Consentful

Data Processing Addendum

Last updated October 9, 2026

This addendum applies when The Plugins Company processes personal data on your behalf as a processor under GDPR or UK GDPR through Consentful. It forms part of our Terms of Service; by using Consentful you agree to it. It is short because Consentful is designed to process very little personal data for you.

Roles

For the websites where you install Consentful, you are the controller and The Plugins Company is a processor. For your own account and billing data, The Plugins Company is an independent controller under our Privacy Policy, not a processor.

What we process for you

  • Visitors' consent choices are stored only in visitors' own browsers on your domain. We do not receive or store them.
  • Connection data (IP address and user agent) in requests your visitors' browsers make to our license service and file hosting, used only transiently for delivery and abuse prevention and not stored.
  • Banner settings you configure (for Webflow sites and hosted-embed sites, stored by us so your site can load them). These contain no visitor personal data.
  • If you enable consent analytics with an endpoint we provide, anonymous aggregate consent events (decision, categories, version, A/B variant, coarse region) that contain no direct identifiers.

Our commitments

When we process personal data for you, we will:

  • process it only on your documented instructions — which are these terms and your configuration — unless the law requires otherwise;
  • make sure anyone who can access it is bound by confidentiality;
  • protect it with appropriate technical and organizational measures, including encryption in transit and least-privilege access;
  • use only the subprocessors listed on our Subprocessors page, give notice of changes, and let you object;
  • help you respond to data subject requests and meet your security, breach-notification and impact-assessment obligations, as far as our role allows;
  • notify you without undue delay after becoming aware of a personal data breach affecting your data;
  • delete personal data processed for you when you stop using the service, unless the law requires us to keep it;
  • make available the information needed to show compliance with this addendum and allow reasonable audits, normally by answering a written questionnaire.

International transfers

Where personal data is transferred outside the EEA or UK, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful mechanism, which are incorporated by reference.

Signed copy

If your organization needs a countersigned copy, email support@theplugins.co.

Data Processing Addendum | Consentful