Data processing agreement
Last updated 29 October 2026
This agreement is part of the TidyCookies terms of service and applies automatically when you use TidyCookies. It sets out how F4 Labs AS (organisation number 936 714 315, Norway, "the processor", "we") processes personal data on behalf of the customer ("the controller", "you"), as required by Article 28 of the General Data Protection Regulation (GDPR), which applies in Norway through the Personal Data Act. If you need a signed copy, write to support@tidycookies.com.
1. What we process
| Subject matter and purpose | Showing your cookie consent banner, recording and storing proof of your visitors' consent choices, letting you look up and export them, and keeping your cookie list up to date. |
|---|---|
| Nature of processing | Collection, storage, retrieval, export and deletion. |
| Data subjects | Visitors of the websites where you install TidyCookies. |
| Personal data | Random consent ID, date and time, consent choices, banner version, page address, language, browser type (user agent), country, shortened IP address (last part removed), and the names of cookies present in the visitor's browser. |
| Special categories | None. You must not set up TidyCookies so that it receives special categories of personal data, for example in page addresses. |
| Duration | For as long as you use TidyCookies, until the data is deleted under section 9. Consent records are deleted automatically 5 years after they were created. |
2. Your instructions
We process the data only on your documented instructions. Your instructions are these terms, this agreement and the settings you choose in the dashboard. We will not use the data for our own purposes. If we are required by law to process it in another way, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.
You are responsible for having a legal basis for the processing, for informing your visitors and for the instructions you give.
3. Confidentiality
Only people at F4 Labs who need access to run or support the service can access the data, and they are bound by confidentiality.
4. Security
We take appropriate technical and organisational measures under GDPR Article 32, including:
- encryption in transit (HTTPS) for all traffic, and storage on Cloudflare infrastructure, which encrypts data at rest;
- shortening IP addresses before they are stored;
- passwordless login with single-use links that expire after 30 minutes and are stored only as hashes; session cookies marked HttpOnly, Secure and SameSite;
- each customer can only see their own websites' data;
- rate limiting and Cloudflare's protection against attacks;
- automatic deletion of consent records after 5 years and of expired login data;
- point-in-time database backups that expire after 30 days.
We may improve these measures over time, but will not lower the overall level of protection.
5. Subprocessors
You give us general permission to use subprocessors. We currently use:
| Subprocessor | Purpose | Location and transfer safeguard |
|---|---|---|
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Hosting, serving the banner, database and file storage | Global network. EU-US Data Privacy Framework, with EU Standard Contractual Clauses as fallback, under Cloudflare's data processing addendum |
Before we add or replace a subprocessor, we update this list and email you at least 30 days in advance. If you have a reasonable data protection objection, tell us within that time. If we cannot address it, you may end the agreement and we refund the unused part of what you paid. We impose the same data protection obligations on every subprocessor and remain responsible to you for their work.
6. Transfers outside the EU/EEA
Data may be processed outside the EU/EEA only with the subprocessors above and only with a valid transfer mechanism under GDPR Chapter V, such as an adequacy decision (including the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses.
7. Helping you
Taking into account the nature of the processing, we help you:
- answer requests from visitors who use their rights. You can look up a visitor's records by consent ID and export your log yourself in the dashboard. If a visitor contacts us directly, we pass the request on to you;
- with security, data protection impact assessments and prior consultation with authorities (GDPR Articles 32 to 36), by giving you the information we have.
Help beyond what the dashboard offers and what is reasonable for a service at this price may be charged at our usual rates, agreed with you in advance.
8. Personal data breaches
We notify you without undue delay, and aim to do so within 48 hours, after we become aware of a personal data breach affecting your data. We give you the information you need to assess it and notify the authorities and data subjects where required, and we take reasonable steps to limit the harm.
9. When the agreement ends
You can export your consent log at any time and for 30 days after the agreement ends. After that we delete the personal data we process for you, unless the law requires us to keep it. Deleting a website in the dashboard deletes its consent records straight away. Copies in backups expire within 30 days.
10. Audits
We make available the information you need to show that we meet Article 28, such as this agreement, our subprocessor list and written answers to reasonable questions. If that is not enough, or an authority requires it, you may audit us or have an independent auditor bound by confidentiality do so, with at least 30 days' notice, no more than once a year unless there has been a breach, and at your own cost. Audits of subprocessors are covered by their own audit reports and certifications.
11. Liability and order of precedence
Each party is liable for its own breaches of data protection law. Between us, the limitations of liability in the terms of service apply to this agreement, as far as the law allows. Nothing here limits the rights of data subjects under GDPR Article 82. If this agreement conflicts with the terms of service, this agreement wins for the processing of personal data. It is governed by the same law and venue as the terms.