Data processing addendum
For sites that need one under GDPR.
Template: have it reviewed before you rely on it.
- Roles. The site owner is the controller; botbar is the processor of visitor data collected by the widget.
- Subject matter. Distinguishing people from automated traffic on the controller's forms.
- Data. Browser characteristics, interaction counts and puzzle interactions as described in the privacy policy; no IP addresses are stored.
- Sub-processors. Cloudflare, Inc. (hosting). Changes are announced 30 days ahead.
- Security. Encryption in transit, single-use encrypted tokens, hashed secrets, least-privilege access.
- Deletion. Event data expires automatically; deleting a site stops collection immediately.