DATA PROTECTION AGREEMENT
This English version is a courtesy translation provided for convenience only. Only the French version is legally binding; in the event of any discrepancy, the French version shall prevail.
Affilae has always been committed to protecting its clients’ data; our DPA (Data Protection Agreement) guarantees that we treat your collected data seriously and that we will continue to do so within the forthcoming European legal framework.
TABLE OF CONTENTS
DEFINITIONS
1. TERM
2. ROLE OF THE PARTIES
3. GENERAL OBLIGATIONS OF THE PARTIES
4. PERSONNEL OF THE PARTIES
5. USE OF SUB-PROCESSING
6. INFORMATION OF DATA SUBJECTS AND MANAGEMENT OF RIGHTS
7. COOPERATION ON COMPLIANCE 8. SECURITY MEASURES
9. PERSONAL DATA BREACH
10. KEEPING THE RECORD OF PROCESSING ACTIVITIES
11. TRANSFERS OF DATA OUTSIDE THE EUROPEAN UNION
12. OWNERSHIP OF DATA
13. GOVERNING LAW AND JURISDICTION
APPENDIX 1: DESCRIPTION OF THE PROCESSING
APPENDIX 2: RECIPIENTS AND SUB-PROCESSORS OF THE DATA
IT BEING RECALLED BEFOREHAND THAT
AFFILAE enables the Advertiser to benefit from a tool for managing its affiliate campaigns and the commissions paid to its Affiliates. In order to use the Services, the Advertiser has accepted AFFILAE’s general terms and conditions of sale and use (hereinafter the “Contract”). The Parties have decided to come together to jointly define the purposes and means of the processing of personal data detailed in Appendix 1. This Agreement, established pursuant to Article 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, is intended to define jointly the conditions under which the Parties undertake to carry out the personal data processing operations defined in Appendix 1 in accordance with the terms set out below. Within the framework of their contractual relations, the Parties undertake to comply with the regulations in force applicable to the processing of personal data and, in particular, the aforementioned Regulation (EU) 2016/679 (hereinafter, “the European Data Protection Regulation“), the French Data Protection Act (“Informatique et libertés“) No. 78-17 of 6 January 1978 as amended, and the regulations relating to industrial and intellectual property. It is expressly understood that this Agreement has been negotiated between the Parties.
THE PARTIES HAVE AGREED AS FOLLOWS
DEFINITIONS
For the purposes hereof, the following terms shall have the meaning given below:
“Advertiser“: means any natural or legal person having accepted AFFILAE’s general terms and conditions of sale and use and using its Services to manage its affiliate programmes.
“Affiliates“: means any natural or legal person joining the affiliate programme offered by the Advertiser.
“Public Authority“: means any legal person governed by public law or by private law acting under a delegation of public service and requiring access of any kind whatsoever to the Data.
“Cookies” or “Trackers“: means any file, pixel or script used by AFFILAE and implemented on the Website in order to collect the information necessary for the provision of the Services.
“Data“: means all types of information and/or data to which the Parties have access in the course of their contractual relations, whatever the format or medium, whether Personal Data (defined below) or not (e.g. financial data, operators, users, partners, strategic, technical, professional, administrative, commercial, legal, accounting data, etc.)
“Personal Data“: means any information relating to a natural person who is identified or who can be identified as such, either directly or indirectly by combining information, by reference to an identification number or to elements specific to that person: name, address, telephone number, IP address, email address, vehicle registration number, employee number, identifier/login, password, connection data, etc.
“Sensitive Data“: means the special categories of data whose processing is prohibited as a matter of principle. These are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
“Internet Users“: means all persons browsing the Advertiser’s Website.
“Data Subject“: means all persons whose personal data are subject to data processing.
“Controller“: means the persons who jointly determine the purposes and means of the processing.
“Services“: means the services provided by AFFILAE to the Advertiser under the Contract.
“Website“: means the Advertiser’s website.
“Processor“: means the person processing personal data on behalf of the controller; it acts under the authority of the controller and on the controller’s instructions.
