1. Parties and scope
1.1 This Data Processing Agreement ("DPA") is concluded between the business customer using GetProofAnchor (the "Controller") and forehead s.r.o., Jaurisova 515/4, Michle, 140 00 Praha 4, Czech Republic, Company ID 21908117, VAT ID CZ21908117, registered in the Commercial Register kept by the Municipal Court in Prague, file C 407991 (the "Processor").
1.2 The DPA applies where the Processor processes personal data on behalf of the Controller when providing the Service under the Terms of Service (getproofanchor.com/terms), in particular personal data contained in content that the Controller or its users capture, upload or submit, and in Assisted Capture orders. It does not apply to data that the Processor processes as a controller (for example account and billing data), which is governed by the Privacy Policy.
1.3 The DPA forms part of the Terms of Service and is concluded in electronic form together with the contract for the Service, i.e. when the business customer accepts the Terms at registration or order (Art. 28(9) GDPR). On request, the Processor will provide a copy signed by its executive. In the event of a conflict, the DPA prevails over the Terms of Service as regards the protection of personal data.
1.4 Terms not defined here have the meaning given to them in Regulation (EU) 2016/679 (GDPR).
2. Subject matter, duration, nature and purpose
2.1 Subject matter: storing and processing content captured by the Controller for the creation, sealing, storage, publication (if chosen by the Controller) and verification of evidence records (proofs).
2.2 Duration: for the term of the contract for the Service and until the data is deleted or anonymised under section 9.
2.3 Nature of the processing: loading of web pages and files at the Controller's instruction, recording, storage, hashing, timestamping (only hashes are sent to the qualified trust service provider), generation of evidence packages and reports, making available to the Controller and, if the Controller publishes a proof, to anyone with the link.
2.4 Purpose: the provision of the Service to the Controller, typically to document web content for the establishment, exercise or defence of legal claims, compliance, investigations or journalism, as determined by the Controller.
2.5 The categories of data subjects and personal data are described in Annex 1.
3. Instructions of the Controller
3.1 The Processor processes the personal data only on the documented instructions of the Controller, including with regard to transfers to third countries, unless it is required to do so by EU or Member State law; in that case it informs the Controller before processing, unless that law prohibits it.
3.2 The Controller's instructions are given by the Terms of Service, this DPA and the Controller's use of the Service (in particular the choice of URLs, capture settings and profiles, publication and revocation, export and deletion). Further instructions must be given in writing (e-mail is sufficient) and be compatible with the Service.
3.3 The Processor informs the Controller without undue delay if, in its opinion, an instruction infringes data protection law.
3.4 The Controller is responsible for the lawfulness of the processing, in particular for having a legal basis for capturing the content and for informing data subjects where required.
4. Confidentiality
4.1 The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only on the Controller's instructions.
4.2 The Processor does not access the content of the Controller's proofs except where necessary to provide the Service (for example in Assisted Capture or support requested by the Controller), to remedy a technical problem, or where required by law.
5. Security of processing
5.1 The Processor implements the technical and organisational measures in Annex 2, which ensure a level of security appropriate to the risk in accordance with Article 32 GDPR. The Processor may adapt the measures to technical progress, provided that the level of security is not reduced.
6. Sub-processors
6.1 The Controller gives the Processor general authorisation to engage sub-processors. The current list is published at getproofanchor.com/subprocessors (Annex 3).
6.2 The Processor will inform the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance, by updating the list and by e-mail to the Account owner or, for Assisted Capture orders, to the e-mail given in the order, or to a privacy contact the Controller notifies to us. The Controller may object on reasonable data protection grounds within this period. If the parties do not find a solution, the Controller may terminate the affected service with effect before the change; prepaid fees for the period after termination will be refunded proportionally.
6.3 The Processor imposes by contract on each sub-processor the same data protection obligations as set out in this DPA, in particular sufficient guarantees under Art. 28(4) GDPR, and remains fully liable to the Controller for the sub-processor's performance.
7. Assistance to the Controller
7.1 Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights. The Service enables the Controller to find, export, revoke and unpublish proofs itself. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not respond to it itself, except to refer the data subject to the Controller.
7.2 The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and prior consultation), taking into account the information available to it.
7.3 Assistance beyond the functions of the Service and the documentation may be charged at reasonable cost, if it is not caused by a breach on the part of the Processor.
8. Personal data breaches
8.1 The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it, and at the latest within 48 hours, by e-mail to the Account owner or, for Assisted Capture orders, to the e-mail given in the order, or to a privacy contact the Controller notifies to us.
8.2 The notification contains, as far as available: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact person. Information that is not yet available will be provided in stages without undue delay.
8.3 The Processor takes the necessary measures to contain the breach and mitigate its consequences and documents it.
9. Deletion and return of data
9.1 During the term of the contract the Controller can download the evidence packages and export the data at any time.
9.2 After the end of the provision of the Service, the Processor will, at the Controller's choice, return the data (by making the export and evidence packages available) and delete it, unless EU or Member State law requires its storage. Deleting the Account owner's Account anonymises the account data and deletes the captured files of proofs in the personal workspace; team workspaces are deleted at the request of their owner.
9.3 Immutability: proofs are immutable evidence records. The hashes, timestamps and entries in the append-only proof log are kept after deletion without the captured content and without any link to the account; the Processor keeps them as controller under Art. 6(1)(f) GDPR, so that evidence packages already issued remain verifiable. The Controller acknowledges that this is an essential property of the Service.
