Data processing agreement
Last updated on 14 October 2026
This agreement covers the personal data that Cookiemark processes for you, as required by Article 28 of the General Data Protection Regulation (GDPR). It forms part of our terms of service and applies as soon as you use Cookiemark on a website. You do not have to sign it separately.
1. Parties and roles
You, the customer, are the controller. Brandforward, which runs Cookiemark, is the processor. This agreement applies to the personal data of the visitors to your websites that Cookiemark processes for you.
For the data of you and your team, such as your account and invoices, Brandforward is the controller itself. Our privacy policy covers that data, and this agreement does not.
2. What we process for you
| Purpose | Showing your cookie banner, storing your visitors' choices as proof of consent, and scanning your websites for cookies and trackers. |
|---|---|
| Data subjects | Visitors to the websites on which you use Cookiemark. |
| Personal data in the consent log | A random consent ID, the choice and the categories allowed, and the time. Also the page path, the language, the country, the browser's user agent and a shortened IP address. |
| Personal data in scans | Whatever your public pages show to a visitor who is not signed in, including in a screenshot of your start page. |
| Special categories | None. Cookiemark is not meant for special categories of personal data. |
| Duration | As long as you use Cookiemark, and after that until we have deleted the data as described in section 9. |
Cookiemark never stores a full IP address in the consent log. It removes the last part of each address before storing it.
3. Your instructions
We process the data only on your documented instructions. Your settings in the dashboard and your use of the service are those instructions. If we believe an instruction breaks the GDPR, we tell you. We only process the data otherwise when a law of the EU or the Netherlands requires it. In that case we tell you first, unless that law forbids it.
4. Confidentiality
Everyone at Brandforward who can access the data is bound to keep it confidential. Only the people who need access to run and support Cookiemark have it.
5. Security
We take appropriate technical and organisational measures to protect the data, as required by Article 32 of the GDPR. These include:
- storing the data in the EU, in a database hosted in Ireland;
- encrypting the connection between visitors' browsers, our servers and the database;
- row-level security in the database, so each customer can only read the data of their own organisation;
- accepting consent records only from the domains of the site they belong to;
- shortening IP addresses before they are stored;
- sign-in links that work once, and a second factor for our own admin area;
- keeping a record of the actions our staff take in the admin area.
6. Subprocessors
You give us general permission to use subprocessors. The list of subprocessors shows who they are, what they do and where. Before we add or replace a subprocessor that handles your visitors' data, we tell you at least 30 days in advance. You may object within that time. If we cannot meet your objection, you may end your plan before the change applies.
We bind each subprocessor to the same data protection obligations as this agreement. We remain responsible to you for their work.
7. Helping you
We help you answer requests from your visitors who exercise their rights. You can find all entries of one visitor by their consent ID, and export them. If a request reaches us directly, we pass it on to you without answering it ourselves.
We also help you with a data protection impact assessment that concerns Cookiemark, as far as can reasonably be expected. The same applies to a consultation with a supervisory authority.
8. Data breaches
If we discover a personal data breach that affects your data, we tell you without undue delay, and within 48 hours. We tell you what happened, which data it concerns, what the likely consequences are and what we are doing about it. We give you what you need to meet your own duty to report the breach.
9. Deletion at the end
You can export your consent log as a CSV file at any time. When you delete your organisation, or 30 days after your agreement ends, we delete the personal data we process for you. Copies in our backups disappear as the backups expire. We only keep data longer when a law requires it.
While you use Cookiemark, we delete consent log entries once they are older than the retention period of your plan.
10. Audits
We give you the information you need to show that we meet this agreement. If that is not enough, you may have an independent auditor check our compliance, once a year and with 30 days' notice. You bear the cost of an audit, unless it shows that we do not meet this agreement.
11. Transfers outside the EU
We store your visitors' data in the EU. Some subprocessors, or their parent companies, are based outside the EU. For those, we only allow a transfer with a safeguard the GDPR recognises, such as an adequacy decision or the EU standard contractual clauses.
12. Liability and law
The limits of liability in our terms of service apply to this agreement. Dutch law applies, and disputes go to the court named in the terms. If this agreement and the terms conflict on the processing of personal data, this agreement prevails.