“Terminal“: means the device used by the Internet User to browse the Advertisers’ Website and on which Cookies may be placed.
“Processing“: means any operation performed on information, whatever the process used (automated or not). This therefore covers all forms of processing of Data, whether on computer media or otherwise (paper, video recording, audio, etc.). With regard in particular to Personal Data, this may include operations of collection, recording, organisation, storage, adaptation, alteration, retrieval, consultation/viewing, dissemination or making available.
“Personal data breach“: means a breach of security leading accidentally or unlawfully to the access to or the destruction, loss, alteration or unauthorised disclosure of Personal Information transmitted, stored or processed.
1. TERM
This Agreement enters into force upon its signature and is concluded for the entire term of the Contract.
2. ROLE OF THE PARTIES
Under this Agreement, the Parties are required to act as joint controllers depending on the processing operations carried out and detailed in Appendix 1. It is specified that the obligations provided for in this Agreement apply only to the processing operations carried out by the Parties in their capacity as joint controllers.
3. GENERAL OBLIGATIONS OF THE PARTIES
3.1 Obligations of the Advertiser
The Advertiser undertakes to:
comply with the principle of lawfulness of processing provided for in Article 6 of the GDPR (Regulation (EU) 2016/679). In particular, the Advertiser undertakes to collect consent under the conditions specified below (Cookie Banner);
process the data solely for the purpose(s) of the processing set out in Appendix 1;
guarantee the confidentiality of the personal data processed under this Agreement;
take into account, with regard to its tools, products, applications or services, the principles of data protection by design and data protection by default;
supervise the processing, including carrying out audits and inspections of the other Party;
ensure, beforehand and throughout the duration of the processing, that the other Party complies with the obligations provided for by the European Data Protection Regulation;
designate a dedicated point of contact. This dedicated point of contact must have the experience, competence, authority and means necessary to carry out his or her duties;
inform data subjects in accordance with Articles 13 and 14 of the European Data Protection Regulation and with CNIL recommendation No. 2020-092 of 17 September 2020;
make the main terms of this Agreement available to Data Subjects upon first request, in addition to the information notices detailed in Article 6.1, by adapting the following template:
The present processing of your data is the subject of a contract between AFFILAE and [__the Advertiser__], each a joint controller within the meaning of Article 26 of the European General Data Protection Regulation of 27 April 2016, which entered into force on 25 May 2018. AFFILAE and [______the Advertiser________] have thus jointly undertaken to inform you of the nature of this processing and of the rights you have, and to implement the appropriate organisational and technical measures to ensure the security and confidentiality of your data.
collaborate in good faith, in particular by providing any Party with all documents, details and information necessary or requested to ensure the compliance of the jointly processed operations detailed in Appendix 1.
The Advertiser undertakes to collect free, informed, specific and unambiguous consent via a “cookie banner” in accordance with Article 4 of the GDPR and with CNIL recommendation No. 2020-092 of 17 September 2020 (hereinafter the “Cookie Banner”). To this end, the Advertiser warrants to AFFILAE that:
The Cookie Banner does not disappear until the Internet User has expressly accepted or refused the placing of Cookies on his or her terminal;
No Cookie or Tracker is placed on the Internet User’s Terminal without his or her express and prior consent. In particular, the Advertiser acknowledges that continued browsing does not under any circumstances constitute valid consent and refrains from any collection of Cookies based on such grounds;
The period of validity of consent to the placing of Cookies is set at a maximum of six (6) months. Upon expiry of this period, the Advertiser undertakes to obtain the Internet User’s consent again in order to place Cookies on his or her Terminal;
It has put in place, on its Website, a quick and easily accessible mechanism enabling Internet Users to withdraw their consent to the placing of Cookies at any time;
The Cookie Banner contains the information listed in Article 7 of this Agreement as well as a link to a privacy policy or a specific information notice and
3.2 Obligations of AFFILAE
AFFILAE undertakes to:
guarantee the confidentiality of the personal data processed under this Agreement;
take into account, with regard to its tools, products, applications or services, the principles of data protection by design and data protection by default;
collaborate in good faith, in particular by providing all documents, details and information necessary or requested to ensure the compliance of the jointly processed operations detailed in Appendix 1.