9.4 Data is removed from backups within 30 days at the latest in the regular backup rotation; until then backups are protected and used only for restoration.
10. Information and audits
10.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, primarily in the form of this DPA, its annexes, the security documentation and written answers to reasonable questionnaires.
10.2 If this information is not sufficient, the Controller may carry out an audit or inspection, itself or through an independent auditor bound by confidentiality, after at least 30 days' notice, during normal business hours, at most once a year (unless a breach has occurred or a supervisory authority requires it), and without disproportionate disruption of operations or access to data of other customers. Each party bears its own costs.
11. Transfers to third countries
11.1 The Processor processes the personal data in the European Union (Czech Republic). Transfers to third countries take place only to the extent described in Annex 3, i.e. the AI fallback for cookie banners provided by Anthropic, PBC (USA), on the basis of the standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Modules 2 and 3) incorporated in Anthropic's Data Processing Addendum, which forms part of Anthropic's Commercial Terms of Service for API customers.
11.2 The AI fallback is enabled by default. The Controller excludes the transfer to Anthropic for a capture by choosing "Capture without AI" in the dashboard, or by using the "strict" capture profile via the API, in which the fallback is never used. In both cases nothing is sent to Anthropic, and the PDF report of the proof records whether the fallback was used.
12. Liability and final provisions
12.1 Liability under this DPA is governed by section 16 of the Terms of Service, to the extent permitted by Article 82 GDPR.
12.2 The DPA is governed by Czech law. It remains in effect as long as the Processor processes personal data on behalf of the Controller. Clause 1.4 of the Terms applies to language versions (the English version prevails).
12.3 The Processor may update the DPA if required by law or by changes in the Service; section 22 of the Terms of Service applies, and changes may not reduce the level of protection.
Annex 1: Description of the processing
| Item | Description |
|---|---|
| Data subjects | persons whose data appears in content captured or submitted by the Controller (for example authors of posts, users of social networks, operators and contacts of websites, persons depicted); users of the Controller's workspace to the extent they appear in proof logs |
| Categories of personal data | any data contained in the captured web pages or files: names, user names, photos and videos, texts, contact data, online identifiers, IP addresses of web servers, domain registration data (RDAP/WHOIS); metadata of captures |
| Special categories | not intended; may appear in captured content if the Controller captures it, for which the Controller is responsible |
| Processing operations | loading, recording, storage, hashing, timestamping, packaging, display, publication at the Controller's choice, export, revocation, anonymisation and deletion |
| Location | Czech Republic (EU); exceptions in Annex 3 |
| Storage period | for the term of the contract; after that as in section 9 |
Annex 2: Technical and organisational measures (Art. 32 GDPR)
Confidentiality
- Encrypted connections (TLS) for the website, the application, the browser extension and the stamp server.
- Access to the production systems is limited to the Processor's authorised personnel; administrative access uses individual credentials.
- Passwords stored only as bcrypt hashes; sign-in links (valid 30 minutes, single use), API keys and refresh sessions stored only as hashes; Forensic Browser licence keys stored as hashes and encrypted (Fernet).
- Proofs are private unless the Controller publishes them; public proof pages are marked not to be indexed by default. For Assisted Capture the Processor publishes proofs on the Controller's instruction given in the order.
- Redaction of cookies, authorisation headers and session tokens in network logs and page sources of captures.
Integrity
- Database triggers prevent the modification or deletion of evidence data of proofs and of proof log entries (append-only).
- Hash-chained transparency log of proofs; SHA-256 manifest of all files of each proof; qualified electronic timestamp (RFC 3161) and OpenTimestamps anchoring.
- Independent offline verification with the open-source tool gpa-verify.
Isolation and protection of the capture process
- Server captures run in an isolated Chromium browser; all its network traffic passes through an egress-filtering proxy that blocks access to internal and non-public addresses (protection against SSRF and DNS rebinding).
- Services run under separate unprivileged system accounts with operating-system sandboxing (for example read-only file system, private temporary directories, no new privileges).
- Rate limiting and throttling of sign-in attempts.
Availability and resilience
- Hosting in a data centre in the Czech Republic (Váš Hosting s.r.o.).
- Nightly backups by the hosting provider to separate external servers.
- Monitoring of the services and automatic recovery of pending timestamps and anchors.
Procedures
- Logging of security-relevant events and of the use of the AI fallback in each proof report.
- Minimisation: only hashes are sent to the qualified trust service provider and to the OpenTimestamps calendars; the AI fallback can be switched off per capture ("Capture without AI") and is never used in the "strict" profile.
- Handling of personal data breaches with notification under section 8; regular review of the measures when the Service changes.
Annex 3: Sub-processors
The current list of sub-processors for customer data, including their location and the transfer safeguards, is part of this DPA and is published at getproofanchor.com/subprocessors (section 1 of that page). On the date of this DPA it comprises: Váš Hosting s.r.o. (Czech Republic) – hosting, databases, e-mail server and backups; Stripe Payments Europe, Ltd. (Ireland) – payments for Assisted Capture orders, including the order data; SK ID Solutions AS (Estonia) – qualified timestamps (hashes only); Anthropic, PBC (USA) – AI fallback for cookie banners, enabled by default, can be switched off per capture.