LEGAL
legal@clevertrek.comBack to site →
Legal Hub/Data Processing Addendum

Data Processing Addendum (DPA)

Last updated: October 21, 2026DOCUMENT 08 OF 11

This Data Processing Addendum (the "DPA") forms part of the agreement between Clevertrek (the "Processor") and the Customer (the "Controller") for the Service, where the Service involves the processing of Personal Data on behalf of the Customer (typically when the Customer invites members to a Workspace or uses Surveys or CRM & Support, or under any plan where the Customer determines the purposes and means of processing of Personal Data of its own end users, employees, or contractors).

This DPA is incorporated by reference into the Terms of Service. In case of conflict between the Terms of Service and this DPA on a data-protection matter, this DPA prevails for that matter.

Clevertrek is operated by Fernando Beneitez Vela-Hidalgo (sole proprietor under Spanish law, NIF 75794423Q, Avenida del Hotel, 1, 15º, 08860 Castelldefels, Barcelona, Spain).

1. Definitions

In this DPA:

  • "Applicable Data Protection Law" means the GDPR (Regulation (EU) 2016/679), the Spanish LOPDGDD (Organic Law 3/2018), the ePrivacy Directive 2002/58/EC as transposed in Spain by Law 9/2014 (LGTel) and Law 34/2002 (LSSI-CE), and any other data-protection law applicable to the processing.

  • "GDPR" has the meaning given in Applicable Data Protection Law.

  • "Personal Data", "Processing", "Controller", "Processor", "Subprocessor", "Data Subject", "Personal Data Breach", and "Supervisory Authority" have the meanings given in the GDPR.

  • "Customer Personal Data" means Personal Data that is processed by Clevertrek on behalf of the Customer in connection with the Service.

  • "Subprocessor" means any third party engaged by Clevertrek to process Customer Personal Data on behalf of the Customer.

  • "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, or any successor instrument.

2. Subject Matter and Duration

2.1 The subject matter of the Processing is Clevertrek's provision of the Service to the Customer.

2.2 The duration of the Processing is the term of the Customer's subscription plus any post-termination period during which Clevertrek retains data in accordance with this DPA, the Terms of Service, or applicable law.

3. Nature and Purpose of Processing

3.1 Clevertrek will process Customer Personal Data only:

  • to provide the Service in accordance with the Customer's documented instructions;
  • to operate, secure, and maintain the Service;
  • to comply with applicable law.

3.2 The nature of Processing includes hosting, storage, structuring, retrieval, display, sharing among authorized users, transmission to third-party services chosen by the Customer (e.g., AI provider, MCP Connectors, Google APIs), backup, and deletion.

3.3 The purpose is to deliver the collaborative knowledge-management functionality described in the Terms of Service.

4. Categories of Data Subjects and Personal Data

Categories of Data Subjects (typical):

  • the Customer's employees, contractors, agents, and authorized users;
  • the Customer's clients, prospects, members, students, contacts, or other persons identified in the Customer's content.

Categories of Personal Data (typical):

  • identification data (name, username, email);
  • contact data;
  • professional data (role, organization);
  • content created by users (notes, links, comments);
  • usage data (logs, IP addresses);
  • where chosen by the Customer, AI Feature inputs and outputs.

The Customer is responsible for ensuring that the categories of Personal Data uploaded into the Service are appropriate for the Service and lawful under Applicable Data Protection Law. The Customer shall not upload special categories of Personal Data (Article 9 GDPR) unless strictly necessary and lawful, and shall inform Clevertrek when doing so.

5. Customer Instructions

5.1 The Customer hereby instructs Clevertrek to process Customer Personal Data:

  • as necessary to provide the Service in accordance with the Terms of Service;
  • as necessary to comply with applicable law;
  • as further documented in any agreed change order, configuration, or feature setting.

5.2 If Clevertrek considers that an instruction infringes Applicable Data Protection Law, it will inform the Customer without undue delay (Art. 28(3) last paragraph GDPR).

5.3 The Customer warrants that it has all necessary legal bases (consent, contract, legitimate interest, etc.) for the Processing of Customer Personal Data through the Service, including for transfers to third-party services chosen by the Customer.

6. Confidentiality of Personnel

6.1 Clevertrek will ensure that any persons authorized to process Customer Personal Data are bound by confidentiality (whether contractually or by statutory duty) and have received appropriate training on data protection and security.

