Template. This agreement under Art. 28 GDPR applies between you as a customer (“controller”) and Xiamen Miaoerduo Trading Co., Ltd. (厦门妙尔多商贸有限公司), Room 907, No. 221 Jiahe Road, Siming District, Xiamen, Fujian, China (see the imprint; “processor”) when you use Allyfolio. It becomes part of the contract when you accept the Terms of Service. If you need a signed copy, email hello@allyfolio.com.
1. Subject, duration and nature of processing
The processor scans web pages that the controller has verified, stores the results and creates reports for the controller. Processing lasts as long as the contract, plus the retention periods below.
2. Types of data and data subjects
- Personal data that happens to be published on the scanned pages (for example names, email addresses or photos of employees or other people) and appears in HTML snippets, screenshots or page titles stored with scan results.
- Email addresses and names of team members invited by the controller.
3. Instructions
The processor processes the data only on documented instructions from the controller – the configuration of sites, scans, reports and team in the dashboard – unless EU or member state law requires otherwise.
4. Confidentiality
Everyone with access to the data is bound to confidentiality.
5. Security (Art. 32 GDPR)
- Hosting in the EU (Hetzner, Germany/Finland); encrypted connections (TLS) for all access.
- Access to the dashboard only after login; passwords stored as salted hashes; sessions can be ended; reset links are single use and expire after 60 minutes.
- Strict separation of customers' data by team; ownership verification before site scans.
- Scanner isolated from internal networks by an egress proxy that only allows public addresses.
- Daily backups with limited retention; tamper-evident, hash-chained scan history.
6. Sub-processors
The controller agrees to the following sub-processors: Hetzner Online GmbH (hosting, Germany); Resend (transactional email, EU region); Cloudflare, Inc. (DNS and inbound email). The processor informs the controller of intended changes at least 30 days in advance by email; the controller may object for important reasons and terminate.
7. Assistance
The processor helps the controller to answer data subject requests and to meet its obligations under Art. 32–36 GDPR, as far as the nature of the processing allows. Data can be exported from the dashboard at any time.
8. Personal data breaches
The processor notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the controller's data.
9. Deletion and return
At the end of the contract, or when the controller deletes a site or the account, the processor deletes the data. Backups are overwritten within 30 days. Before deletion, the controller can export the data.
10. Audits
The processor makes available the information needed to show that the obligations under Art. 28 GDPR are met and allows reasonable audits, normally by providing written information, with at least 30 days' notice.