4. PERSONNEL OF THE PARTIES
Qualification of personnel
The Parties shall assign sufficient and qualified teams to the performance of the Assignments. These teams must be trained in the regulations on the protection of personal data.
Non-subordination of personnel
In the context of the Assignments and the related Processing as detailed in Appendix 1, it is hereby specified that the personnel of one Party shall in no way be bound to the other Party by any relationship of subordination. The only person entitled to take disciplinary measures, to organise work and, generally speaking, to settle all matters relating to personnel management, is the Party for whose benefit the employment contracts have been concluded. Accordingly, the personnel of each Party remain placed under that Party’s sole authority, direction and supervision.
5. USE OF SUB-PROCESSING
The Parties may engage one or more sub-processors to carry out specific processing activities in compliance with the purposes defined for the Processing set out in Appendix 1. In such case, the Parties undertake and ensure that the selected sub-processors provide sufficient levels of guarantee to strictly comply with the applicable data protection law. If the selected sub-processor(s) fail to fulfil their data protection obligations, the Party having selected that sub-processor shall alone remain fully liable for such breaches. In the event that the sub-processor is selected jointly by the Parties, liability in the event of a breach by that sub-processor of its data protection obligations shall be shared.
6. INFORMATION OF DATA SUBJECTS AND MANAGEMENT OF RIGHTS
6.1. Information of individuals
It is the Advertiser’s responsibility to provide Data Subjects with the information relating to the processing operations detailed in Appendix 1, as well as the main terms of this agreement, in accordance with the provisions of Articles 13 and 26 of the GDPR. In particular, the Advertiser undertakes to put in place a “cookie banner” compliant with CNIL recommendation No. 2020-092 of 17 September 2020, mentioning in particular:
The precise purposes of AFFILAE’s Trackers used on the Website;
AFFILAE’s capacity as a Cookie publisher, which must appear in its “cookie banner”;
The Internet user’s right and ability to object, at any time, to the placing of these Cookies on his or her terminal, by means of a dedicated button;
The possibility of accepting or refusing the placing of Cookies on his or her terminal.
The Advertiser undertakes to provide, in addition to the information mentioned on the “cookie banner”, the following information and to adapt for this purpose the template available below: “The personal information collected by AFFILAE on its own behalf and on behalf of [Advertiser], in their capacity as joint controllers of the processing, is intended to measure the performance of its advertising campaigns and to calculate the amount of the commission of its affiliate partners. This information is kept for a period of 25 months from its collection, after which it is anonymized. The information recorded may only be communicated to AFFILAE’s sub-processors and to our affiliate partners in order to calculate the amount of their commission. You have a right of access, rectification, portability and erasure of your personal data, a right to set directives regarding the fate of your data after death, and a right to restriction of the processing concerning you. You may exercise these rights by writing to our Data Protection Officer by email at [insert the email address of the Advertiser’s DPO] or by post at [insert the postal address of the Advertiser’s DPO]. You may also object to the processing of data concerning you and have the right to withdraw your consent at any time. You also have the option of lodging a complaint with a supervisory authority.“. In the event that a transfer of data outside the EU takes place during the processing, the following wording shall be added: “Some of these recipients may be located outside the European Union. In this case, we have ensured that:
The country concerned has been the subject of an adequacy decision by the European Commission;
Otherwise, the recipient has signed standard contractual clauses and we will be alerted to any request for access to your data from a public authority. “.