7. Security Measures (Annex II)

7.1 Clevertrek implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account Article 32 GDPR.

7.2 Current measures include:

  • Encryption in transit using TLS for all communications between client and server;
  • Encryption at rest of sensitive secrets, including BYOK API keys (AES-256-CBC) and the OAuth tokens of Google integrations (XChaCha20-Poly1305, with the key kept outside the database);
  • Access controls: access to the production environment is limited to the operator named above; the hosting provider can access it only to provide its service;
  • Authentication using industry-standard hashing of passwords;
  • Network and infrastructure security at the hosting provider's level;
  • Backups: daily backups kept by the hosting provider for 30 days;
  • Monitoring of server and error logs for security events and abuse;
  • Software updates: regular updates of WordPress, its plugins and the server software;
  • Separation of customer data by Workspace and permission scope;
  • Incident response procedures for the detection, containment, eradication, and notification of security incidents;
  • Vendor management: subprocessors are selected and monitored under contractual data-protection commitments.

7.3 Clevertrek may update its security measures over time. Updates will not materially decrease the level of security.

8. Subprocessors (Annex III)

8.1 The Customer authorizes Clevertrek to engage Subprocessors to process Customer Personal Data, subject to this Section.

8.2 The current list of Subprocessors (Annex III), with the name, service, data received, location and transfer safeguard of each one, is published at /forms-privacy/#sub-processors. It currently includes providers for: hosting, database and cache; file and archive storage (files of generated reports are deleted after 30 days); report rendering; AI Features (where not in BYOK mode); connection to the advertising accounts that users connect; email delivery; payment processing; cookie consent on Clevertrek's website; and electronic signature, where available. The data sources that the Customer or its users connect (such as Google APIs) are not Subprocessors of Clevertrek.

8.3 Clevertrek imposes data-protection obligations on each Subprocessor that are no less protective than this DPA.

8.4 Clevertrek will provide the Customer with prior notice of the addition or replacement of Subprocessors. The Customer may object to a new Subprocessor on reasonable data-protection grounds within thirty (30) days of the notice. The current list of Subprocessors is published at /forms-privacy/#sub-processors. If the parties cannot resolve the objection, the Customer may terminate the affected portion of the Service for cause and obtain a pro-rata refund of prepaid fees for the unused term.

8.5 Clevertrek remains responsible to the Customer for the Processing carried out by its Subprocessors in accordance with Article 28(4) GDPR.

9. Data Subject Rights Assistance

9.1 Clevertrek will, taking into account the nature of the Processing, assist the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests for exercising Data Subjects' rights under Chapter III of the GDPR.

9.2 Where Clevertrek receives a Data Subject request directly relating to Customer Personal Data, Clevertrek will, where lawful, redirect the Data Subject to the Customer or notify the Customer.

10. Personal Data Breach Notification

10.1 Clevertrek will notify the Customer of a Personal Data Breach affecting Customer Personal Data without undue delay after becoming aware of it.

10.2 The notification will include, to the extent known at the time, the information set out in Article 33(3) GDPR, including the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed.

10.3 Clevertrek will provide reasonable assistance to the Customer in connection with the Customer's notification obligations to the Supervisory Authority and to Data Subjects under Articles 33 and 34 GDPR.

11. Data Protection Impact Assessments and Prior Consultation

11.1 Where required by Article 35 GDPR, Clevertrek will, taking into account the nature of the Processing and the information available to it, provide reasonable assistance to the Customer with data-protection impact assessments and prior consultations with Supervisory Authorities.

12. Audits and Inspections

12.1 Clevertrek will make available to the Customer, on reasonable request, the information necessary to demonstrate compliance with this DPA and Article 28 GDPR.

12.2 Where the Customer reasonably considers that the information so provided is insufficient, Clevertrek will allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, subject to the following:

  • audits are limited to once per twelve (12) months, except where required by a Supervisory Authority or following a Personal Data Breach;
  • audits are conducted during normal business hours, with at least thirty (30) days' prior notice, with appropriate confidentiality undertakings;
  • the auditor must not be a competitor of Clevertrek;
  • the Customer bears its own costs and the reasonable costs of Clevertrek for the audit, except where the audit reveals a material breach of this DPA, in which case the Customer's reasonable costs may be borne by Clevertrek.

13. International Data Transfers and Standard Contractual Clauses (Annex IV)

13.1 Clevertrek's servers are located in the United Kingdom, which benefits from an adequacy decision of the European Commission under Article 45 GDPR. Some Subprocessors process Customer Personal Data in the European Economic Area (EEA) and others outside it, including in the United States.

13.2 Where transfers occur to a country not benefiting from an adequacy decision under Article 45 GDPR, the parties rely on the Standard Contractual Clauses (Module 2: Controller to Processor, or Module 3: Processor to Subprocessor, as applicable), which are incorporated by reference into this DPA, supplemented as required by transfer impact assessments and additional safeguards.

13.3 For transfers to the United States, Clevertrek prefers Subprocessors certified under the EU–U.S. Data Privacy Framework (DPF), where available.

