Data processing agreement
CookieHub's DPA under Article 28 GDPR: how it applies, where to download it, and what CookieHub commits to.
CookieHub acts as a data processor for customer data processed through the service. The customer is the data controller.
The agreement
The data processing agreement (DPA) is entered into pursuant to Article 28 GDPR and forms part of the Terms and Conditions or other service agreement between CookieHub and the customer. The current version is effective from 1 April 2026.
The DPA is accepted as part of the Terms of Service and does not require a signature. The copy below is provided for your records. Enterprise customers may request a signed or customised DPA. One term is the same in every DPA: the customer's general authorisation for CookieHub to engage sub-processors is never made subject to the customer's approval.
Download the CookieHub DPA (April 2026)
What CookieHub commits to
Under the DPA, CookieHub commits to:
- Process personal data only in accordance with the customer's documented instructions, unless required to do otherwise by applicable law
- Ensure that persons authorised to process personal data are subject to binding confidentiality obligations
- Implement appropriate technical and organisational measures in accordance with Article 32 GDPR
- Maintain an up-to-date list of sub-processors, including their country of location, and ensure they are bound by data protection obligations no less protective than those in the DPA
- Provide reasonable assistance so that the customer can respond to data subject requests and comply with Articles 32 to 36 GDPR
- Notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data
- Make available all information reasonably necessary to demonstrate compliance with the DPA and Article 28 GDPR
- Delete or return personal data upon termination of the service agreement, subject to technical constraints, backup retention cycles and legal obligations
Annexes
- Annex 1, the categories of data subjects and personal data: see Personal data processed.
- Annex 2, the approved sub-processors: see Sub-processors.