Data Processing Addendum
Last updated October 18, 2026
This Data Processing Addendum (the "DPA") forms part of the Terms of Service and governs Wunderly's processing of personal data on behalf of the customer whose websites and forms use the Service.
1. Definitions
"Controller" means the customer using the Service. "Processor" means Wunderly. "Personal Data", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the EU General Data Protection Regulation ("GDPR") and the UK GDPR (together with other applicable privacy laws, "Data Protection Laws"). "Subprocessor" means a third party engaged by the Processor to process Personal Data. Capitalized terms not defined here have the meanings given in the Terms of Service.
2. Roles of the Parties
With respect to the Personal Data of visitors to the Controller's websites and of people who send the Controller's forms, the Controller is the controller and Wunderly is the processor. Each party will comply with its obligations under Data Protection Laws.
3. Details of the Processing
| Subject matter | Counting visits to the Controller's websites, operating the Controller's contact and quote forms, and reporting both to the Controller. |
|---|---|
| Duration | For as long as the Controller's account exists, followed by deletion as set out in Section 4, and within the retention periods in the Privacy Policy. |
| Nature and purpose | Collection by the analytics script and the forms, storage, counting, and sending the emails the Controller's settings call for: each request to the Controller, the estimate a requester asks for, and the weekly report. |
| Categories of personal data | For visitors: the pages they open (without query strings, apart from utm tags), the referring website, a screen-size group, their country, taps on telephone, email and map links, and a daily key that cannot be traced back to them; never their network address. For requesters: what the Controller's form asks (typically names, email addresses, phone numbers and answers), the estimate displayed, the pages they looked at that day when they send, their country, and whether and under which wording they asked for their estimate by email. |
| Categories of data subjects | Visitors to the Controller's websites, and people who open or send the Controller's forms. |
4. Obligations of the Processor
The Processor will:
- process Personal Data only on the Controller's documented instructions, which consist of the Controller's installation of the analytics script, its forms and its settings, including with regard to international transfers, and inform the Controller if, in the Processor's opinion, an instruction infringes Data Protection Laws;
- ensure that every person authorized to process Personal Data is bound by confidentiality;
- implement appropriate technical and organizational security measures, including HTTPS everywhere, encryption at rest by its host, sign-in links, sessions and emailed links stored only as hashes, a spam check on every form, rate limits, an operations console behind single sign-on in which every access to answers is logged, and nightly backups kept for 30 days;
- assist the Controller in responding to requests from Data Subjects to access, correct or delete their Personal Data;
- notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting the Controller's data, and in any event within 72 hours, describing, as far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences and the measures taken or proposed, and supplementing that notice as more becomes known;
- assist the Controller, taking into account the nature of the processing and the information available to the Processor, with its obligations regarding security, Personal Data Breaches, data protection impact assessments and prior consultation with a supervisory authority;
- at the end of the processing, return the Controller's Personal Data, which the Controller may export at any time before deleting its account, and delete it when a website or the account is deleted, with backups expiring within 30 days, unless the law requires its storage; and
- make available to the Controller, on request, the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, by the Controller or an independent auditor it mandates who is bound by confidentiality. An audit is requested in writing at least 30 days ahead, takes place no more than once in any 12 months unless a supervisory authority requires it or it follows a Personal Data Breach, and is conducted during business hours without unreasonably disrupting the Service; the Controller bears its own costs.
5. Subprocessors
The Controller authorizes the Processor to engage the Subprocessors listed below. The Processor will announce any new Subprocessor on the changelog at least 30 days before it begins processing, and the Controller may object on reasonable data protection grounds by writing to the Processor. If the parties cannot resolve the objection, the Controller may stop using the Service and delete its account before the new Subprocessor begins processing. The Processor imposes on each Subprocessor, by written contract, data protection obligations no less protective than those in this DPA, and remains liable to the Controller for each Subprocessor's performance of them.
| Company | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the database, sending email, the browser the site checks use, the spam check (Turnstile) and backups | Global network; data kept in North America |
| Paddle.com Market Ltd | Selling Wunderly's plans as the merchant of record: payment, invoices, receipts and tax. It sees the customer's billing details, never their visitors' or requesters' data | United Kingdom |
6. International Transfers
The Processor keeps the Controller's Personal Data in North America, as set out in the Privacy Policy. A request is handled at the Cloudflare location nearest whoever makes it; scheduled jobs, queues and the site checks' browser run wherever Cloudflare places them and keep nothing outside that storage; and emails go wherever the Controller's settings direct.
Where Personal Data is transferred outside the EU, the EEA or the UK, the transfer is governed by the European Commission's Standard Contractual Clauses (Module Two, controller to processor, and Module Three for onward transfers to Subprocessors), together with the UK International Data Transfer Addendum, which are incorporated into this DPA by reference. Section 3 of this DPA serves as their Annex I, and Section 4(c) as their Annex II.
7. Term and Precedence
This DPA remains in effect for as long as the Processor processes Personal Data on the Controller's behalf. In the event of a conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA prevails.
8. Contact
Wunderly is operated by Zachary Johnson, an individual doing business as Wunderly, Kentucky, USA. Questions about this DPA may be sent to legal@usewunderly.com. Requests concerning a Data Subject's Personal Data may be sent to privacy@usewunderly.com.