Data Processing Addendum
Last updated 31 May 2026
Draft, pending counsel review. This document is a working draft and does not yet constitute final legal terms. It may change before publication.
This page summarises the ConsentX Data Processing Addendum, or DPA, which forms part of our agreement with customers who use ConsentX to process personal data. The signed DPA controls in case of any conflict with this summary.
Roles
When you use ConsentX to manage consent on your own websites, you are the controller of your visitors personal data and ConsentX acts as your processor. ConsentX processes that data only on your documented instructions and for the purpose of providing the service.
Subject matter and duration
The subject matter is the processing of consent and related records needed to deliver the ConsentX platform. Processing lasts for the term of your subscription and for any wind-down period agreed in the DPA, after which data is returned or deleted in line with your instructions.
Security measures
ConsentX maintains technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls with multi-factor authentication and tamper-evident consent evidence. Full detail is on our security page.
Subprocessors
ConsentX uses a limited set of subprocessors to deliver the service, each bound by data protection obligations no less protective than those in the DPA. The current list, with notice of changes, is on our subprocessors page.
Data subject requests
ConsentX provides features to help you respond to data subject requests, such as access and erasure, through built-in DSAR workflows. Where a request reaches ConsentX directly, we will promptly refer it to you, the controller, unless legally required to act otherwise.
Audits
ConsentX makes available the information needed to demonstrate compliance with the DPA and will allow for and contribute to audits, subject to reasonable notice and confidentiality, as set out in the signed agreement.
Request a signed DPA
To request a signed copy of the ConsentX DPA, email legal@consentx.io with your company name and the entity that will sign. We will return a copy for execution.