The costs relating to the provision of information to individuals shall be shared by the Parties
6.2. Management of rights
The Parties shall assist each other in responding to requests to exercise the rights of data subjects: right of access, rectification, erasure and objection, right to restriction of processing, right to data portability, right not to be subject to an automated individual decision (including profiling), and right to organise the fate of one’s personal data after death, in particular. The Advertiser shall primarily handle contact with the data subject so that he or she may exercise his or her rights, in particular by making a contact procedure available on its website. However, since the data subject may exercise his or her rights over his or her Personal Data with respect to and against each of the Controllers, the Parties shall communicate to each other any request by a data subject to exercise his or her rights, as soon as possible and at the latest within two (2) days of receipt. AFFILAE shall also ensure that the exercise of individuals’ rights is communicated to its partners, recipients of the Personal Data. In the event of a request to exercise rights concerning both Parties, the Parties shall agree within a maximum of twenty (20) days from receipt of the request on how to respond to the request. The Party which alone refuses to give effect to the data subject’s rights shall justify this refusal to the other Party and to the data subject, shall alone bear the costs incurred and shall alone assume any penalties resulting from the failure to give effect to the data subject’s rights.
7. COOPERATION ON COMPLIANCE
The Parties shall use all necessary means to assist each other in achieving compliance with data protection regulations. Where the carrying out of a data protection impact assessment or prior consultation of the supervisory authority is necessary for the processing operations carried out jointly, the Parties shall work together to carry out such impact assessments. The costs incurred may be shared between the Parties. The Parties shall communicate the name and contact details of the data protection officers designated by them or, failing that, of their representative. These contact details are set out in Appendix 1 and must be brought to the attention of data subjects in the same way as the various information notices provided for in Articles 13 and 14 of the GDPR.
8. SECURITY MEASURES
The Parties undertake to implement the technical and organisational security measures detailed in Appendix 1 to ensure the security and confidentiality of the Data.
9. PERSONAL DATA BREACH
9.1 Notification to the CNIL
The Parties undertake to notify each other, as soon as possible, of any Personal data breach jeopardising or having consequences for the Personal Data collected, at the email address of their DPO as specified in Appendix 1. The Parties shall jointly notify any personal data breach to the CNIL no later than seventy-two (72) hours after becoming aware of it, unless the breach in question is unlikely to result in a risk to the rights and freedoms of data subjects. Where such notification cannot be made within the seventy-two (72) hour period, the Parties shall provide legitimate and valid reasons for the delay. The notification shall contain at least:
a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned by the breach and the categories and approximate number of personal data records concerned;
the name and contact details of the data protection officer or other contact point where more information can be obtained;
a description of the likely consequences of the personal data breach;
a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Where, and in so far as, it is not possible to provide all this information at the same time, the information may reasonably be provided in phases without undue delay. The notification shall be accompanied by any useful documentation to enable the breach to be assessed. Before it is sent, the notification made by one of the Parties shall be submitted to the other Party for validation.
9.2 Communication to data subjects
The Parties shall also communicate the personal data breach to the data subject as soon as possible, where such breach is likely to result in a high risk to the rights and freedoms of a natural person. The communication to the data subject shall describe, in clear and plain language, the nature of the personal data breach and shall contain at least:
a description of the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned by the breach and the categories and approximate number of personal data records concerned;
the name and contact details of the data protection officer or other contact point where more information can be obtained;
a description of the likely consequences of the personal data breach;
a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
The means and content of the communication shall be determined jointly by the Parties.
10. KEEPING THE RECORD OF PROCESSING ACTIVITIES
The Parties shall each be responsible for keeping the record of processing activities in their respective capacity as Controller.
11. TRANSFERS OF DATA OUTSIDE THE EUROPEAN UNION
In the context of the processing operations referred to in Appendix 1, the Advertiser accepts and acknowledges that the data may be transferred to Affiliates located outside the European Union. AFFILAE undertakes to:
Ensure that the third country in which the Affiliate is established is a country which, according to the European Commission, provides an adequate level of protection of Personal Data; or
Conclude with the Affiliate:The European Commission’s standard contractual clauses;
A Data Agreement providing that the Affiliate undertakes to:alert AFFILAE to any request for access to the Data by a Public Authority within forty-eight (48) hours of such request;
where the law so provides, bring any action available to challenge such access request before the competent courts before granting access to the data;
allow AFFILAE to suspend its access to the Services within forty-eight (48) hours of notification of the access request or discovery of the access request;
Ensure that transfers made with the Affiliate fall, where applicable, within the derogation regime referred to in Article 49 of the General Data Protection Regulation.