13.4 The parties will cooperate in good faith to maintain appropriate transfer safeguards.

14. Return and Deletion of Data

14.1 Upon termination of the Service, Clevertrek will, at the Customer's choice, return or delete Customer Personal Data, except where Union or Member State law requires retention.

14.2 The Customer can export its data before closing its account. After termination, Customer Personal Data is no longer processed and is kept until the Customer asks for it to be deleted or returned; Clevertrek then deletes it, or returns it, at the Customer's choice, except where Union or Member State law requires its storage.

14.3 Backup copies kept by the hosting provider are overwritten within thirty (30) days. The archive of project memory is kept encrypted in write-once storage, where archived files cannot be erased: content deleted from the Service is no longer accessible through it and its archived copies are no longer read, and when the memory of a whole Workspace is erased its encryption key is destroyed, so that the Service can no longer decrypt those copies. A recovery key is kept offline by the operator, only to restore the Service after a loss of its database and never to recover erased content; that recovery key can still open the archived copies of a Workspace whose memory was erased.

15. Liability

15.1 The liability of each party under this DPA is subject to the limitations of liability set out in the Terms of Service, except as required by Article 82 GDPR.

15.2 Each party remains liable for its own non-compliance with Applicable Data Protection Law.

16. Order of Precedence; Miscellaneous

16.1 In case of conflict between this DPA and the Terms of Service on data-protection matters, this DPA prevails.

16.2 In case of conflict between this DPA and the Standard Contractual Clauses on transfer matters, the Standard Contractual Clauses prevail.

16.3 This DPA is governed by Spanish law, and the courts of Barcelona, Spain, shall have exclusive jurisdiction in respect of disputes between the parties (without prejudice to the rights of Data Subjects under Applicable Data Protection Law).

17. Annexes

The following annexes are part of this DPA and updated by Clevertrek as needed:

  • Annex I — Description of Processing (categories of Data Subjects, categories of Personal Data, nature and purpose of Processing, duration);
  • Annex II — Technical and Organizational Measures (Section 7 above);
  • Annex III — List of Subprocessors (published at /forms-privacy/#sub-processors, see Section 8);
  • Annex IV — Standard Contractual Clauses for international transfers, where applicable;
  • Schedule F — Surveys and CRM & Support (below).

18. Contact

For DPA matters, contact:

Clevertrek (Fernando Beneitez Vela-Hidalgo, sole proprietor, NIF 75794423Q) Avenida del Hotel, 1, 15º 08860 Castelldefels, Barcelona, Spain Email: privacy@clevertrek.com / legal@clevertrek.com

Schedule F — Surveys and CRM & Support

Parties

  • Controller (the Customer): the business identified by the controller details it enters in the activation wizard (name, company, tax ID, address, contact email and, if any, Data Protection Officer).
  • Processor: Clevertrek, operated by Fernando Beneitez Vela-Hidalgo, sole proprietor under Spanish law, NIF 75794423Q, Avenida del Hotel, 1, 15º, 08860 Castelldefels, Barcelona, Spain · privacy@clevertrek.com.

This Schedule applies to the Customer's use of Surveys and CRM & Support (the "Collection Tools"), which let the Customer collect personal data from people outside Clevertrek ("End Users"). Where this Schedule and the DPA differ on the Collection Tools, this Schedule prevails.

F1. Description of the processing (complements Annex I)

Data subjectsPeople who fill in the Customer's forms; contacts and requesters managed in the CRM; people who receive emails about their submission
Personal dataName, email, phone, company and any other answer the Customer's form asks for; messages exchanged; submission data (date and time, page, campaign tags/UTM, salted one-way IP fingerprint); consent records (text versions accepted, date and time)
Forbidden dataSpecial categories (Art. 9 GDPR), criminal data (Art. 10), passwords, payment card data, bank account numbers (IBAN), identity document or social security numbers. Tax IDs for invoicing (VAT, NIF, CIF, Tax ID) are allowed
OperationsCollection through forms, storage, organisation in contacts/requests/funnels, consultation by the Customer's authorised team, confirmation and reply emails, analytics, export, archiving, permanent deletion; automated summaries only if the Customer enables AI features
RetentionDecided by the Customer, at most until the end of the Service plus the return period of DPA §14. Erasure requested by an End User: immediate and permanent

F2. Customer's additional obligations

The Customer:

  1. completes the Controller details in the wizard and keeps them up to date; they are published in the Customer's specific terms linked from each form, and the Customer is responsible for their accuracy and for any purpose it adds there;
  2. has a valid legal basis for each form and, for commercial communications, the consent required by Spanish Law 34/2002 (LSSI-CE) and equivalent laws;
  3. will not ask for forbidden data, and accepts that Clevertrek's automatic checks remove questions asking for it and return the form to Draft;
  4. will not import or upload lists of people who did not submit one of its forms, nor use the Collection Tools to send unsolicited messages;
  5. answers within the legal deadlines the rights requests that End Users address to it.

