Last updated: 27 September 2026

1. Roles and scope

Customer is the controller of Customer Personal Data, or a processor acting under another controller’s documented authority. abtestkit acts as Customer’s processor, or subprocessor as appropriate, for the customer-directed functions in Schedule 1. The Terms, this DPA, connection settings and reasonable written instructions are Customer’s documented instructions.

abtestkit is an independent controller for its own account administration, authentication, service security, abuse prevention, product and reliability analysis, support handling and email deliverability suppression. Those purposes are governed by the Privacy Policy, not by Customer’s instructions under this DPA. Detailed visitor experiment rows kept only in Customer’s own WordPress database are outside abtestkit’s hosted processor scope unless Customer deliberately submits them for support.

2. Instructions and customer duties

abtestkit will process Customer Personal Data only on documented instructions, unless applicable law requires otherwise. If law requires other processing, it will inform Customer beforehand unless prohibited. It will tell Customer if, in its opinion, an instruction infringes applicable data-protection law and may pause the affected activity while the parties resolve it.

Customer is responsible for lawful collection and use of visitor data, notices, cookie and browser-storage controls, authority to connect a site, minimisation and local retention. Customer must avoid putting unnecessary personal data, special-category data, payment-card information or children’s information in test names and free-text support fields. If such information is nevertheless received, abtestkit’s applicable duties still apply.

3. Confidentiality and security

abtestkit will restrict access to authorised personnel bound by confidentiality and use appropriate technical and organisational security measures for the risk. The current connected service uses HTTPS, site-scoped credentials, hashed or keyed credential storage, tenant checks, bounded allow-listed payloads, rate limits and limited retry queues. abtestkit will review security as the service changes and require its subprocessors to protect Customer Personal Data to an equivalent contractual standard.

4. Subprocessors and transfers

Customer authorises the providers in Schedule 2 for the stated functions. abtestkit will use written terms that impose the data-protection obligations required for their processing and remains responsible to Customer for subprocessor performance under this DPA. It will give reasonable advance notice by the account email or a durable service notice before adding or replacing a subprocessor that handles Customer Personal Data. Customer may object on reasonable data-protection grounds. The parties will try to resolve an objection; if they cannot, Customer may end the affected connected service and request deletion or return under section 7.

abtestkit will not make a restricted international transfer without a valid adequacy arrangement or appropriate safeguard and any required assessment. If an EU Standard Contractual Clauses instrument or UK IDTA/Addendum is needed, the applicable official instrument and completed annexes must be used; this DPA alone is not a substitute. Information about relevant safeguards can be requested at support@abtestkit.io.

5. Requests and assistance

Taking account of the nature of its processing, abtestkit will reasonably assist Customer with access, correction, deletion, restriction, portability and objection requests that Customer cannot fulfil using its own WordPress and abtestkit account controls. It will also provide reasonable assistance with security, breach notifications, impact assessments and prior consultation as applicable. If a visitor contacts abtestkit about Customer-controlled local data, abtestkit may direct them to Customer unless the law requires another response. Both parties will verify identity before disclosing another person’s data.

6. Personal-data breaches

abtestkit will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. It will provide available information on the nature of the breach, affected information and people, likely effects, containment and remediation, and provide updates as facts become available. Customer decides whether to notify a regulator or individuals for processing it controls. abtestkit remains responsible for its own controller notifications.

7. Return, deletion and recovery copies

On a verified written request, abtestkit will provide a reasonable export of available customer-directed hosted information in a commonly used format, subject to security and the rights of others. Customer can request this during the service term and before deleting its account. On Customer’s instruction or when the connected service ends, abtestkit will delete or return Customer Personal Data unless law requires retention.

Disconnecting a site revokes its connection but does not delete hosted history. Customer can then use **Remove disconnected site** to delete that site’s hosted records, or delete the account to remove all account-owned hosted records. The separate permanent bounce/complaint suppression hash is retained by abtestkit for its own email deliverability purpose, as explained in the Privacy Policy; it is not a customer-directed processor record.

Deleted live records may remain in restricted recovery copies until those copies expire. The hosting provider reports four-hour website/database backups and hourly off-site replication; the operator has been told the UK replica is retained for 12 months. abtestkit will not resume traffic or outbound email from a restored copy until deletion and revocation requests made after that copy was created are reapplied. The precise expiry of separate four-hour backups is governed by the hosting recovery schedule and must be checked against the maximum period disclosed to customers.

8. Information and audits

abtestkit will make reasonably necessary information about its processing, security, subprocessors and retention available to Customer to demonstrate compliance with this DPA. On reasonable notice and subject to confidentiality, service security and other customers’ rights, Customer may request a proportionate audit or independent assurance review. The parties will first use available documents and remote evidence where sufficient, and agree practical arrangements for any further inspection.

9. Order of terms

This DPA prevails over conflicting commercial Terms concerning Customer Personal Data processed on Customer’s behalf. Mandatory law and any applicable official international-transfer clauses prevail where required.

Schedule 1 – processing description

Subject and duration
Customer-directed connected functions while the site or account is connected and during any necessary export, deletion, or recovery period.

Purpose and operations
Receive, validate, store, update, display where applicable, generate selected service notifications from bounded aggregate state, transmit to authorised providers, export, and delete.

ABTestKit’s independent analytics and security purposes are outside this schedule.

People concerned
Customer account administrators; potentially visitors if a very small aggregate can relate to an individual; and anyone named by an administrator in an optional test title or message.

Information
Site origin and label; opaque site and experiment references linked to the account; optional bounded test display name; aggregate impressions, conversions and revenue; test status and warnings; and recipient email or message content for selected notifications.

Automatic connected analytics does not upload detailed visitor rows, order IDs, raw visitor IP addresses or user agents, page content, selectors, or custom code.

Frequency
On connection, at bounded change-triggered or scheduled updates, and when selected email notifications are delivered.

Customer rights
Give lawful instructions, request available export or deletion, object to subprocessor changes, and obtain compliance information under this DPA.

Schedule 2 – authorised providers

Soup Digital Ltd

Function
Managed hosting of abtestkit.io and the connected service/database, including ordinary server logs and recovery infrastructure.

Hosting location
Primary hosting infrastructure is reported to be in Worcestershire, UK.

Cloudflare

Function
Website delivery and security.

Information processed
Ordinary request and security metadata where the configured service handles traffic.

Resend

Function
Delivery of enabled transactional service emails.

Information processed
Recipient address, message content, and delivery, bounce, or complaint information.

Soup Digital may use underlying infrastructure suppliers under its own contractual arrangements. The primary UK hosting location does not mean every provider’s access or onward processing stays in the UK. The current provider configuration and applicable transfer safeguards must be maintained in an operator-held supplier register.

Schedule 3 – retention relevant to this DPA

90-day retention
Raw hosted lifecycle events, connection-code records, notification delivery and outbox records, and webhook replay receipts are pruned daily after 30 days.

Connection links
Connection links expire after 20 minutes.

Account and site records
Latest snapshots, environment and registration state, and bounded journey summaries remain until the associated hosted site history is removed or the account is deleted.

Local connected queue
The local unsent connected queue expires after no more than 30 days or is cleared sooner.

Recovery copies
Recovery-copy retention and restoration controls are described in Section 7 and the Privacy Policy.

Bounce and complaint suppression
The global bounce and complaint suppression hash is an ABTestKit controller record and falls outside the Customer’s processor instructions.