AFFILAE undertakes to notify the Advertiser, as soon as possible, of any access request from a Public Authority of which it has been alerted by an Affiliate or which it has discovered by its own means.
12. OWNERSHIP OF DATA
The Parties agree that they shall remain the owners of their respective databases.
13. GOVERNING LAW AND JURISDICTION
This Agreement shall be governed by and construed in accordance with French law, and any dispute arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the French courts, to which each of the parties irrevocably submits. Before any litigation, the parties shall seek, in good faith, to settle amicably their disputes relating to the validity, interpretation, performance or non-performance, interruption, termination or cancellation of this Agreement, as well as to the partial or total cessation of the commercial relations between the parties, for whatever causes and on whatever grounds. The parties shall meet in order to compare their points of view and make all useful observations to enable them to find a solution to the dispute between them. The Parties shall endeavour to reach an amicable agreement within 30 days from notification by one of them of the need for an amicable agreement, by registered letter with acknowledgment of receipt.
APPENDIX 1: DESCRIPTION OF THE JOINT PROCESSING
Contact details of Affilae’s DPO: dpo@affilae.com
Main purpose: Management of the affiliate campaign.
Sub-purposes: Management of tracking (impressions, clicks, conversions); management of Affiliates’ commissions; statistics.
Legal basis/bases: Consent of Internet Users.
Categories of data subjects: Internet Users; Affiliates.
Categories of data: Data relating to the Internet User (IP address, country, user agent, fingerprint); data relating to the Internet User’s browsing journey (landing page, referrer, ClicksID, date and time of clicks, impressions and conversions, publisher); data relating to the commission (program, orderID, amount, commission, per click).
Retention period: The data are kept for a period of 25 months from their collection, then anonymized.
Transfers outside the EU:The data may be transferred to Affiliates established in a country outside the European Union. In this case, Affilae ensures that the country benefits from an adequacy decision by the European Commission; otherwise, it concludes the European Commission’s standard contractual clauses and incorporates appropriate contractual measures into its DPA.
Information measures: The Internet User’s consent by means of a cookie banner and a specific information notice available on the Advertiser’s Website in accordance with Article 6 of this Agreement.
Method of collecting individuals’ consent:
The Internet User’s consent by means of one or more buttons located on a cookie banner. The period of validity of consent is set at six (6) months. The Internet User may withdraw his or her consent at any time by means of a specific button on the Website.
Security measures implemented by Affilae: Affilae implements technical and organisational measures appropriate to the risks to protect the Data against loss, unauthorised access, disclosure or alteration, including:
- Encryption: of communications (TLS) and of stored data;
- Access control: access to the Data restricted to authorised staff;
- Authentication: multi-factor authentication (MFA) available on the platform; passwords are never stored in plain text;
- Backups: regular automated backups;
- Monitoring: detection of errors and anomalies;
- Awareness: staff are made aware of their data protection obligations.
For security reasons, the details of these measures are not published.
APPENDIX 2: DATA RECIPIENTS AND SUB-PROCESSORS
List up to date as of October 5, 2026. It matches section 7 of Affilae’s privacy policy.
Sub-processors
Category: Hosting, computing, storage
Company name: Google Cloud Platform (Google)
Location: Belgium, France
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://policies.google.com/privacy
Category: File storage
Company name: Amazon Web Services (AWS S3)
Location: Ireland
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://aws.amazon.com/privacy/
Category: Hosted database and database management
Company name: MongoDB (Atlas, Cloud Manager)
Location: EU
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://www.mongodb.com/legal/privacy-policy
Category: DNS, hosting
Company name: OVH SAS (OVHcloud)
Location: France
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://www.ovhcloud.com/en/terms-and-conditions/privacy-policy/
Category: Transactional emails
Company name: Mailjet
Location: France
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://www.mailjet.com/legal/privacy-policy/
Category: VAT number validation
Company name: VATLayer (apilayer)
Location: EU
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://vatlayer.com/privacy
Category: SMS communications
Company name: Sinch AB
Location: Sweden
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://www.sinch.com/privacy-policy/
Category: Product usage measurement
Company name: PostHog (Cloud EU)
Location: Germany (Frankfurt)
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://posthog.com/privacy
Category: Accounting
Company name: Pennylane
Location: Ireland
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://www.pennylane.com/fr/legal/privacy
Category: Signup fraud prevention
Company name: Trustfull (Fido S.p.A.)
