allyWay Data Processing Agreement

Last updated: 13 October 2026 · Version 1.0

1. Parties, subject and precedence

1.1 This Data Processing Agreement ("DPA") is concluded between the customer as controller and BlueCloud Software d.o.o., Ulica Ivana Meštrovića 35, Sesvete, 10040 Zagreb, Croatia, OIB 81263662150 ("BlueCloud") as processor within the meaning of Art. 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1.2 It applies whenever BlueCloud processes personal data on behalf of the customer when providing allyWay (the "Service") under the allyWay Terms of Service ("Terms"). It forms part of the Terms and is accepted together with them.

1.3 Where an agency uses the Service for its clients, the agency acts towards BlueCloud as controller or as processor of its client. In the latter case BlueCloud is a subprocessor; the agency ensures that its contract with the client allows this.

1.4 In case of conflict, this DPA prevails over the Terms in matters of data protection. Terms defined in the GDPR have the same meaning here.

2. Scope of processing

2.1 Purpose. BlueCloud processes personal data only to provide, secure, support and improve the Service as described in the Terms: delivering the widget to website visitors, scanning and analysing the customer's web pages, applying and showing Changes, generating AI output, providing the dashboard, reports and notifications.

2.2 Categories of data and data subjects:

Data subjects	Types of personal data	Purpose
Visitors of Customer Websites	IP address (in server logs, deleted after at most 14 days), browser and device data, widget settings chosen by the visitor (e.g. text size, contrast), technical error data	Deliver and run the widget, remember visitor settings, security, error analysis
Persons named on Customer Websites	Personal data contained in page content, images or alt texts that the scanner or AI reads (e.g. names, photos of people)	Scanning, accessibility analysis, AI descriptions
Users of the customer (account users)	Name, email, role, login data (including Google sign-in), activity in the dashboard (approvals, changes)	Account, dashboard, support, audit trail

2.3 BlueCloud does not knowingly process special categories of personal data (Art. 9 GDPR). The customer must not use the Service to process such data beyond what is unavoidably contained in its public web pages.

2.4 Processing for BlueCloud's own purposes as controller is not covered by this DPA but by our Privacy Policy. This includes billing via Stripe, the customer relationship, and analytics and marketing on our own website allyway.ai (e.g. Google Analytics, Google Tag Manager, Google Search Console, Microsoft Clarity, advertising pixels). These tools are not part of the widget on Customer Websites.

3. Duration

This DPA applies for as long as BlueCloud processes personal data on behalf of the customer, i.e. for the term of the Terms and until deletion or return under section 10.

4. Instructions and obligations of BlueCloud

4.1 BlueCloud processes personal data only on documented instructions of the customer, unless required by EU or Member State law. The Terms, this DPA and the customer's settings and approvals in the dashboard are the customer's complete instructions. Further instructions must be in writing and compatible with the Service; additional effort may be charged.

4.2 BlueCloud informs the customer without delay if it believes an instruction infringes data protection law, and may suspend that instruction until it is confirmed or changed.

4.3 BlueCloud ensures that persons authorised to process personal data are bound to confidentiality.

4.4 BlueCloud implements the technical and organisational measures in Annex 1 (Art. 32 GDPR). It may adapt them to technical progress, provided the level of protection is not reduced.

4.5 BlueCloud supports the customer, taking into account the nature of processing and the information available, with its obligations under Art. 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Support beyond what the Service provides may be charged at reasonable rates.

4.6 The customer is responsible for the lawfulness of the processing, in particular for having a legal basis, informing website visitors (e.g. in its privacy policy) and, where required, obtaining consent (Terms, 13.2).

5. Subprocessors

5.1 The customer gives general authorisation to engage subprocessors. The subprocessors engaged at the time of this DPA are listed in Annex 2 and at allyway.ai/subprocessors.

5.2 BlueCloud informs the customer at least 30 days before adding or replacing a subprocessor, by email or in the dashboard. The customer may object in writing within this period for reasonable data protection reasons. If no solution is found, either party may terminate the affected part of the Service at the time of the change; fees already paid for the remaining period are refunded pro rata.

5.3 In urgent cases (e.g. a provider failure or a security incident) BlueCloud may engage a replacement immediately and informs the customer without delay.

5.4 BlueCloud imposes on each subprocessor data protection obligations that offer at least the same level of protection as this DPA, and remains responsible to the customer for its subprocessors under Art. 28(4) GDPR.

6. Transfers outside the EU/EEA

6.1 BlueCloud hosts the Service and stores personal data in the European Union.

6.2 Where a subprocessor processes personal data in a third country, BlueCloud ensures that the transfer complies with Chapter V GDPR – in particular through an adequacy decision (including the EU–U.S. Data Privacy Framework for certified recipients) or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with additional safeguards where necessary.

