Data processing agreement

1. Parties and roles

The customer (“you”) is the controller of the personal data that people send through your widgets. Mariën Digital SRL (“we”), which runs Two Cents, is your processor. For account and billing data about you, we are a controller in our own right, as the privacy policy explains.

2. What we process, and why

• Purpose: hosting the widget, receiving and storing messages, showing them in your dashboard, exporting them and sending you notifications about them.
• People concerned: the visitors of your site who send a message, and anyone whose details you or your code attach to one.
• Data: the message text; the name and email address if given; the page address and referrer; browser, system, window size, language and time zone; console lines sent with bug reports; an optional screenshot; and anything your own code passes to the widget.
• Duration: as long as your account exists, then deleted as in section 9.

The widget is not designed for sensitive categories of data, and we ask you not to invite them.

3. Our commitments

• We process the data only on your documented instructions, which are these terms, the settings you choose in the dashboard and your use of the service.
• If we believe an instruction breaks the law, we tell you.
• Everyone with access on our side is bound by confidentiality.
• We use the data for nothing else: no advertising, no resale, no training of any model.

4. Security

We apply measures suited to the risk, including:

• encrypted connections everywhere, and a secure, script-inaccessible session cookie;
• passwords stored only as salted hashes;
• every read and write in the dashboard checked against the account that owns the site, so one account cannot reach another’s messages;
• screenshots served only to their owner, with the file type checked and a restrictive content policy;
• text from visitors always shown as text, never as markup, and links from visitors limited to safe addresses;
• exports guarded against spreadsheet-formula injection;
• rate limits on the public endpoint, and nightly backups kept for 14 days.

5. Sub-processors

You give us a general authorisation to use the companies listed on the sub-processors page. We bind each of them to obligations equivalent to these, and remain responsible for them. We tell you at least 30 days before adding or replacing one. You may object on reasonable grounds within that time; if we cannot meet the objection, you can end the service and we refund the period you paid for and did not use.

6. Help with people’s rights

You can find, export and delete messages from the dashboard yourself. If someone asks us instead of you, we send them to you and do not answer on your behalf. If you need more help than the dashboard gives, we assist within reason and within the time the law allows.

7. Personal data breaches

We tell you without undue delay after we become aware of a breach that affects your data, with what we know: what happened, what data, the likely consequences and what we are doing about it, so that you can meet your own duty to notify.

8. Transfers outside the EEA

Your data is stored in France. The only sub-processor that may move data outside the European Economic Area is Stripe, and only for billing data, under the EU–US Data Privacy Framework and standard contractual clauses. Message content stays in the EEA.

9. Deletion and return

You can export everything as CSV or JSON at any time. When you delete your account, the messages and screenshots are removed at once and leave our backups within 14 days. Invoices are the exception: Stripe keeps them for ten years, as Belgian accounting law requires, and they hold no message content.

10. Proof and audits

We give you the information needed to check that we meet this agreement, and allow an audit by you or an auditor you appoint, once a year unless a breach calls for more, with reasonable notice, during working hours and at your cost. For most customers, this page, the privacy policy and a written answer to your questions will do.

11. Signing a copy

This agreement applies without a signature. If your own compliance process needs a countersigned copy, write to sylvain@twocentsbox.com with your company details and we return one. Belgian law applies, as in the terms.