EL Start free

Data processing agreement

Last updated: 9 November 2026

This data processing agreement ("DPA") is part of the terms of service between the customer who uses CookieDoo ("you", the controller) and 2ΠΙΞ Ο.Ε. (2pix General Partnership), Ekavis 6, 175 64 Palaio Faliro, Athens, Greece, VAT number EL801872902, General Commercial Registry (G.E.MI.) number 164948803000 ("we", the processor). It sets out the terms required by Article 28 of the General Data Protection Regulation (GDPR) for the personal data we process on your behalf. It applies automatically when you use the service; no signature is needed. If you need a signed copy for your records, write to [email protected].

1. Scope

This DPA covers the personal data of the visitors of your websites that we process when the CookieDoo banner runs on them (Annex 1). It does not cover the data of your account and team members, our billing or our own websites: for those we are the controller, as our privacy policy explains. If this DPA and the terms differ on data protection, this DPA prevails.

2. Your instructions

We process the data only on your documented instructions, which are these terms, this DPA and the settings you choose in the portal, and for no purpose of our own. If we believe an instruction breaks the law, we tell you. If the law of the EU or of a member state requires us to process data otherwise, we tell you first, unless that law forbids it.

You are responsible for the lawfulness of the processing you instruct, including the texts and settings of your banner and the information you give to your visitors.

3. Confidentiality

Only people who need access to run the service have it, and they are bound by confidentiality.

4. Security

We apply the technical and organisational measures of Annex 2 and keep them appropriate to the risk. We may improve them over time, but never lower the overall level of protection.

5. Sub-processors

You authorise us to use the sub-processors of Annex 3. We bind each of them by a written contract to data protection obligations no less protective than this DPA, and we remain responsible to you for them. We announce a new or replaced sub-processor at least 30 days in advance by e-mail to the account's Owners and on this page. If you object on reasonable data protection grounds, tell us within that time; if we cannot address the objection, you may close the affected account before the change, and fees already paid for the remaining period are refunded pro rata.

6. Transfers outside the EU

The service and its database are hosted in the European Union. Where a sub-processor may process data outside the European Economic Area, the transfer relies on an adequacy decision, such as the EU–US Data Privacy Framework, or on the European Commission's standard contractual clauses.

7. Helping you

8. Personal data breaches

If we become aware of a breach that affects data we process for you, we inform the account's Owners without undue delay and in any case within 48 hours, with what we know: what happened, which data and roughly how many visitors are affected, the likely consequences and what we have done and propose to do. We add information as we learn it, and we help you meet your own obligations to notify the authority and the visitors.

9. End of the processing

You can export your consent records as CSV at any time while the account is open. When the account's Owner closes the account, the processing stops: the banners stop at once, and the data is erased within 30 days, or sooner if you ask us. Encrypted backups are overwritten within a further 30 days. We do not keep copies unless the law requires it.

10. Information and audits

We give you, on request, the information needed to show that we meet this DPA, including this page and answers to reasonable security questionnaires. If that is not enough, you or an independent auditor bound by confidentiality may audit us, after at least 30 days' notice, during business hours, at most once a year (more often after a breach or when an authority requires it), and at your own cost.

11. Liability and duration

Liability under this DPA follows the terms of service, without prejudice to Article 82 GDPR. This DPA applies for as long as we process personal data on your behalf.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

Annex 3: Sub-processors