Data Processing Agreement (DPA)

Last updated: 1 August 2026

This Data Processing Agreement specifies the data protection obligations of the parties pursuant to Art. 28 GDPR for the services provided under the main agreement (hosting and optimization services "Sophistication.io"). In the event of a conflict, the provisions of this DPA take precedence over the provisions of the main agreement in matters of data protection.

Parties

Processor:
Sophistication.io, Owner: Dominik Schimpf
c/o IP-Management #2918, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany
VAT ID: DE322867508 · Email: support@sophistication.io

Controller: the customer who concludes the main agreement with the Processor. In data protection terms, the Controller is the controller (Art. 4(7) GDPR) for the personal data processed via its website(s). The Processor processes this data exclusively on documented instructions and on behalf of the Controller.

1. Subject Matter and Duration

The subject matter is the provision and operation of the Controller's website(s) (creation and hosting of marketing pages and funnels on the platform, including managed hosting) and, the AI-assisted creation, editing and optimization of page content (editor), the collection of leads submitted by end visitors via forms on the Controller's pages, the measurement of page performance (views, clicks) and, where activated by the Controller by connecting its accounts, the attribution of orders and advertising spend to the operated pages. The DPA applies for the term of the main agreement and ends automatically upon its termination.

2. Type of Data and Categories of Data Subjects

Categories of data subjects: end visitors of the Controller's website(s), end customers of the Controller's shop (where a shop connection is activated), as well as contact persons and account users of the Controller.

Categories of personal data:

• End visitors: IP address (transient, for delivery and bot filtering), usage and interaction data (page views / impressions, clicks on calls to action), a pseudonymous visitor identifier, a signed click identifier in outbound links, browser and device information (user agent, for bot detection).
• Leads (only where the Controller's pages contain lead forms): the form fields submitted by the end visitor, typically name and email address, together with the submission time and the page of origin. The scope of the fields is determined by the Controller through the design of its pages.
• End customers of the shop (only where a shop connection is activated): order identifier, gross and net amount, currency, order date, as well as technical attribution attributes of the order (click identifier, entry page). Names, addresses, or contact details of end customers are not obtained and not stored.
• Advertising account data (only where an advertising account connection is activated): campaign identifiers and aggregated spend values. This data is generally not personal data.
• Account users: name, email address, authentication data, organization and role affiliation.

Special categories of personal data (Art. 9 GDPR) are not processed on a targeted basis. Which content or fields the Controller's website itself collects is determined solely by the Controller.

3. Obligations of the Processor

• Processing exclusively on documented instructions from the Controller and only for the agreed purposes (Art. 28(3)(a) GDPR).
• Obligation of persons authorized to process the data to maintain confidentiality (Art. 28(3)(b), Art. 29, Art. 32(4) GDPR).
• Implementation of the technical and organizational measures pursuant to Section 6 (Art. 32 GDPR).
• Support for the Controller with data subject requests and with the obligations under Art. 32-36 GDPR, insofar as possible for the Processor.
• Notification without undue delay of personal data breaches to the Controller (Art. 33 GDPR).
• Deletion or return of the data at the Controller's choice after the end of the service, insofar as no statutory retention obligation applies; unless otherwise agreed, without undue delay, at the latest within 30 days.
• Provision of the information necessary to demonstrate compliance and enabling of audits within the meaning of Art. 28(3)(h) GDPR.

4. Subprocessors

The Controller consents to the use of the following subprocessors (Art. 28(2) and (4) GDPR). The Processor informs about intended changes in advance; the Controller may object to a change for an important data protection reason.

• Cloudflare, Inc. – Hosting, CDN, edge workers, key and object storage, custom hostnames; delivery and measurement of the pages.
• Supabase, Inc. – Database (accounts, pages, versions, logs, analytics data); region EU (Frankfurt am Main).
• Clerk, Inc. – Authentication and identity management (portal login, organizations).
• Anthropic, PBC – AI-assisted editing of page content (editor, test suggestions). Content transmitted via the API is not used to train the models under Anthropic's terms of use.
• Stripe, Inc. / Stripe Payments Europe Ltd. – Payment processing of the subscriptions. For the payment data, Stripe regularly acts as an independent controller.

If the Controller connects its own accounts with third-party services (e.g., Shopify, Meta), these are not subprocessors of the Processor; the data is obtained at the instigation and on behalf of the Controller from its own contractual relationship with the third-party service.

5. Place of Processing and Transfer to a Third Country

Processing generally takes place within the EU or the EEA, insofar as the respective service supports this. Insofar as a subprocessor processes data in a third country, this takes place on the basis of appropriate safeguards under Chapter V GDPR, in particular the EU Standard Contractual Clauses and, where applicable, an adequacy decision.

6. Technical and Organizational Measures (Art. 32 GDPR)

• Encryption of transmission: TLS / HTTPS for all delivered pages and portal access; automatic certificate issuance and renewal.
• Access and admission control: authentication via a dedicated identity service; role- and organization-based access separation; database-side tenant separation (row-level security per organization).
• Authorization concept based on the principle of least privilege; write access restricted per tenant and plan; secrets are not stored in the source code; stored access keys of connected services cannot be read by portal users.
• Signed, tamper-protected attribution identifiers (HMAC) for order attribution; time-limited validity.
• Separation control: data separation per organization and project via unique keys; attribution of order and spend data exclusively within the Controller's organization.
• Logging: version and change log per page.
• Availability and resilience: delivery via globally distributed edge infrastructure; fault-tolerant delivery (fallback to the last known good state).
• Protection against automated abuse in measurement (bot detection, deduplication).

7. Data Subject Rights, Deletion, Liability

The Processor supports the Controller in fulfilling data subject rights (access, rectification, erasure, restriction, data portability, objection). After termination of the agreement, the data processed on behalf of the Controller is deleted or returned at the Controller's choice. Information on the deletion procedure: sophistication.io/data-deletion. Liability is governed by the provisions of the main agreement and by Art. 82 GDPR.

8. Final Provisions

Amendments and additions to this DPA require text form. German law applies. Should a provision be invalid, the validity of the remaining provisions remains unaffected.

Questions about data processing or about concluding a signed version: support@sophistication.io.