F3. End User erasure, unsubscribe and spam reports

The Customer instructs Clevertrek, and accepts, that:

  1. every email sent to an End User about a submission includes Unsubscribe, Delete my data and Mark as spam links, personal to that submission, signed and time-limited, plus the Customer's name and postal address (from its controller details) and a link to the Anti-spam policy; every form includes Report this form;
  2. Delete my data and Mark as spam permanently delete that End User's data from the Customer's Collection Tools (answers, contact record, requests and messages), without prior notice to the Customer and without possible recovery. This is an exception to the platform's general "archive, don't delete" rule, required by Article 17 GDPR;
  3. Clevertrek keeps only a minimal anonymous record of each request (date, type, the Customer's account and form, no End User data) as proof of compliance;
  4. Unsubscribe stops any further email from the Customer's workspace to that address through the Collection Tools; it is lifted only if that person submits one of the Customer's forms again and accepts its terms;
  5. the Customer is informed of the number of erasures, unsubscribes and reports, never of the identity of the End Users who made them;
  6. Clevertrek keeps a suppression list with a salted one-way fingerprint (hash) of the email of each End User who asked for erasure or reported spam, never the address itself, and rejects any later submission, import or email to that address in the Customer's Collection Tools.

F4. Anti-abuse measures (Clevertrek as independent controller)

For the security of the service and of End Users, Clevertrek acts as an independent controller (Art. 6(1)(f) GDPR) for: content checks of forms, rate limits, salted IP fingerprints, spam reports and the escalation below. Under the Anti-spam policy, when spam reports and unsubscribes against the Customer pass the thresholds published there:

  1. Warning: the Customer sees in Surveys and CRM: "Your account is being reported for spam abuse. It is possible that your account will be suspended. Contact support if you need something."
  2. Pause: Surveys and CRM are paused ("Your account has been reported as spam. It is being reviewed."). Forms stop accepting submissions and no emails are sent; the Customer can still log in and see its data, and nothing is deleted from its account. Only Clevertrek staff can lift the pause, after the review; it is never lifted automatically.
  3. Review: the Customer answers a questionnaire on the origin of its contacts and how they agreed to be contacted; Clevertrek decides within the period published in the Anti-spam policy.
  4. Closure: if it happens again within the published period, or the Customer does not answer the review, the Collection Tools are closed for that account.
  5. Appeal: the Customer can appeal in writing within the published period; Clevertrek answers within the published deadline.

Clevertrek may pause the Collection Tools immediately in case of phishing, fraud or risk to End Users' data.

F5. Sub-processors for the Collection Tools (complements Annex III)

In addition to the categories in DPA §8, the Collection Tools use: an email-delivery provider (confirmation and reply emails) and an electronic-signature provider (electronic signature of this document, where available). The list is public at /forms-privacy/#sub-processors with name, service, location and transfer safeguard. Clevertrek gives 30 days' notice of any change, and the Customer may object and terminate the Collection Tools without penalty.

F6. Security measures specific to the Collection Tools (complements Annex II)

  • Access to each workspace's forms and CRM data only for the people the workspace admin has added to the tool's Team; Clevertrek staff do not access it except for support or security.
  • IP addresses stored only as salted one-way fingerprints in submission records.
  • Email links signed, unique per submission, expiring, and unusable for another person's data.
  • Automatic detection and removal of questions asking for forbidden data; rate limits per IP and per workspace; forms marked "noindex".
  • No third-party tracking scripts loaded on Clevertrek pages; conversion events, if any, are passed to the Customer's own website.

F7. End of the Service

The Customer exports its data before closing its account or stopping the use of the Collection Tools. After that, the End Users' data is no longer processed and is kept until the Customer, or the End User for their own data, asks for its deletion; Clevertrek then permanently deletes it (backups are overwritten within 30 days).

F8. Acceptance and evidence

This Schedule and the DPA are accepted by the administrator of the Customer's workspace in the activation wizard (or signed electronically, where this option is available), and take effect only when the Customer clicks the confirmation link sent to the Customer's contact email (double opt-in). Until then the Customer cannot publish forms. Clevertrek keeps as evidence, without the possibility of deleting it from the interface: the versions signed (DPA and Schedule F), date and time of signature and of confirmation, IP address, the accepted or signed document and the confirmation click. A new version of these documents requires a new acceptance before publishing new forms.

← PREVIOUSSubscription, Billing & Refund TermsNEXT →Google API Services Disclosure