Data Processing Agreement

This Data Processing Agreement ("DPA") is concluded between you (the "Customer") and GoCohort GmbH ("GoCohort", "we") and supplements the Terms of Service available at /terms.

It applies where GoCohort processes personal data on behalf of the Customer, in particular personal data of visitors and end users of the funnel pages the Customer creates, publishes and hosts through the platform.

The Customer is the controller within the meaning of Art. 4 No. 7 GDPR and determines the purposes and means of the processing. GoCohort is a processor within the meaning of Art. 4 No. 8 GDPR and processes such data exclusively on behalf of the Customer.

This DPA does not apply where GoCohort processes personal data of the Customer's own account users for its own purposes, such as account administration, billing and product analytics. For that processing GoCohort is itself the controller and its privacy notice applies.

The subject matter, nature, purpose and duration of the processing, the categories of personal data and the categories of data subjects are set out in Annex 1.

This DPA takes effect when the Customer first uses a feature that causes GoCohort to process personal data on the Customer's behalf, and remains in force for as long as the Terms of Service are in force or such processing continues.

Either party may terminate this DPA only together with the Terms of Service. Provisions that by their nature are intended to survive termination, in particular Sections 4, 9 and 12, remain in force.

GoCohort processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law to which GoCohort is subject. In that case GoCohort informs the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The Customer's configuration of the platform constitutes documented instructions. This includes in particular the fields collected by a funnel's lead form, the enabling of the AI chat assistant, the tracking and pixel integrations activated for a funnel page, the lead delivery destinations configured by the Customer, and the retention settings selected.

Additional or deviating instructions must be given in text form to hey@gocohort.com. GoCohort may charge for the implementation of instructions that go beyond the functionality of the platform.

GoCohort informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. GoCohort may suspend the execution of such an instruction until it is confirmed or amended by the Customer.

The Customer is responsible for the lawfulness of the processing, in particular for establishing a legal basis under Art. 6 GDPR, for obtaining and documenting any required consent from visitors of its funnel pages, and for meeting the information obligations under Art. 13 and 14 GDPR by providing its own imprint and privacy notice.

GoCohort ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

This obligation continues to apply after the termination of the respective employment or contractual relationship and after the end of this DPA.

Access to personal data processed on behalf of the Customer is limited to those personnel who require such access to provide, maintain or support the platform.

GoCohort implements appropriate technical and organisational measures pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk. The measures in force at the time of conclusion of this DPA are described in Annex 2.

GoCohort may adapt the measures over time, provided that the agreed level of protection is not reduced. Material changes are documented in Annex 2.

On request, GoCohort provides the Customer with more detailed information about the implemented measures, subject to appropriate confidentiality obligations.

The Customer has reviewed the measures described in Annex 2 and considers them appropriate for the personal data it entrusts to GoCohort. The Customer is responsible for assessing whether these measures are appropriate for any special categories of personal data pursuant to Art. 9 GDPR that the Customer chooses to collect through custom lead form fields or the chat assistant.

The Customer grants GoCohort general written authorisation within the meaning of Art. 28(2) GDPR to engage sub-processors. The sub-processors engaged at the time of conclusion of this DPA are listed in Annex 3.

GoCohort imposes on each sub-processor, by way of a contract, data protection obligations that are no less protective than those set out in this DPA, and remains fully liable to the Customer for the performance of the sub-processor's obligations.

GoCohort informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the address associated with the Customer's account or by an in-product notice.

The Customer may object to such a change on reasonable data protection grounds within 30 days of being informed. If the parties cannot reach an amicable solution, the Customer may terminate the affected services with effect from the date the change takes effect, without incurring an early termination fee for those services.

Providers that the Customer itself configures as a destination for its data, such as CRM systems, webhook endpoints and advertising pixels, are not sub-processors of GoCohort to the extent that GoCohort transmits personal data to them solely on the Customer's documented instruction and does not process the data for its own purposes. The Customer is responsible for its relationship with those providers, including any required processing agreement with them.

Taking into account the nature of the processing, GoCohort assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR.

The platform enables the Customer to view, export, correct and delete the leads and chat records associated with its funnel pages directly, which the Customer uses as the primary means of responding to such requests.

If a data subject contacts GoCohort directly regarding data processed on behalf of the Customer, GoCohort forwards that request to the Customer without undue delay and does not respond to it substantively itself.

GoCohort assists the Customer in ensuring compliance with the obligations pursuant to Art. 32 to 36 GDPR, taking into account the nature of the processing and the information available to GoCohort.

GoCohort notifies the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Customer. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed.

The notification pursuant to Art. 33(1) GDPR to the competent supervisory authority and, where required, the communication to data subjects pursuant to Art. 34 GDPR are the responsibility of the Customer as controller.

On request, GoCohort provides the Customer with the information reasonably required for a data protection impact assessment pursuant to Art. 35 GDPR and for prior consultation pursuant to Art. 36 GDPR.

On termination of the provision of services relating to processing, GoCohort deletes the personal data processed on behalf of the Customer without undue delay, unless Union or Member State law requires continued storage.

The Customer is able to export its leads and chat records through the platform at any time during the term and thereby effects the return of the data itself. The Customer must complete any export it requires before termination takes effect; after termination the data is no longer available.

Files uploaded by visitors during a chat session are deleted automatically after three weeks, independently of the term of this DPA.

Backups are retained for the duration of the applicable backup cycle and are deleted in accordance with that cycle. Until deletion, the data in backups remains subject to this DPA.

On request, GoCohort confirms the deletion in text form.

GoCohort makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

Audits are announced with reasonable notice of at least four weeks, take place during normal business hours, must not disproportionately disrupt operations, and are limited to one audit per calendar year. The notice period and the annual limit do not apply where there is an actual or reasonably suspected personal data breach affecting personal data processed on behalf of the Customer, a material compliance issue under this DPA, or where an audit is required by a competent supervisory authority.

The auditor must not be a competitor of GoCohort and must be bound to confidentiality. GoCohort may require the auditor to sign a confidentiality agreement before granting access.

GoCohort may satisfy the audit obligation by providing current certifications, audit reports or reports of independent third parties, insofar as these are suitable to demonstrate compliance.

Personal data processed on behalf of the Customer is processed within the European Union wherever the relevant service permits. Where a sub-processor listed in Annex 3 processes personal data outside the European Economic Area, the transfer takes place on the basis of an adequacy decision pursuant to Art. 45 GDPR or on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, supplemented where necessary by additional safeguards.

The legal basis relied on for each sub-processor established outside the European Economic Area is stated in Annex 3.

GoCohort does not transfer personal data processed on behalf of the Customer to a third country on its own initiative without a valid transfer mechanism.

The liability provisions of the Terms of Service apply to this DPA, without prejudice to Art. 82 GDPR.

Where the Terms of Service and this DPA conflict in respect of the processing of personal data on behalf of the Customer, this DPA prevails.

GoCohort may amend this DPA where necessary to reflect changes in the law, in the decisions of supervisory authorities or in the functionality of the platform. Material amendments are notified to the Customer at least 30 days before they take effect.

Should individual provisions of this DPA be or become invalid, the validity of the remaining provisions remains unaffected.

This DPA is governed by German law. The place of jurisdiction is Stuttgart, Germany, insofar as the Customer is a merchant, a legal person under public law or a special fund under public law.