Last updated: 2026-07-17 Version: 1 (draft)
This Data Processing Agreement ("DPA") forms part of the agreement between Filova Ltd, a company registered in England and Wales, company number 17263134, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, email privacy@filova.io, phone +44 20 3967 8386 ("Processor", "Filova", trading as "Consentio"), and the customer identified in the applicable order or account ("Controller"), governing the Processor's processing of personal data on the Controller's behalf in the course of providing the Consentio service.
Governing law: England and Wales.
"GDPR" means Regulation (EU) 2016/679 and, as applicable, the UK GDPR as defined in the Data Protection Act 2018. "Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Sub-processor" have the meanings given in the GDPR. "KVKK" means the Turkish Personal Data Protection Law No. 6698 and its implementing regulations, where applicable to the Controller's own data subjects. Where KVKK applies, the Controller is the "veri sorumlusu" (data controller) and the Processor is the "veri işleyen" (data processor) with respect to the same categories of Personal Data described in this DPA — the GDPR/KVKK terminology differs, but the controller/processor role split described throughout this DPA is the same under both regimes.
The Processor processes Personal Data on the Controller's behalf solely to provide the Consentio consent-management service: recording consent choices made by visitors to the Controller's website(s), and (where the Controller has enabled it) scanning the Controller's website(s) for cookies and scripts to help the Controller categorize them. This DPA continues for as long as the Processor processes Personal Data on the Controller's behalf under the parties' agreement.
anon_id); the consent choice and categories accepted/
rejected; timestamp; detected region/legal regime; a country code derived
from IP address (the raw IP address is not stored in Personal Data records
processed under this DPA — infrastructure providers listed in Annex 1 may
still transiently process IP addresses in their own server/request logs
under their own retention policies); a hash of the browser's user-agent
string; a Global Privacy Control signal if present. The Processor does
not process the data subject's name, email address, or other directly
identifying information as part of this service, nor any special
category / sensitive Personal Data.The Processor shall:
UPDATE, DELETE, and
TRUNCATE, independent of application-layer code) — restoring from a
backup cannot be used to introduce tampered or altered consent-record
content, since every backup only contains data that was itself written
under the same append-only enforcement (a point-in-time restore could
still omit genuine records written after that snapshot, which is a
distinct availability consideration, not a tampering risk); each consent
record carries an HMAC-SHA256 integrity signature (proof_hash, with a
small number of pre-migration records carrying an unsigned SHA-256 hash
instead, tracked via the proof_scheme column); rate limiting on the
public consent-ingest endpoint, keyed by both site and client IP;
SSRF-hardening on the cookie-scanning crawler (no following of redirects
into, or DNS resolution to, private/internal network ranges); and
encryption at rest and in transit via our infrastructure providers'
platform-level controls (Supabase, Vercel).consent_records), which are retained for as
long as reasonably necessary to demonstrate historical consent decisions
and to comply with applicable legal obligations, rather than being
deleted at the end of the parties' agreement or on any fixed schedule;
they are enforced append-only and immutable at the database level by
design (see item 3 above) due to the integrity requirements of consent
evidence. See privacy-policy.md §4 and kvkk-aydinlatma-metni.md §6 for
the same exception. Deletion or return requests for other Personal Data
are currently fulfilled manually within 30 days of the request (see
privacy-policy.md §4); automated self-service deletion tooling is a
planned future improvement, not yet built.The Controller warrants that it has a lawful basis under applicable law (GDPR, KVKK, CCPA, or other) for the collection and processing of Personal Data via the Consentio service, and that its instructions to the Processor comply with applicable law. In particular, the Controller is responsible for: providing lawful notice to its own website visitors (e.g. its own cookie/privacy notice); obtaining any consent required beyond what the Consentio banner itself records; correctly configuring the banner and cookie/script categorization for its own site; responding to data-subject access requests concerning its own visitors as the controller of that relationship (with the Processor's assistance per Section 4.5); and determining the appropriate retention period for its own account and configuration data, subject to Section 4.7.
