ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXLast updated 1 June 2026
Draft, pending counsel review. This document is a working draft and does not yet constitute final legal terms. It may change before publication.
This Data Processing Addendum (DPA) forms part of the agreement between the customer and ConsentX for the provision of the ConsentX platform at app.consentx.io. It governs the processing of personal data by ConsentX as a processor acting on behalf of the customer as controller, and reflects the requirements of Article 28 of the General Data Protection Regulation and equivalent obligations under the UK GDPR, the California Consumer Privacy Act and the Indian Digital Personal Data Protection Act. If a signed copy of this DPA is agreed between the parties, that signed copy controls in case of any conflict with this page.
Capitalised terms used in this DPA have the meanings set out below. Terms not defined here have the meaning given in Applicable Data Protection Law or in the Terms.
When the customer uses ConsentX to manage consent on its own websites, properties and applications, the customer is the controller of the personal data and ConsentX acts as the customer’s processor. ConsentX processes that personal data only on the customer’s documented instructions and solely for the purpose of providing and supporting the service.
This DPA forms part of the Terms. It applies to the extent that ConsentX processes personal data on behalf of the customer in its capacity as processor. Where ConsentX processes data as a controller for its own limited purposes, such as account administration, billing and security, that processing is governed by the ConsentX privacy policy rather than this DPA. In case of conflict between this DPA and the rest of the Terms on the subject of data protection, this DPA prevails.
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in detail in Annex 1 to this DPA. In summary, the subject matter is the processing of consent records and related data needed to deliver the ConsentX platform. Processing lasts for the term of the subscription and any wind-down period agreed in this DPA, after which personal data is returned or deleted in accordance with Section 10.
ConsentX, as processor, undertakes to comply with Article 28(3) of the GDPR and the equivalent obligations under Applicable Data Protection Law. In particular, ConsentX will:
The customer grants ConsentX general written authorisation to engage subprocessors to process personal data in connection with the service. ConsentX maintains an up to date list of subprocessors on its subprocessors page and in Annex 3 to this DPA. ConsentX will give the customer notice of any intended addition or replacement of a subprocessor, giving the customer the opportunity to object on reasonable data protection grounds before the new subprocessor begins processing personal data.
Where ConsentX engages a subprocessor, it will do so by way of a written contract that imposes on the subprocessor data protection obligations no less protective than those set out in this DPA, in particular obligations to implement appropriate technical and organisational measures. ConsentX remains fully liable to the customer for the performance of each subprocessor’s obligations. If the customer reasonably objects to a new subprocessor and ConsentX cannot offer a commercially reasonable alternative, the customer may terminate the affected service as set out in the Terms.
ConsentX hosts production data in the Amazon Web Services Asia Pacific Mumbai region (ap-south-1) in India, with Cloudflare providing content delivery and web application firewall services and Vercel hosting the public marketing site. Where the provision of the service involves a transfer of personal data outside the European Economic Area, the United Kingdom or another jurisdiction with data localisation requirements, ConsentX implements an appropriate transfer mechanism under Applicable Data Protection Law.
Where the SCCs apply, they are incorporated into this DPA by reference and, in case of conflict between the SCCs and any other term of this DPA, the SCCs prevail. ConsentX has appointed IntelligenceX as its representative in the European Union and the United Kingdom under Article 27 of the GDPR and the UK GDPR. The representative can be contacted via intelligencex.org.
ConsentX provides built-in features to help the customer respond to requests from data subjects to exercise their rights, including rights of access, rectification, erasure, restriction, objection and data portability, through the platform’s data subject access request and grievance workflows. Taking into account the nature of the processing, ConsentX assists the customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the customer’s obligation to respond to such requests.
Where a data subject request reaches ConsentX directly, ConsentX will, unless legally required to act otherwise, promptly refer the request to the customer as controller and will not respond to the request itself except on the customer’s documented instructions.
ConsentX will notify the customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting the customer’s personal data. The notification will, taking into account the information available to ConsentX, include:
ConsentX will cooperate with the customer and take reasonable steps to assist in the investigation, mitigation and remediation of the breach. The customer remains responsible for any notifications to supervisory authorities and affected data subjects required of it as controller. Breach notifications should be sent to dpo@consentx.io.
