Data Processing Agreement

1. Scope and Parties

Customer: the person or organisation that registers a domain in Accesserty Console and installs Pulse on that website. The customer decides why Pulse is used on its website and is the controller of its visitors' personal data.

Accesserty: operated by Neil Lin as an individual based in Taiwan. For the processing in this DPA, Accesserty acts as the customer's processor.

This DPA covers personal data of the customer's website visitors that Pulse collects on the customer's behalf. It does not cover data that Accesserty handles as a controller, such as Console accounts, billing, Signal reports, or visitors to accesserty.com; the Privacy Policy describes that processing.

2. Processing Details

The subject matter, nature, purpose, duration, types of personal data, and categories of data subjects are described in Annex A.

3. Instructions and Accesserty's Own Use

Accesserty processes the personal data only on the customer's documented instructions. The Terms, this DPA, and the customer's settings in Console are those instructions. If Accesserty believes an instruction infringes data protection law, it will tell the customer.

Accesserty does not sell the personal data, use it for advertising, or combine it with data from other sources. It uses the data only to provide the service to the customer, to keep the service secure and prevent abuse, and to diagnose and fix faults in the service.

The customer is responsible for having a lawful basis for the processing, for obtaining any consent required for Pulse on its website, and for informing its visitors. Console explains how a consent tool can hold Pulse until visitors agree.

4. Confidentiality and Security

Only Neil Lin, as the operator of Accesserty, has administrative access to the personal data and is bound by confidentiality. Accesserty maintains the security measures in Annex B and may update them if the level of protection is not reduced.

5. Sub-processors

The customer gives general authorisation for the sub-processors in Annex C. Accesserty will announce any intended addition or replacement on this page at least 30 days before the change. The customer may object on reasonable data protection grounds; if the objection cannot be resolved, the customer may stop using Pulse and remove its domain.

Accesserty uses sub-processors under written terms that offer at least the protection required by this DPA and remains responsible to the customer for their performance.

6. Assistance and Breach Notification

Taking into account the nature of the processing, Accesserty will help the customer respond to requests from data subjects, and will provide information the customer reasonably needs for its security obligations, data protection impact assessments, and consultations with supervisory authorities.

Accesserty will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information then available, and will provide further information as it becomes known.

7. International Transfers

Accesserty is operated from Taiwan. Pulse data is stored in Tokyo, Japan, and the sub-processors in Annex C may process it elsewhere. The European Commission has not adopted an adequacy decision for Taiwan.

Where the processing involves a transfer of personal data from the European Economic Area to Accesserty, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA. The customer is the data exporter and Accesserty is the data importer. Clause 7 does not apply. Under Clause 9(a), Option 2 applies with the 30-day notice in section 5. The optional wording in Clause 11(a) does not apply. Under Clause 17, Option 2 applies, and under Clause 18(b) the courts of the EU Member State in which the data exporter is established have jurisdiction. Annexes A, B, and C of this DPA complete Annexes I, II, and III of those clauses.

Where the processing involves a restricted transfer from the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated as well, with the information in this DPA completing its tables. Accesserty's address for those tables is provided on request.

If those clauses conflict with this DPA, the clauses prevail.

8. Deletion at the End of the Service

Removing a domain in Console ends the customer's access to that domain's Pulse data. On the customer's written request after the service ends, Accesserty deletes the Pulse records associated with that customer's domain access within 30 days, unless law requires retention. Without a request, records are deleted under the retention rules in the Privacy Policy. The customer can export its data from Console before removing a domain.

9. Information and Audits

Accesserty will make available the information reasonably necessary to demonstrate compliance with this DPA, primarily by answering written questions. Any further audit is agreed in advance as to scope and timing, at the customer's cost, and must respect the confidentiality and security of other customers' data.

10. Liability and Order of Precedence

Liability under this DPA is subject to the limitations in the Terms, except where the law, including the clauses in section 7, does not allow liability to be limited. Nothing in this DPA limits the rights of data subjects.

For the processing of the customer's website visitors' data, this DPA prevails over the Terms if they conflict.

11. Contact

Neil Lin, operator of Accesserty, an individual based in Taiwan: [email protected]

Annex A: Description of Processing

• Data subjects: visitors to the customer's website on pages where Pulse runs.
• Types of personal data: page addresses without query strings, with segments that look like personal data or secrets replaced; event type; a CSS selector of the affected element, redacted the same way; a short event note; a random page-view ID that exists only in that page's memory; machine-scan summaries for the page. Requests to the service also carry IP addresses and other technical request data, which the infrastructure providers process. Pulse does not collect form contents, keystrokes, page text, or screenshots, and stores nothing on the visitor's device.
• Special categories of data: not intended. The customer should not instruct Accesserty to process them.
• Nature and purpose: detecting interaction events that may indicate usability or accessibility difficulty, running machine accessibility scans, and presenting the results to the customer in Console and weekly reports so the customer can decide which pages to review.
• Frequency: continuous while Pulse is installed and the domain access is active.
• Duration and retention: for as long as the customer uses Pulse, followed by deletion under section 8 and the retention rules in the Privacy Policy.

Annex B: Security Measures

• Collection limits: no cookies or browser storage on visitors' devices; no User-Agent; query strings removed; personal data patterns in page addresses and selectors replaced before sending and again before storage.
• Encryption: HTTPS for the Pulse script, data collection, and Console. Supabase states that it encrypts stored data with AES-256.
• Access control: customers see only data for domains they have verified and currently hold; a later claimant of a domain cannot see an earlier claimant's records. Access is enforced in the database. Administrative access is limited to the operator.
• Input and abuse controls: requests are accepted only from verified domains whose origin matches; request size, event rate, scan rate, and scan targets are limited.
• Retention: scheduled deletion under the retention rules in the Privacy Policy.
• Accounts: Console sign-in uses Google; Accesserty does not store passwords.

Annex C: Sub-processors

• Supabase, Inc. (United States): database and server functions. Pulse data is stored in Tokyo, Japan; server functions may run in regions near the request.
• Cloudflare, Inc. (United States): delivers the Pulse script and accesserty.com, and processes request data such as IP addresses when the script loads.
• Resend (United States): sends the optional weekly report email to the customer, which contains page addresses and selectors derived from Pulse data.