Last updated: 1 January 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between TrackBooth and the Customer and applies where TrackBooth processes personal data on the Customer's behalf in providing the platform. It is designed to support compliance with applicable data-protection law, including the GDPR where relevant. For a signed counterpart suited to your jurisdiction, contact us during onboarding.
For end-user personal data captured and processed through the platform, including click and session identifiers, device and IP-derived signals, and captured contact details, the Customer is the controller and TrackBooth is the processor. Each party complies with its respective obligations under applicable data-protection law.
The subject matter is the provision of affiliate tracking and network-management services. Processing covers the duration of the agreement. The nature and purpose of processing is to deliver tracking, attribution, reporting, forensics and partner-management functionality. Data subjects may include the Customer's end users and traffic; categories of data include online identifiers, technical and network data, and any contact data the Customer chooses to capture.
TrackBooth processes personal data only on the Customer's documented instructions, including those given through configuration of the platform, except where required by law. If TrackBooth believes an instruction infringes applicable law, it will inform the Customer.
TrackBooth ensures that personnel authorized to process personal data are bound by appropriate confidentiality obligations and access data only as necessary to provide the service.
TrackBooth maintains technical and organizational measures appropriate to the risk, including encryption in transit, role- and field-level access controls, partner data isolation, and audit logging. These measures are summarized on our Security page and may be updated to keep pace with evolving threats, provided protection is not materially reduced.
The Customer authorizes TrackBooth to engage sub-processors to support delivery of the service. TrackBooth imposes data-protection obligations on sub-processors substantially similar to those in this DPA and remains responsible for their performance. A current list of sub-processors is available on request, and we will give notice of intended changes so the Customer may object on reasonable grounds.
Taking into account the nature of processing, TrackBooth assists the Customer with appropriate measures to fulfil its obligation to respond to data-subject requests, and to support data-protection impact assessments and consultations with authorities. Where TrackBooth receives a request directly from a data subject relating to Customer data, it will direct that request to the Customer.
TrackBooth notifies the Customer without undue delay after becoming aware of a personal-data breach affecting Customer data, and provides information reasonably available to help the Customer meet its own notification obligations.
Where processing involves transferring personal data across borders, the parties rely on an appropriate transfer mechanism, such as standard contractual clauses, where required by applicable law.
On termination of the service, TrackBooth makes Customer data available for export for a limited period and thereafter deletes or anonymizes it, unless retention is required by law. The Customer is responsible for exporting data within the available window.
For DPA-related questions or to request a signed copy, contact [email protected].