ConsentX makes available to the customer all information necessary to demonstrate compliance with the obligations in Article 28 of the GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the customer or an auditor mandated by the customer. ConsentX may satisfy an audit request, in the first instance, by providing relevant documentation such as security certifications, third party audit reports, summaries of penetration tests and responses to a reasonable security questionnaire.
Where the customer reasonably requires an on-site inspection, ConsentX will permit such inspection on reasonable prior notice, during normal business hours, no more than once in any twelve month period unless required by a supervisory authority or following a personal data breach, subject to appropriate confidentiality undertakings and conducted so as to minimise disruption to ConsentX’s operations and the security of other customers.
On termination or expiry of the Terms, ConsentX will, at the choice of the customer, delete or return all personal data processed on behalf of the customer and delete existing copies, unless Applicable Data Protection Law requires storage of the personal data. ConsentX will carry out deletion or return within a reasonable period after the end of the provision of services, subject to a defined wind-down period agreed in this DPA.
Personal data retained in routine backups will be deleted in accordance with ConsentX’s documented backup retention schedule and will not be used for any purpose other than continuity while it remains in those backups. On the customer’s written request, ConsentX will provide written certification that it has complied with this Section 10.
To the extent that the CCPA applies to the processing of personal information under this DPA, ConsentX acts as a service provider to the customer as a business, as those terms are defined in the CCPA. ConsentX:
To the extent that the Indian Digital Personal Data Protection Act 2023 applies, the customer acts as the data fiduciary and ConsentX acts as a data processor engaged under a valid contract. ConsentX:
Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Terms, and any reference to the liability of a party in the Terms means the aggregate liability of that party under the Terms and this DPA together.
In case of any conflict or inconsistency, the following order of precedence applies: first, the SCCs and the UK Addendum to the extent they apply to a relevant transfer; second, the body of this DPA and its annexes; and third, the remainder of the Terms. Nothing in the Terms or this DPA is intended to limit or override the rights of data subjects or the powers of any supervisory authority.
This Annex 1 describes the processing carried out by ConsentX as processor on behalf of the customer as controller, as required by Article 28(3) of the GDPR and the SCCs.
| Item | Description |
|---|---|
| Parties | Data exporter and controller: the customer that subscribes to ConsentX. Data importer and processor: ConsentX, the provider of the platform at app.consentx.io. |
| Subject matter | Processing of consent records and related data needed to provide the ConsentX consent management, preference management, data subject request and compliance reporting services. |
| Duration | For the term of the subscription and any wind-down period, after which personal data is returned or deleted in accordance with Section 10. |
| Nature and purpose | Collection, recording, storage, organisation, retrieval, use and erasure of consent and preference data for the purpose of enabling the customer to obtain, record, evidence and honour end-user consent and to demonstrate compliance. |
| Types of personal data | Consent and preference records, consent receipts and timestamps, hashed or pseudonymised identifiers, IP address (which may be truncated), device and browser information, page or domain context, and, for data subject requests, the contact details and request content provided by the data subject. Customers should not send special categories of personal data unless expressly agreed. |
| Categories of data subjects | Visitors and end users of the customer’s websites, properties and applications, and individuals who submit data subject requests or grievances to the customer. |
| Frequency | Continuous, on an ongoing basis for the duration of the subscription, as visitors interact with the customer’s consent experiences. |
ConsentX maintains the technical and organisational measures set out below, appropriate to the risk, in accordance with Article 32 of the GDPR. These measures may be updated over time provided the updates do not materially reduce the overall level of security. Further detail is available on the ConsentX security page.
ConsentX uses a limited set of subprocessors to deliver the service, including Amazon Web Services for hosting in the Asia Pacific Mumbai region, Cloudflare for content delivery and web application firewall services, and Vercel for the public marketing site. Each subprocessor is bound by data protection obligations no less protective than those in this DPA.
The current and authoritative list of subprocessors, together with the mechanism for receiving notice of changes, is maintained on the ConsentX subprocessors page, which is incorporated into this Annex 3 by reference.
This DPA is a working draft pending counsel review and is not yet available for signature. Once it is final, this page will set out how to request and execute a signed copy. Until then, you can raise questions about the draft with legal@consentx.io. For privacy enquiries contact privacy@consentx.io, and for security matters contact dpo@consentx.io. ConsentX’s representative in the European Union and the United Kingdom under Article 27 is IntelligenceX, which can be contacted via intelligencex.org.