Location: EU
Transfer of data outside the EU: No transfer outside the EU
Privacy policy: https://trustfull.com/legal/privacy-policy
Category: Payment processing
Company name: Stripe
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://stripe.com/privacy
Category: Error monitoring
Company name: Sentry (Functional Software Inc.)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://sentry.io/privacy/
Category: IP geolocation
Company name: ipdata.co (Ip Data LLC)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://ipdata.co/privacy-policy.html
Category: IBAN and VAT validation
Company name: Abstract API (Abstract Cloud Inc.)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://www.abstractapi.com/legal/legal
Category: Artificial intelligence processing
Company name: OpenAI
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://openai.com/policies/privacy-policy/
Category: Artificial intelligence processing
Company name: Anthropic PBC
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://www.anthropic.com/legal/privacy
Category: Artificial intelligence processing (profile and website analysis, Match explanations)
Company name: Cerebras Systems Inc.
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://www.cerebras.ai/privacy-policy
Category: Internal communications
Company name: Google Workspace (Google)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://policies.google.com/privacy
Category: Web analytics
Company name: Google Analytics 4 (Google)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://policies.google.com/privacy
Category: Project management
Company name: ClickUp (Mango Technologies, Inc.)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://clickup.com/privacy
Category: CRM and marketing
Company name: HubSpot Inc.
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://legal.hubspot.com/privacy-policy
Category: Collection of public social network data (Match)
Company name: ScrapeCreators (Web Scraping Guy LLC)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://scrapecreators.com/privacy
Category: Vector embeddings and ranking of recommendations (Match)
Company name: MongoDB, Inc. (Voyage AI)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://www.mongodb.com/legal/privacy-policy
Category: Customer support
Company name: Freshworks (Freshdesk)
Location: United States
Transfer of data outside the EU: EU-US Data Privacy Framework and SCCs
Privacy policy: https://www.freshworks.com/privacy/
Category: Mobile notifications
Company name: Expo (650 Industries, Inc.)
Location: United States
Transfer of data outside the EU: EU-US Data Privacy Framework and SCCs
Privacy policy: https://expo.dev/privacy
Category: Tax identification number verification
Company name: Tax ID Pro (Balancer Services LLC)
Location: United States
Transfer of data outside the EU: Standard Contractual Clauses (SCCs)
Privacy policy: https://taxid.pro/docs/privacy-policy
Category: Web traffic analysis
Company name: SimilarWeb Ltd.
Location: Israel
Transfer of data outside the EU: EU adequacy decision (Israel)
Privacy policy: https://www.similarweb.com/corp/legal/privacy-policy/
Category: Data services (collection of web pages and public social network data)
Company name: Bright Data Ltd.
Location: Israel
Transfer of data outside the EU: EU adequacy decision (Israel)
Privacy policy: https://brightdata.com/privacy
Recipients acting as controllers
These providers receive personal data for the purposes of the service but process it on their own behalf, as controllers (or joint controllers).
Category: Payment of commissions to affiliates
Company name: Wise Europe SA
Location: Belgium; processing outside the EU possible
Transfer of data outside the EU: EU adequacy decision, SCCs
Privacy policy: https://wise.com/legal/privacy-policy
Category: Electronic signature of contracts
Company name: Universign (Cryptolog International)
Location: EU
Transfer of data outside the EU: SCCs (verification codes sent by SMS)
Privacy policy: https://www.universign.com/en/privacy-policy/
Category: Postal address verification
Company name: Google Maps Platform (Google Ireland Limited)
Location: Ireland; processing in the United States possible
Transfer of data outside the EU: EU-US Data Privacy Framework and SCCs
Privacy policy: https://business.safety.google/controllerterms/