Data Processing Agreement

1. Roles

The Controller decides why and how personal data is processed. GoTouch processes it only on the Controller's documented instructions, which include the configuration choices made in the GoTouch dashboard and this agreement.

2. Subject matter and duration

GoTouch provides physical-to-digital engagement measurement using NFC and QR touchpoints. Processing continues for as long as the Controller holds an active GoTouch account, and for the deletion period described in section 7.

3. Categories of data subject

Visitors and customers of the Controller who interact with a GoTouch touchpoint, and staff of the Controller who hold dashboard accounts.

4. Categories of personal data

Collected on every interaction:

Timestamp, touchpoint identifier, interaction source (NFC or QR), coarse device category, browser family, operating system family, and a randomly generated session identifier stored in the visitor's browser.

Collected only when a visitor submits a form:

First name, optional last name, email address, optional phone number, consent timestamp, and the campaign the submission relates to.

Explicitly not collected:

IP addresses are not stored. Precise location is not collected. No special category data is collected. No cross-site tracking identifiers are used, and the session identifier cannot be used to recognize a visitor on any other service.

5. Security measures

Data is encrypted in transit using TLS and at rest by the hosting provider. Access between customer accounts is isolated at the database level using row-level security, so one Controller's records are not retrievable by another regardless of application behavior. Administrative access is limited to named GoTouch personnel and requires authentication. Rate limiting protects public forms, and automated traffic is filtered from interaction records.

6. Sub-processors

GoTouch uses the following sub-processors. The Controller consents to their use, and GoTouch will give notice before adding a new one, giving the Controller a reasonable opportunity to object.

• Vercel Inc. — application hosting and delivery
• Supabase Inc. — database, authentication, and storage
• Anthropic PBC — generation of written recommendations from aggregate statistics only, on plans where that feature is enabled
• Sentry (Functional Software, Inc.) — error monitoring, configured to exclude request bodies and cookies
• Any marketing platform the Controller connects themselves, such as a CRM receiving lead webhooks

Aggregate statistics sent for recommendation generation contain no names, email addresses, phone numbers, or session identifiers.

7. Retention and deletion

Interaction records are retained for the life of the account so that year-on-year comparison remains possible. Contact details are retained until the data subject unsubscribes or the Controller deletes them.

On termination, the Controller may export their full account from the dashboard. GoTouch will delete or return all personal data within 30 days of a written request, except where retention is required by law.

8. Assisting the Controller

GoTouch will assist the Controller in responding to requests from data subjects to access, correct, delete, or port their data. Self-service tools are provided for the common cases: one-click unsubscribe on every marketing message, lead deletion in the dashboard, and full account export.

9. Breach notification

GoTouch will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller's data, and will provide the information reasonably needed for the Controller to meet its own notification obligations.

10. Audit

GoTouch will make available the information necessary to demonstrate compliance with this agreement and will allow for audits by the Controller or a mandated auditor, on reasonable notice and no more than once per year unless required by a supervisory authority.

11. International transfers

Where personal data is transferred outside the jurisdiction in which it was collected, GoTouch will ensure an appropriate transfer mechanism is in place, such as the Standard Contractual Clauses.