Data Processing Addendum

Full Service Review LLC

Effective date: September 19, 2026 Version: 2.0

Why this document exists

Most of what Full Service Review does, it does as a controller — we decide what data to collect about our own account holders and why. This document covers the narrower case where we are a processor: handling data about your website's visitors, on your instructions, for your purposes.

That happens in one place: the Visible plugin, our proprietary software, when we install it on a website we maintain for you under a retained engagement. It classifies incoming traffic and may record information about visitors and automated agents.

If the plugin does not run on a site you control, this document does not apply to you. If it does, it forms part of your agreement automatically, and we will also execute it as a standalone signed document on request at no cost.

Roles. You are the Controller. Full Service Review LLC is the Processor. Where your own customer is a controller and you are their processor, we are a sub-processor and the same terms flow down.

1. Scope of processing (Annex I equivalent)

1.1 Subject matter and duration

Processing of personal data of visitors to Controller's website(s), for the duration of the subscription, plus the retention periods in Section 8.

1.2 Nature and purpose

1.3 Categories of data subject

• Visitors to the Controller's website.
• Operators of automated agents (generally not personal data, but included for completeness).

1.4 Categories of personal data

Special category data: none. The plugin does not collect, and must not be configured to collect, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation. Data about criminal convictions is likewise out of scope.

1.5 What the plugin does not do

Stated affirmatively, because a scope limit is only meaningful if it is written down:

• It does not set cookies.
• It does not write to localStorage or sessionStorage.
• It does not fingerprint browsers.
• It does not record form contents, keystrokes, mouse movement, or session replay.
• It does not record precise geolocation.
• It does not build cross-site profiles. The daily salt rotation makes this structurally impossible, not merely prohibited.
• It does not transmit data to any third party other than Full Service Review.

1.6 Configuration

The plugin runs with agent classification enabled. Human visitor logging is switched on only where the Controller asks for it in writing, and either function can be disabled on request. Disabling takes effect on the next request, not on the next scheduled run.

2. Processor obligations

We will:

1. Process only on documented instructions. Your instructions are: this DPA, the plugin's configuration as you have set it, and any written direction you give us. We will not process for our own purposes. If we believe an instruction breaches data protection law, we will tell you and may suspend that processing until it is resolved.
2. Not sell, share, or use your data for our own purposes — including not using it to train AI models, not using it for our own analytics, and not aggregating it into any commercial product without your written agreement. Aggregate statistics we publish about the FSR directory concern our own properties, not yours.
3. Ensure confidentiality. Personnel with access are bound by confidentiality obligations that survive their employment, and access is limited to those who need it.
4. Implement the security measures in Section 5.
5. Engage sub-processors only under Section 4.
6. Assist you with data subject requests, DPIAs, prior consultations, and breach notification, as set out in Sections 6 and 7.
7. Delete or return data at the end of the engagement, per Section 8.
8. Make available the information necessary to demonstrate compliance and submit to audits under Section 9.

3. Controller obligations

You will:

1. Establish and maintain a lawful basis for the processing you instruct.
2. Publish a privacy notice on your own website that accurately describes what the plugin does. We provide model language in Appendix A; using it is optional and does not transfer responsibility for it to us.
3. Where your jurisdiction requires consent for the processing — and note that transient IP use for security and abuse prevention generally does not, while behavioral analytics generally does — obtain it, and configure the plugin accordingly.
4. Not instruct us to process special category data or children's data through the plugin.
5. Respond to your own visitors' data subject requests as the controller.

4. Sub-processors

4.1 Authorization

You give general written authorization for us to engage sub-processors, subject to this section.

4.2 Current list

Maintained at fullservicereview.com/subprocessors/.

4.3 Changes

We will give 30 days' notice before adding or replacing a sub-processor that will process your data. You may object in writing on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected service with a pro-rata refund of prepaid fees — an exit, not a deadlock.

4.4 Liability

We remain fully liable to you for the acts and omissions of our sub-processors as if they were our own. We impose on each, by written contract, obligations no less protective than those in this DPA.

5. Security measures (Annex II equivalent)

We may update these measures, provided the level of protection is not reduced.

6. Assistance with data subject rights

Who. Visitors to your website exercising rights against you.

What we do. Where a data subject exercises a right and the data sits in our systems, we will assist you in responding, taking account of the nature of the processing.

How, honestly. Because visitor identifiers are salted hashes and the salt rotates daily and is not retained beyond its rotation window, we generally cannot locate the records of a specific individual on request. This is a consequence of the pseudonymization that protects them. Where a data subject can supply enough information to identify records within the current salt window, we can act. Beyond that window, the data is effectively anonymous and Article 11 of the GDPR applies: a controller is not obliged to maintain identifying information solely to enable rights that the data no longer supports.

We will say this to you plainly rather than promise a capability we do not have.

What we can always do. Delete all data associated with your site, or with a specific URL, on request, within 30 days.

Timing. We will forward any request we receive directly from your visitor to you within 5 business days and will not respond to it ourselves except to say we have forwarded it.

