This DPA applies where WebMoment processes personal data on behalf of a customer in connection with the Services.
1. Definitions
"Agreement" means the Terms of Service, order form, master agreement, or other agreement governing use of WebMoment.
"Customer" means the entity or person using WebMoment.
"Customer Data" means data submitted to or generated through the Services for Customer.
"Personal Data" means personal data, personal information, or similar terms under applicable data protection laws.
"Controller" means the party that determines purposes and means of processing.
"Processor" means the party that processes Personal Data on behalf of the Controller.
"Subprocessor" means a third party engaged by WebMoment to process Personal Data.
"GDPR" means the EU General Data Protection Regulation and, where applicable, UK GDPR.
"SCCs" means the Standard Contractual Clauses approved by the European Commission or applicable UK transfer mechanism.
2. Roles
For Customer Data processed through Workspaces, Pages, Moments, Trackings, Replay archives, comments, uploads, and APIs:
Customer is the Controller or Processor, as applicable.
WebMoment is the Processor or Subprocessor, as applicable.
Customer determines what URLs are submitted, what content is captured, and how Customer Data is used.
3. Processing Scope
WebMoment processes Personal Data to provide the Services, including:
capturing screenshots;
generating Replay archives;
running Trackings;
storing Moments;
organizing Collections;
enabling collaboration;
providing APIs;
sending notifications;
supporting exports;
securing and troubleshooting the Services.
4. Processing Details
4.1 Subject Matter
Automated website Capture, Replay preservation, scheduled Tracking, collaboration, storage, APIs, and related SaaS services.
4.2 Duration
For the term of the Agreement and any post-termination retention period required by the Agreement, law, backups, or legitimate operational needs.
4.3 Categories of Data Subjects
Data subjects may include:
Customer users;
Workspace members;
customer personnel;
website visitors whose data appears in Captured Content;
end users;
support contacts.
4.4 Categories of Personal Data
Personal Data may include:
names;
email addresses;
account identifiers;
IP addresses;
URLs;
comments;
screenshots;
Replay archive content;
metadata;
logs;
any personal data visible on captured Pages.
4.5 Processing Operations
Processing may include collection, storage, hosting, retrieval, transmission, organization, deletion, export, analysis for security, and technical support.
5. Customer Instructions
WebMoment will process Personal Data only according to Customer's documented instructions, including the Agreement, product settings, API requests, and support instructions.
WebMoment will notify Customer if it believes an instruction violates applicable data protection law, unless prohibited by law.
6. Customer Responsibilities
Customer is responsible for:
lawful basis;
privacy notices;
consent where required;
submitted URLs;
permissions for Captured Content;
configuring retention and access controls;
responding to data subject requests;
ensuring users comply with the Agreement.
7. Confidentiality
WebMoment will ensure personnel authorized to process Personal Data are bound by confidentiality obligations or are subject to appropriate statutory duties.
8. Security
WebMoment will maintain appropriate technical and organizational measures designed to protect Personal Data.
WebMoment remains responsible for Subprocessor performance of data protection obligations required by this DPA.
10. Subprocessor Changes
WebMoment may add or replace Subprocessors as the Services evolve. Where required by law or agreement, notice will be provided before a material change takes effect.
If Customer objects and WebMoment cannot reasonably accommodate the objection, either party may terminate affected Services according to the Agreement.
11. Data Subject Requests
WebMoment will provide reasonable assistance for data subject requests where Customer cannot fulfill the request through the Services.
Customer is responsible for verifying and responding to requests where Customer is the Controller.
12. Personal Data Breach
WebMoment will notify Customer without undue delay after becoming aware of a Personal Data breach affecting Customer Data.
Notice will include available information reasonably needed for Customer to meet legal obligations, subject to ongoing investigation and legal restrictions.
13. Data Protection Impact Assessments
WebMoment will provide reasonable information to help Customer complete data protection impact assessments and regulator consultations where required and where the information is not otherwise available.
14. Deletion and Return
Upon termination or written request, WebMoment will delete or return Customer Data according to the Agreement, product functionality, legal requirements, and backup retention.
Deletion from backups may occur on normal backup rotation cycles.
15. Audit Rights
WebMoment will make available information reasonably necessary to demonstrate compliance with this DPA.
Audits must:
be reasonable in scope;
occur during normal business hours;
avoid disruption;
protect confidential information;
not compromise other customers.
Where available, third-party reports or security documentation may satisfy audit requests.
16. International Transfers
WebMoment and Subprocessors may process Personal Data outside Customer's jurisdiction.
Where required, transfers will rely on appropriate mechanisms, such as SCCs, UK transfer mechanisms, adequacy decisions, or other lawful transfer tools.
17. SCCs
Where SCCs are required, the parties agree that the applicable SCCs are incorporated by reference and apply to transfers of Personal Data from the EEA, UK, or Switzerland to countries without an adequacy decision.
The parties will complete SCC details as required by applicable law and the parties' roles.
18. CCPA Service Provider Terms
Where CCPA or similar U.S. privacy laws apply, WebMoment acts as a service provider or processor for Customer Data.
WebMoment will not sell Customer Data or use it for cross-context behavioral advertising as those terms are defined by applicable law.
19. Order of Precedence
If this DPA conflicts with the Agreement, this DPA controls only for Personal Data processing matters.
20. Contact
DPA questions may be sent through our contact page.
