Data processing agreement

Last updated: 10 October 2026

Parties and scope

This agreement is between the customer who uses Passback ("the controller") and Passback, operated by a sole trader with NIF and VAT number PT311924093 ("the processor", "we"). It applies to the personal data we process for the controller when the controller uses the hosted Passback service, and it is part of the terms of service at https://passback.dev/legal/terms/. It takes effect when the controller accepts the terms, and it runs as long as we process that data.

It follows Article 28 of the General Data Protection Regulation (GDPR).

What we process, why and for whom

  • Subject matter and purpose: receiving the feedback that visitors of the controller's sites send through the Passback widget, and delivering it to the issue tracker the controller chose.
  • Nature of the processing: receiving, temporary storage, screenshot storage, transmission to the tracker, deletion.
  • Types of data: the text of comments, the address of the page, the selected element and its place in the code, basic browser information, screenshots on plans that include them, and any personal data a visitor writes or shows in them.
  • People concerned: the visitors and testers who send feedback, and the controller's own staff who use the dashboard.
  • Duration: as long as the controller's account exists, and the retention periods below.

What we do and do not do

We process the data only on the controller's documented instructions. The terms, this agreement and the settings the controller makes in the dashboard are those instructions. If we think an instruction breaks data protection law we tell the controller.

We do not use the data for our own purposes, we do not sell it, and we do not send it to an artificial intelligence provider.

Everyone at our side who can see the data is bound to confidentiality.

What the controller does

The controller decides what is collected and why, makes sure it has a legal basis, tells its visitors that it uses the widget, and answers the questions and requests of the people concerned. The controller uses the widget's settings to switch off screenshots and to black out private fields where needed.

Security measures

  • Connections to the service are encrypted in transit.
  • The service runs on servers in the European Union; backups are encrypted before they leave the server.
  • Access to production systems is limited to the people who need it, with individual sign-in.
  • Tracker access tokens given to us are stored only for delivery and are not shown again.
  • Screenshots are stored in a private bucket and expire after the retention period.
  • Private fields are blacked out by the widget before a screenshot is taken.
  • We check and update the software that runs the service regularly.

Subprocessors

The controller gives us a general authorisation to use subprocessors. The ones in use are listed at https://passback.dev/legal/subprocessors/ with their purpose and location. We bind each one to data protection duties no weaker than these.

We tell the controller by email at least 30 days before we add or replace a subprocessor. The controller can object within that time on reasonable grounds of data protection; if we cannot accommodate the objection, the controller can end the agreement and cancel its plan, and we refund the unused part of what it prepaid.

Help with requests and audits

We help the controller to answer requests of the people concerned, and with data protection impact assessments and consultation with authorities, as far as it is needed and within what we can reasonably do. We may ask for reasonable payment for help that goes beyond normal use of the dashboard.

We give the controller the information it needs to show that we meet this agreement. The controller or an auditor it names can audit us once a year, with 30 days' written notice, in working hours and without disturbing the service; the controller bears the cost.

Personal data breaches

If we learn of a breach of security that affects the controller's data we tell the controller without undue delay and in any case within 48 hours, and give what we know: what happened, which data, the likely effects and the steps taken.

Transfers outside the EU

We keep the controller's data in the European Union. Where a subprocessor is in a country without an adequacy decision, for example the United States, we rely on the standard contractual clauses of the European Commission (Decision 2021/914, module 3, processor to processor), the provider's certification under the EU-US Data Privacy Framework, or both, as listed on the subprocessors page.

Deletion and return

Screenshots expire 90 days after they were taken. When the controller deletes a site, comments waiting for delivery and its screenshots are removed at once. When the agreement ends we delete the remaining data within 30 days, unless the law requires us to keep it. Before that, the controller can ask for a copy at legal@passback.dev.

Liability, law and order of precedence

The limits of liability in the terms of service apply to this agreement, without limiting the rights of the people concerned. This agreement is governed by Portuguese law. If it conflicts with the terms of service on the processing of personal data, this agreement prevails.

Signed copy

Acceptance of the terms is acceptance of this agreement. If the controller needs a signed copy, it can ask for one at legal@passback.dev.