6.3 Annex 2 states for each subprocessor where data is processed and which transfer mechanism applies.

7. Personal data breaches

7.1 BlueCloud notifies the customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the customer's data, to the email address stored in the account.

7.2 The notification contains, as far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact person. Information may be provided in stages.

7.3 BlueCloud takes reasonable steps to contain the breach and limit its effects. A notification is not an admission of fault or liability.

8. Data subject rights and assistance

8.1 Taking into account the nature of the processing, BlueCloud supports the customer with appropriate technical and organisational measures in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection).

8.2 If a data subject contacts BlueCloud directly about processing on behalf of the customer, BlueCloud refers the person to the customer and does not respond itself, unless legally required.

8.3 Visitors can reset their widget settings themselves at any time in the widget; settings are stored locally in the visitor's browser where technically possible.

9. Audits and information

9.1 BlueCloud makes available to the customer the information necessary to demonstrate compliance with Art. 28 GDPR, primarily through this DPA, Annex 1, Annex 2 and, where available, certifications or audit reports of BlueCloud or its subprocessors.

9.2 If this information is not sufficient, the customer may carry out an audit, at most once per year, with at least 30 days' written notice, during normal business hours, without disrupting operations and subject to confidentiality. The customer may use an independent auditor who is not a competitor of BlueCloud.

9.3 Each party bears its own costs. BlueCloud may charge reasonable costs for audits that require more than one working day of its staff. Audits required by a supervisory authority are always possible.

10. Deletion and return

10.1 After the end of the Terms, the customer can export its data for 30 days. BlueCloud then deletes the personal data processed on behalf of the customer, unless EU or Member State law requires storage.

10.2 Backups are overwritten in the normal backup cycle of our hosting providers, at the latest after 30 days. Until then they remain protected under this DPA and are not used.

10.3 On request, BlueCloud confirms the deletion in text form.

11. Liability and final provisions

11.1 Liability between the parties under this DPA is governed by the limitation of liability in the Terms (section 8), to the extent permitted by Art. 82 GDPR. Liability towards data subjects under Art. 82 GDPR remains unaffected.

11.2 Each party is liable for fines imposed on it by a supervisory authority for its own breaches. The customer indemnifies BlueCloud against claims arising from unlawful instructions or from processing without a valid legal basis on the customer's side.

11.3 BlueCloud may update this DPA where required by law or by changes to the Service, provided the level of protection is not reduced. Section 14.1 of the Terms applies to notice and objection.

11.4 This DPA is governed by the laws of the Republic of Croatia. Place of jurisdiction is Zagreb, Croatia, as in the Terms. If a provision is invalid, the rest remains valid.

11.5 Contact for data protection matters: legal@allyway.ai

Annex 1 – Technical and organisational measures

Area	Measures
Hosting and physical security	Servers at Hetzner Online GmbH in Germany, in ISO/IEC 27001 certified data centres; database and authentication at Supabase in an EU region
Access control (systems)	Personal accounts, strong passwords and two-factor authentication for admin access; SSH keys only; access on a need-to-know basis; access removed when no longer needed
Encryption	TLS for all connections (HTTPS); database encrypted at rest; passwords stored only as salted hashes
Separation	Customer data logically separated by account and website; separate staging and production environments
Integrity and logging	Logging of admin access and relevant changes; audit trail of approvals and Changes in the dashboard
Availability and resilience	Automatic daily backups (Hetzner Cloud, Supabase); monitoring and error tracking (Sentry, EU region); firewalls and rate limits against attacks
Data minimisation	Server logs with IP addresses deleted after at most 14 days; error reports with as little personal data as possible; widget settings stored in the visitor's browser where possible; no tracking or profiling of website visitors
AI and scanning	AI features use the OpenAI API, which does not use API data to train models; accessibility checks use the open-source library axe-core, which runs within the Service and sends no data to third parties
Organisation	Confidentiality obligations for staff and contractors; data protection training; incident response process; review of subprocessors before engagement
Development	Code review, automated tests, separate test data; security updates applied regularly

Annex 2 – Subprocessors

Subprocessor	Purpose	Location of processing	Transfer mechanism
Hetzner Online GmbH, Gunzenhausen, Germany	Hosting of the Service (servers, backups)	EU (Germany)	not required (EU)
Supabase, Inc., USA	Database, authentication, file storage	EU region	Standard Contractual Clauses for any access from outside the EU
Functional Software, Inc. (Sentry), USA	Error monitoring	EU region (Germany)	Standard Contractual Clauses for any access from outside the EU
OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.)	AI features (image descriptions, link names, suggestions)	USA	Standard Contractual Clauses

Not listed, because they do not process data on behalf of the customer: Stripe (payments, independent controller), Google (sign-in, independent controller), the analytics and marketing tools on allyway.ai (see 2.4) and axe-core (open-source software without data transfer).