Cost. Assistance is included. We do not charge for compliance help.

7. Personal data breach

Notification to you. We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data. Forty-eight hours is deliberately shorter than the 72 hours you have to notify your regulator, so the clock does not start against you already partly spent.

What the notice will contain. The nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide all of it at once, we will provide it in phases rather than delay the first notice.

What we will not do. We will not wait for a complete forensic picture before telling you something has happened. We will not characterize a breach as a "security incident" to avoid triggering an obligation. We will not ask you to keep it confidential from your own regulator or data subjects.

Cooperation. We will cooperate with your investigation and with any regulator, at our cost where the breach arose from our processing.

8. Deletion and return

On termination, at your election:

• Return: we will provide the data in JSON or CSV within 30 days.
• Deletion: we will delete it from live systems within 30 days, and from backups as they age out of the 35-day window. We will not restore a backup to recover deleted data.

If you make no election within 30 days of termination, we will delete.

Certification. We will confirm deletion in writing on request.

Exception. We may retain data where law requires. If that applies, we will tell you what, why, and for how long, and we will continue to protect it under this DPA for as long as we hold it.

9. Audit

What you can do. On reasonable notice, not more than once a year unless a breach or a regulator's direction warrants more, you may audit our compliance with this DPA.

How, in practice. In the first instance we will respond to a written questionnaire and provide documentation of our controls. If that does not satisfy a reasonable question, we will accommodate an audit conducted by you or an independent auditor bound by confidentiality, during business hours, without unreasonable disruption, and without access to other customers' data.

Cost. Ours to bear for the questionnaire and documentation. Yours for an on-site audit, unless the audit finds a material breach of this DPA, in which case we bear it.

10. International transfers

We are established in the United States. Where you are established in the EEA, UK, or Switzerland, or where you instruct us to process data of individuals located there:

• The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), are incorporated into this DPA by reference and take precedence over conflicting terms.
• Docking clause: applicable. Option in Clause 9(a): general written authorization with a 30-day notice period, per Section 4.3. Clause 17 governing law: Ireland. Clause 18 forum: Ireland.
• Annex I (parties, description of transfer) is populated by Section 1 of this DPA and the parties' details.
• Annex II (technical and organizational measures) is populated by Section 5.
• Annex III (sub-processors) is populated by Section 4.2.
• For UK transfers, the UK International Data Transfer Addendum (version B1.0) is incorporated, with Tables 1–4 populated from the above and the Importer selected as the party permitted to terminate under Section 19.
• For Swiss transfers, references to the GDPR read as references to the FADP, references to member state law read as references to Swiss law, and the FDPIC is the competent authority.

Transfer impact assessment. We have assessed the legal environment of the destination and the sub-processors involved. The supplementary measures we rely on are: encryption in transit and at rest, non-retention of raw IP addresses, pseudonymization by rotating salt, minimization of transferred fields, and the commitment in Section 14 of our Privacy Policy to require valid legal process and to notify you unless legally prohibited. The assessment is available to you on request.

11. CCPA and US state law

For the purposes of the California Consumer Privacy Act as amended, and equivalent state statutes:

• We are a service provider (California) / processor (other states) with respect to data processed under this DPA.
• We are prohibited from, and will not: sell or share the data; retain, use, or disclose it for any purpose other than performing the services; retain, use, or disclose it outside the direct business relationship between us; or combine it with data from another source, except as permitted for a service provider.
• We certify that we understand these restrictions and will comply with them.
• You may take reasonable steps to stop and remediate any unauthorized use, and we will notify you if we determine we can no longer meet these obligations.

12. Order of precedence and general

Where this DPA conflicts with the Terms of Service, this DPA prevails on matters of data protection. Where the SCCs conflict with this DPA, the SCCs prevail.

Liability under this DPA is subject to the limitation in Section 16 of the Terms of Service, except that the cap does not apply to breaches of Section 2.2 (no sale, no own-purpose use), Section 7 (breach notification), or to regulatory fines arising from our breach of this DPA.

Governing law: as per the Terms of Service, save where the SCCs specify otherwise.

Appendix A — Model privacy notice language for Controllers

You may add the following to your own website's privacy policy. It is offered as a convenience; you remain responsible for its accuracy in your context.

AI and automated traffic measurement

This website uses the Visible plugin from Full Service Review to identify and measure automated software that accesses our pages — including AI crawlers and search engine bots — and to check that those systems are able to read our content correctly.

When a request is made to this site, the plugin briefly examines the requesting party's IP address and browser identification string. For automated traffic, it records the software's identity, the page requested, and the response given. For human visitors, it records a one-way coded value that changes every 24 hours, which allows us to count visits without identifying anyone and without tracking anyone across days or across other websites.

No cookies are set for this purpose. No browsing profile is created. Your IP address is not stored. This information is not sold or shared with advertisers, and is deleted after 90 days.

Our processor for this activity is Full Service Review LLC. To ask about it, or to ask us to stop, contact us at (your contact details).

Signature block