Data processing agreement

Last updated 24 October 2026

This data processing agreement (“DPA”) forms part of the Terms of service between Halfborg Software, a business registered in Singapore (UEN 53254612A) (“Pupop”, “we”), and the customer that accepts them (“Customer”, “you”). It applies whenever we process Customer Personal Data on your behalf, and needs no signature. If you need a countersigned copy for your records, email privacy@pupop.io.

1. Definitions

• Customer Personal Data: personal data about visitors to your websites that we process on your behalf through the service. This includes leads, session IDs and the popup activity linked to them.
• Data Protection Laws: all laws that apply to that processing, including:
  • Singapore's Personal Data Protection Act 2012 (“PDPA”);
  • the EU General Data Protection Regulation (“GDPR”);
  • the UK GDPR and Data Protection Act 2018.
• Controller, processor, data subject, personal data breach and processing have the meanings given in the GDPR. Under the PDPA, “controller” means “organisation” and “processor” means “data intermediary”.
• Other capitalised terms have the meanings given in the Terms.

2. Roles

You are the controller of Customer Personal Data, and we are your processor. You're responsible for:

• having a lawful basis for the processing;
• giving visitors the notices the law requires;
• collecting consent where it's needed;
• making sure your instructions to us are lawful.

3. Instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise; if it does, we'll tell you first where the law allows. Your instructions are:

• the Terms and this DPA;
• how you set up the service in the dashboard, such as your popups, form fields, webhooks and email alerts;
• any other written instructions you give us that are consistent with the Terms.

We'll tell you if we think an instruction breaks Data Protection Laws.

4. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

5. Security

We maintain the technical and organisational measures in Annex 2. They protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. We may update them, as long as the overall level of protection doesn't go down.

6. Subprocessors

• Authorisation. You give us general authorisation to use subprocessors. The current ones are listed on our Subprocessors page.
• Our obligations. We impose data protection terms on each subprocessor that are at least as protective as this DPA, and we remain responsible to you for their performance.
• Notice of changes. We'll update the page and email the owner of each workspace at least 30 days before a new subprocessor starts processing Customer Personal Data.
• Objections. You may object on reasonable data protection grounds within that period. If we can't reasonably meet the objection, you may close your account, and we'll refund any prepaid fees for the unused part of your period.

7. Data subject requests

• Self-service. The service lets you find, export (CSV) and delete individual leads, so you can answer visitors' requests yourself.
• Requests sent to us. If a visitor sends a request to us, we'll pass it to you promptly and won't answer it ourselves unless you ask us to.
• Further help. We'll give you reasonable help with requests the tools don't cover.

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we'll notify you without undue delay, and in any case within 48 hours. The notice will go to your workspace owner's email address and will include what we know about:

• the nature of the breach;
• the data and the number of data subjects affected;
• the likely consequences;
• the steps we've taken or propose to take.

We'll keep you updated as we learn more, and take reasonable steps to contain and fix the breach.

9. Assistance

Taking into account the nature of the processing and the information available to us, we'll give you reasonable help with:

• data protection impact assessments;
• consultations with supervisory authorities;
• your security obligations.

10. Deletion and return

• During the service. You can export and delete Customer Personal Data at any time.
• When your account closes. We delete Customer Personal Data within 30 days. Copies in backups are overwritten within a further 30 days.
• Exception. We may keep data only where the law requires it, and we keep protecting it while we do.

11. Audits

• Information. We'll make available the information reasonably needed to show that we comply with this DPA, including answers to reasonable security questionnaires.
• Audits. If that isn't enough, you may audit our compliance once every 12 months, at your own cost. You must give us 30 days' written notice, carry out the audit during business hours, and keep what you learn confidential.
• Providers. Where an audit concerns a subprocessor, we may rely on that provider's own certifications and reports.

12. International transfers

• Where processing happens. We process Customer Personal Data in Singapore, and through subprocessors in the countries listed on the Subprocessors page.
• Transfers from the EEA or Switzerland to a country without an adequacy decision are governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two: controller to processor). They are incorporated into this DPA by reference, as follows:
  • Annexes 1 and 2 of this DPA complete the SCCs' annexes;
  • the optional clause 7 doesn't apply;
  • clause 9 uses option 2 (general authorisation, with the notice period in section 6);
  • in clause 11, the optional wording doesn't apply;
  • clauses 17 and 18 choose the law and courts of Ireland.
• Transfers from the UK use those clauses together with the UK International Data Transfer Addendum.
• Onward transfers to our subprocessors are covered by equivalent safeguards.

13. Liability and precedence

• Liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the SCCs don't allow it.
• Precedence. If this DPA conflicts with the Terms, this DPA wins. If the SCCs conflict with this DPA, the SCCs win.

Annex 1: Details of processing

• Subject matter and purpose: showing your popups on your websites, recording how visitors interact with them, and collecting, storing and delivering the details visitors submit, so that you can follow up with them.
• Duration: for as long as you use the service, and until deletion under section 10.
• Nature: collection, storage, aggregation, display, export, transmission to destinations you configure (webhooks and email alerts), and deletion.
• Data subjects: visitors to your websites who see or interact with your popups.
• Categories of personal data:
  • Every visitor: a random session ID, the page path, the device type (mobile or desktop), and popup activity (shown, closed, clicked, submitted).
  • Visitors who submit a form: the fields you configure, such as name, email address, phone number and free text, plus whether consent was given and the wording shown.
• Special categories: none. The Terms forbid using Pupop to collect them.
• Frequency: continuous, while your popups are published.
• Retention: as described in section 10 and our Privacy policy.

Annex 2: Security measures

• Encryption: all traffic uses HTTPS, and data is encrypted at rest by our hosting and database providers.
• Hosting: the database and dashboard are hosted in Singapore, with established infrastructure providers.
• Minimisation:
  • visitor IP addresses are used only briefly, for rate limiting, and never stored;
  • no cookies are set on visitors;
  • page paths drop query strings;
  • statistics are kept only as aggregate counts.
• Access control:
  • production access is limited to the people who need it;
  • provider accounts are protected with strong authentication, including multi-factor authentication;
  • customer passwords are hashed.
• Isolation: each customer's data is scoped to their workspace, and every request checks access to it.
• Abuse protection: the endpoints are rate-limited, requests are only accepted from each site's allowed domains, and the forms reject spam submissions.
• Integrity: webhooks are signed with a secret for each site, which the customer can rotate.
• Resilience: the database is backed up by our provider, and queued data is retried if delivery fails.

Annex 3: Subprocessors

See pupop.io/subprocessors.

Contact

Halfborg Software · UEN 53254612A · Singapore · privacy@pupop.io