Data processing agreement
Between Lanyards Trader LTD trading as ClickTrap trading as ClickTrap (the processor) and the customer (the controller).
Effective from 01.10.2026.
1. Scope and parties
1.1 This agreement is between Lanyards Trader LTD trading as ClickTrap trading as ClickTrap, a company registered in England and Wales (company number 09614643), whose registered office is at 37 Lonsdale Close, London, SE9 4HF (“Lanyards Trader LTD trading as ClickTrap”, the “Processor”) and the customer that has accepted our terms of service (the “Customer”, the “Controller”). It forms part of those terms and applies whenever we process personal data on the Customer’s behalf in providing ClickTrap (the “Service”).
1.2 It is intended to meet the requirements of Article 28 of the UK General Data Protection Regulation (“UK GDPR”) and, where they apply, Article 28 of the EU General Data Protection Regulation (“EU GDPR”). Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR.
1.3 The details of the processing are set out in Annex 1, our security measures in Annex 2, and our sub-processors in Annex 3.
2. Processing on the Customer’s instructions
2.1 We process the Customer’s personal data only on its documented instructions, including with regard to transfers outside the UK, unless the law requires otherwise, in which case we will tell the Customer before processing unless the law prohibits it.
2.2 The Customer’s instructions are: these terms and this agreement; the settings, rules and connections it configures in the Service; and any further written instructions it gives that are consistent with the terms. We will tell the Customer straight away if we believe an instruction breaks data protection law.
2.3 The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis, giving visitors the information the law requires, and obtaining any consent needed for the tracking code to read information from visitors’ devices.
3. Confidentiality
We ensure that everyone we authorise to process the Customer’s personal data is bound by a duty of confidentiality, and that our staff access it only as needed to provide, support and secure the Service.
4. Security
We implement and maintain the technical and organisational measures in Annex 2, which are designed to protect the Customer’s personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. We may update these measures, provided the overall level of protection is not reduced.
5. Sub-processors
5.1 The Customer gives general authorisation for us to engage sub-processors. Our current sub-processors are listed in Annex 3.
5.2 We will give the Customer at least 30 days’ notice of any new or replacement sub-processor, by email to the account owner and by updating Annex 3. The Customer may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, the Customer may cancel the affected Service and receive a refund of fees prepaid for the period after the change.
5.3 We impose data protection obligations on each sub-processor that are no less protective than those in this agreement, and remain liable to the Customer for their performance.
6. Data subjects’ rights and assistance
6.1 Taking into account the nature of the processing, we assist the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights. The Service lets the Customer find and export the visits for an IP address or device and remove its exclusions, and we will delete a data subject’s visit data on the Customer’s request.
6.2 If we receive a request directly from a data subject about the Customer’s data, we will pass it to the Customer without undue delay and will not respond ourselves, except to direct the person to the Customer.
6.3 We provide reasonable assistance to the Customer with its obligations on security, breach notification, data protection impact assessments and prior consultation with the regulator, taking into account the nature of the processing and the information available to us.
7. Personal data breaches
We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting its personal data. The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and take reasonable steps to contain the breach.
8. International transfers
We will not transfer the Customer’s personal data outside the UK, or allow a sub-processor to do so, unless the transfer is covered by UK adequacy regulations or appropriate safeguards under Article 46 of the UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. For customers subject to the EU GDPR, the equivalent EU safeguards apply.
9. Deletion and return of data
9.1 During the subscription, visit data is deleted automatically at the end of the retention period of the Customer’s plan, and the Customer can delete data itself.
9.2 When the subscription ends, the Customer can export its visits and exclusions from the Service. We delete all of the Customer’s personal data 30 days after the subscription ends, including from our live systems, and from backups as they expire in their normal cycle, unless the law requires us to keep it.
10. Information and audits
10.1 We make available to the Customer the information reasonably necessary to demonstrate compliance with this agreement, including answers to reasonable security questionnaires and summaries of relevant certifications or reports of our sub-processors.
10.2 Where that information is not enough to demonstrate compliance, or a regulator requires it, we will allow and contribute to an audit by the Customer or an independent auditor it appoints, on at least 30 days’ written notice, during business hours, no more than once a year (except after a breach), subject to confidentiality, and at the Customer’s cost.
11. The Collective Shield
11.1 Reports to the Collective Shield (an IP address, the kind of signal, the reporting account and website, and the date) are processed by Lanyards Trader LTD trading as ClickTrap as a controller for the purpose of preventing advertising fraud, and not as the Customer’s processor under this agreement.
11.2 The Customer instructs us to make these reports as part of the Service. We process them only as our privacy policy describes, never disclose one customer’s reports to another customer, and delete them after 90 days. IP addresses on the Customer’s allowlist are never reported.
