Legal
Data Processing Addendum
Last updated September 2026
A summary of the processing relationship, published so you can see the shape before asking for the document. This page is a summary, not the agreement — the signable DPA is in legal review and available on request.
Roles
For visitor consent evidence collected through your websites, you are the controller and DotCensus is the processor. For your own account data, DotCensus is the controller. The distinction matters for who answers a visitor's request, and it is you.
Subject matter and duration
Processing consists of collecting, storing and returning consent evidence and website scan data for as long as your subscription runs, plus the retention period you configure.
Categories of data
Pseudonymous consent records, website inventory and scan artifacts, and customer account data. DotCensus is not designed to receive special categories of personal data, and you should not send them to it.
Sub-processors
Hosting, storage, CDN and email delivery providers, listed on the subprocessors page with notice of changes. That list is maintained as a page rather than as an appendix nobody re-reads.
Security and assistance
Technical and organizational measures as described on the security page, assistance with visitor requests where the pseudonymous record permits identification, and incident notification without undue delay.
Status
The executable DPA is in legal review ahead of paid launch. If you need it for a procurement process now, ask and we will tell you exactly where it stands rather than sending a draft described as final.
This is placeholder legal copy for the marketing site. Replace it with your reviewed Terms & Privacy before launch.