See Annex 1. The Controller authorizes the engagement of the listed Sub-processors generally, subject to the notice-of-change right in Section 4.4.
Personal Data is transferred outside the UK/EEA in the course of providing the Service. Such transfers are protected by the following mechanisms, per Sub-processor:
eu-central-1): Supabase's own
disclosed Sub-processors (its cloud infrastructure and support providers)
are located in the United States and Singapore. Supabase's Data Processing
Agreement pre-attaches the EU Standard Contractual Clauses (Module Two,
controller-to-processor), the UK International Data Transfer Addendum, and
a Swiss Addendum; executing that agreement is deemed to constitute
signature of all three. Separately, remote access to Supabase's EU-hosted
data by the Processor's own UK-based personnel is itself treated as a
transfer under EDPB guidance (Recommendations 01/2020) and is covered by
the same mechanisms.legal/README.md for the operational status of this signature.Where the Controller's own data subjects are protected under KVKK, see the
separate kvkk-aydinlatma-metni.md for the KVKK-specific transfer basis
relied upon for these same Sub-processors. As transfer volumes grow beyond
our current pre-launch scale, we intend to conduct and document a formal
Transfer Impact Assessment (and, for UK transfers, a Transfer Risk
Assessment) consistent with post-Schrems II guidance — this is a planned
improvement, not yet completed as of this draft.
Each party's total liability arising out of or in connection with this DPA, whether in contract, tort (including negligence), or otherwise, shall not exceed the total fees paid by the Controller to the Processor under the parties' agreement in the 12 months preceding the event giving rise to the claim, except where such limitation is not permitted by applicable law (including for death, personal injury, fraud, or breaches of confidentiality or data protection obligations that cannot be limited by law).
This DPA and any dispute arising out of or in connection with it is governed by the laws of England and Wales, and the courts of England and Wales shall have exclusive jurisdiction, without prejudice to any mandatory local data protection law obligations the Controller may separately owe to its own data subjects (e.g. under KVKK, where the Controller is itself subject to Turkish law).
| Sub-processor | Purpose | Location | Status |
|---|---|---|---|
| Supabase | Database (Postgres) and authentication hosting | EU (eu-central-1); Supabase's own Sub-processors (infrastructure, support) in the United States and Singapore |
Live |
| Vercel | Application hosting | United States (default function region; an EU region is not currently configured) | Live |
| Railway | Background worker hosting | Region selectable at deployment (Railway offers an EU West / Amsterdam option), though Railway's own account/billing processing is US-based regardless of the selected workload region | Planned — not yet deployed |
| Payment processor (provider not yet finalized) | Payment processing for paid plans | Not yet integrated — under evaluation (candidates include traditional processors and Merchant-of-Record providers) | Planned — not yet integrated |
consent_records are enforced append-only and
immutable at the database level (triggers reject UPDATE, DELETE, and
TRUNCATE, independent of application code). Records written since our
HMAC-signing migration carry an HMAC-SHA256 integrity signature
(proof_hash) that lets tampering by a party without the signing key be
detected; a small number of earlier records predate that migration and
carry an unsigned SHA-256 hash instead (tracked via the proof_scheme
column) — see item 3 of Section 4 above.This list reflects our actual current implementation, not an aspirational
target — see supabase/migrations/006_consent_immutability.sql and
supabase/migrations/009_consent_proof_scheme.sql for the underlying
database enforcement. It does not yet include a formally documented
incident-response plan, backup/disaster-recovery policy, or vulnerability
management program beyond our infrastructure providers' own — these are
tracked as future improvements, not asserted as already in place.
Section 7 (International transfers) and Annex 1 (Sub-processors) were
prepared based on official regulatory sources (European Commission, EDPB,
UK ICO, KVKK Kurumu) and the relevant vendors' own published data processing
terms, current as of the "Last updated" date above. This is not a substitute
for legal advice — see legal/README.md for this document's overall review
status.
Signature blocks — [TBD, for final version]
For and on behalf of Filova Ltd: ___________________________ Date: _______
For and on behalf of the Controller: ___________________________ Date: _______