "the Processor"), and the customer that has accepted those Terms ("you", "the Controller"). It applies whenever we process personal data on your behalf in providing the useMo behaviour analytics service ("the Service"), and takes effect when you accept the Terms. No signature is needed; if you would like a countersigned copy, email hello@usemo.app.

useMo is a trading name of Joined Up Intelligence Limited. Registered in England & Wales, company no. 13984081. Registered office: Bank House, Market Street, Whaley Bridge, High Peak, SK23 7AA. VAT no. GB432596974.

1. Definitions

"Personal data", "processing", "data subject", "controller", "processor", "personal data breach" and "supervisory authority" have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law"). "Tracking data" means the personal data described in Annex 1, collected by our script on your websites.

2. Roles

For tracking data you are the controller and we are your processor. You decide which websites the script runs on, which pages and fields it records (for example with mo-data-skip and mo-data-no-values), whether it waits for consent (mo-data-require-consent), and who on your team can see the results. That configuration, these Terms and this DPA are your documented instructions. We will tell you if we believe an instruction infringes Data Protection Law.

For your own account, billing and team details we are a controller, as described in our Privacy policy; this DPA does not apply to them.

3. Your responsibilities

• You have a lawful basis for the tracking data, and give your visitors the privacy and cookie information Data Protection Law and PECR require. The script stores data in the visitor's browser (Annex 1), which needs consent in the UK and EU unless an exemption applies.
• You do not deploy the Service on pages where element labels or chosen options would reveal special category data or data about children, unless you have switched recording off for those fields.
• You keep your allowed domains and team membership up to date.

4. Our obligations

We will:

1. process tracking data only on your documented instructions, including for transfers outside the UK, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it);
2. ensure everyone we authorise to process it is bound by confidentiality;
3. apply the technical and organisational measures in Annex 2;
4. engage sub-processors only as set out in clause 5;
5. help you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights;
6. help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us;
7. delete or return tracking data at the end of the Service, as set out in clause 8;
8. make available the information needed to show compliance with Article 28 UK GDPR and allow for audits as set out in clause 7.

5. Sub-processors

You give general authorisation for the sub-processors listed in Annex 3. We will tell you of any intended addition or replacement at least 30 days in advance, by email to the account owner and by updating this page, so that you can object on reasonable data protection grounds. If we cannot resolve an objection, you may end the affected Service without penalty and we will refund any fees you have paid in advance for the period after it ends.

We impose on each sub-processor data protection obligations no less protective than this DPA, and we remain liable to you for their performance.

6. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting tracking data. We will give you the information reasonably available to us, including the nature of the breach, the categories and approximate number of records concerned, its likely consequences and the measures taken or proposed, and will add to it as we learn more.

7. Information and audit

We will answer reasonable written questions about our processing. You may, on 30 days' notice and no more than once a year (unless a supervisory authority requires it or after a breach), audit our compliance at your cost, during business hours, without unreasonable disruption and subject to confidentiality. Where our answers or an independent report reasonably cover the point, we may provide those instead of an on-site audit.

8. Deletion and return

Tracking data is deleted automatically 365 days after it is collected (Annex 1). You can delete it sooner yourself: deleting a project removes its sessions, events and page structures straight away, and a project's Danger zone can clear its data.

When your account closes, we will delete the tracking data of the projects you own within 30 days, unless the law requires us to keep it. Before then, on request, we will give you a copy in a commonly used, machine-readable format. Deleted data leaves our database backups as they expire.

9. International transfers

Tracking data is stored in Ireland. Some of our sub-processors handle it in transit in other countries (Annex 3). We will not transfer it outside the UK without a transfer mechanism recognised by Data Protection Law, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

10. Liability and precedence

Liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on data protection, this DPA prevails. It is governed by the laws of England and Wales and lasts as long as we process tracking data for you.

Annex 1: details of processing

Personal data

Not collected

• Anything typed into a form field: text, email, password, textarea and similar.
• Full IP addresses, the full referring address or search terms, and ad click identifiers.
• Cookies. The script uses the browser's local and session storage instead, listed on our Cookie policy.
• Identifiers that follow a visitor between different customers' sites or devices.

Annex 2: technical and organisational measures

Data minimisation

• Form field values are never read, sent or stored.
• IP addresses are shortened on arrival, before anything is written: IPv4 loses its final octet, IPv6 keeps its first three groups.
• Element labels and chosen options are screened in the visitor's browser before they are sent: anything resembling an email address, telephone, card or account number, UK postcode or date is replaced with a placeholder such as [email]. Labels over 100 characters are dropped.
• Link addresses are kept without their query string or fragment.
• Automatic deletion after 365 days.

Access control

• Dashboard sign-in by one-time code sent to a confirmed email address.
• Row-level security in the database limits every query to the projects the signed-in person owns or has been invited to; this is enforced by the database and covered by automated tests.
• Tracking keys are stored only as hashes. Data is accepted only from the website addresses you have allowed for the project; a project with none accepts nothing.
• Staff access to production systems is limited to named personnel who need it to run and support the Service.

Transport, storage and operations

• HTTPS for all traffic, with HSTS on usemo.app; encryption at rest by our hosting provider.
• Requests are validated, size-limited and rate-limited.
• Daily database backups held by our database provider.
• An automated test suite covering data isolation, consent handling and the screening rules above.

Annex 3: sub-processors

Contact

Questions about this DPA: hello@usemo.app