12. Liability and term
12.1 Each party’s liability under this agreement is subject to the limitations in the terms of service.
12.2 This agreement lasts for as long as we process personal data on the Customer’s behalf.
12.3 If this agreement and the terms of service conflict on the processing of personal data, this agreement wins.
Annex 1: Details of the processing
| Subject matter | Detecting and blocking invalid and fraudulent clicks on the Customer’s online advertising. |
|---|---|
| Duration | The term of the Customer’s subscription, plus 30 days until deletion. |
| Nature and purpose | Collecting data about visits from the Customer’s ads through the tracking code; reading the Customer’s records of those clicks from its advertising accounts; recognising repeated clicks from the same IP address or device and scoring how visitors behave; applying the Customer’s rules; adding and removing IP exclusions in the Customer’s advertising accounts, on campaigns and, where switched on, on the account’s own list; reporting to the Customer. Where the Customer switches them on: judging the forms its visitors send; sending its verified conversions to Google Ads, and the customers it uploads with their sale value; sending blocked visitors’ details to its Meta Pixel through Meta’s Conversions API; telling its own website tags whether a visitor looks genuine or suspicious; hiding its contact links and forms from visitors whose source is blocked, and telling them so with a check that brings them back; briefly pausing the part of a campaign under attack; adding the websites and apps it approves to its advertising account’s placement exclusions; and making the data available to its own systems through API tokens and webhooks. |
| Data subjects | People who visit the Customer’s websites after clicking its ads, and anyone whose IP address the Customer adds to an exclusion or allowlist. |
| Personal data | IP address and derived country and network; user agent; device characteristics and a derived device identifier; ad click identifiers and ad details (campaign, ad group, keyword and match type, network, the website or app the ad was shown on, device type, approximate location), and the advertising platform’s record of the click (such as whether it was filtered as invalid); landing page, referring page and paths of pages viewed; time on site; counts of how the visitor scrolled, moved the pointer, clicked or pressed keys and focused form fields (never what was typed, or where on the page); automation, VPN and tampering signals where the Customer uses them; where the Customer switches it on, that a form was sent, which form and on which page (never what was typed); where the Customer uploads them, the click identifiers of leads that became its customers, with the date and sale value; whether the Customer marked a lead as spam or genuine; the Customer’s notes on exclusions. |
| Special category data | None intended. The Customer must not configure the Service to collect it. |
| Retention | The retention period of the Customer’s plan, then deleted automatically. |
Annex 2: Security measures
- Encryption: HTTPS for all connections, including the tracking code; OAuth tokens and secret keys encrypted at rest; passwords stored only as secure hashes.
- Separation: every customer’s data carries its account identifier and is filtered by it on every request, with automated tests that one account cannot read or change another’s data.
- Access control: role-based access for customers’ users (owner, admin, viewer); staff access limited to those who need it, protected by two-factor authentication, and recorded in the customer’s audit log when staff sign in as a user.
- Minimisation: the tracking code runs only on visits from ads; page paths are stored without query strings; behaviour is recorded only as counts, and nothing typed into forms is recorded; data is deleted at the end of the plan’s retention period.
- Resilience: regular backups, and monitored queues and scheduled tasks.
- Development: automated tests, including tenant-separation tests, on every change; dependency updates; and separate development and production environments, with no production data in development.
- Incident response: a documented process for investigating, containing and notifying personal data breaches.
Annex 3: Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Krystal Hosting | Hosting the application, database and queues | All data held in the service | United Kingdom |
| Stripe Payments Europe, Ltd. | Subscription billing and card payments | Account holders’ names, email addresses, billing addresses and payment details | Ireland, with transfers to the United States |
| Sendinblue SAS (Brevo) | Sending service emails (sign-in, invitations, billing notices, weekly reports) | Account holders’ names and email addresses, and email content | France (European Union) |
| FingerprintJS, Inc. | Device identification and bot detection, for accounts in Managed mode | Visitors’ IP addresses and browser and device characteristics | United States, or the European Union for EU-region workspaces |
When the Customer connects an advertising account, IP addresses to be excluded, and the verified conversions and other changes the Customer switches on, are sent to that platform (such as Google) on the Customer’s instruction. Where the Customer uses Meta’s Conversions API, blocked visitors’ IP addresses, browsers and click identifiers are sent to Meta with the Customer’s own access key, alerts go to the Slack or Microsoft Teams addresses the Customer gives, and webhook events go to the web addresses the Customer gives. Each of these acts under its own terms with the Customer and is not our sub-processor.
Questions about this agreement: support@clicktrap.co.uk.