Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service between SourceStream ("Processor," "we," "us") and the Customer ("Controller," "you") who has agreed to the Terms of Service at sourcestream.io.

This DPA applies where SourceStream processes personal data on behalf of the Customer in the course of providing the Service. It reflects the parties' agreement on the processing of personal data in accordance with applicable data protection laws, including the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs).

1. Introduction

SourceStream provides a marketing attribution platform that collects and processes data from visitors to Customer websites. In the course of providing this service, SourceStream processes personal data on behalf of the Customer. This DPA sets out the terms governing that processing.

This DPA is automatically incorporated into the Terms of Service for all Customers. No separate signature is required. By using SourceStream, you accept the terms of this DPA.

2. Definitions

In this DPA, the following terms have the meanings set out below. Terms not defined here have the meaning given in the Terms of Service or applicable data protection law.

• "Controller" means the Customer who determines the purposes and means of processing personal data through the Service.
• "Processor" means SourceStream, which processes personal data on behalf of the Controller.
• "Sub-Processor" means a third party engaged by the Processor to carry out specific processing activities on behalf of the Controller.
• "Data Subject" means an identified or identifiable natural person whose personal data is processed. In the context of SourceStream, this primarily refers to visitors to the Controller's website.
• "Personal Data" means any information relating to a Data Subject that is processed through the Service.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, erasure, and destruction.
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data processed under this DPA.

3. Scope and Purpose of Processing

3.1 Purpose

The Processor shall process personal data only for the following purposes:

• Providing marketing attribution analytics to the Controller.
• Tracking website visitor sessions and attributing them to marketing sources (referrer, UTM parameters, ad click identifiers, landing pages).
• Storing and associating attribution data with a first-party cookie identifier on the Controller's website.
• Populating hidden form fields with attribution data when visitors submit forms on the Controller's website.
• Generating attribution reports and analytics dashboards for the Controller.
• Providing data exports and API access as requested by the Controller.

3.2 Instructions

The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by applicable law. The Controller's instructions are defined by this DPA, the Terms of Service, and the Controller's configuration of the Service (e.g., which websites have tracking scripts installed).

If the Processor believes an instruction from the Controller infringes applicable data protection law, the Processor shall inform the Controller without delay.

3.3 Duration

Processing shall continue for the duration of the Controller's active subscription to the Service. Upon termination of the subscription, processing shall cease and the provisions of Section 13 (Data Return and Deletion) shall apply.

4. Types of Personal Data Processed

The Processor processes the following categories of personal data through the Service:

Data Category	Examples
Cookie identifiers	Randomly generated unique visitor ID (_ss_uid)
Attribution data	Referring URL, UTM parameters (source, medium, campaign, term, content), ad click identifiers (gclid, fbclid, msclkid)
Session data	Pages visited, landing page URL, session timestamps, session duration
Technical data	Browser type, operating system, device type, screen resolution
IP addresses	Used for geolocation and security; may be truncated or anonymized

The Processor does not intentionally process sensitive personal information such as health data, biometric data, or information about criminal convictions.

5. Categories of Data Subjects

The Data Subjects whose personal data is processed under this DPA include:

• Website visitors: individuals who visit the Controller's website(s) where the SourceStream tracking script is installed.
• Form submitters: website visitors who submit a form on the Controller's website, triggering the capture of attribution data alongside their form submission.

6. Obligations of the Controller

The Controller is responsible for:

• Ensuring that there is a valid legal basis for the processing of personal data through SourceStream (e.g., legitimate interest, consent).
• Providing appropriate privacy notices to Data Subjects, including disclosure of the use of SourceStream's tracking script and cookies.
• Obtaining any required consent from Data Subjects for the use of cookies and tracking technologies, in accordance with applicable law.
• Implementing a cookie consent mechanism on their website where required by law.
• Handling Data Subject requests and, where needed, instructing the Processor to assist.
• Ensuring that any instructions given to the Processor comply with applicable data protection law.

7. Obligations of the Processor

The Processor shall:

• Process personal data only on documented instructions from the Controller, as described in Section 3.
• Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organizational security measures as described in Section 10.
• Comply with the conditions for engaging Sub-Processors as set out in Section 8.
• Assist the Controller in fulfilling its obligation to respond to Data Subject requests, as described in Section 9.
• Assist the Controller in ensuring compliance with its obligations regarding data breach notification.
• Delete or return all personal data to the Controller upon termination of the Service, as described in Section 13.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, as described in Section 14.

8. Sub-Processors

8.1 General Authorization

The Controller provides general authorization for the Processor to engage Sub-Processors to assist in providing the Service. The Processor shall ensure that Sub-Processors are bound by data protection obligations no less protective than those in this DPA.

8.2 Current Sub-Processors

The following Sub-Processors are currently engaged:

Sub-Processor	Purpose	Location
Amazon Web Services (AWS)	Cloud infrastructure and data hosting	Australia
Stripe	Payment processing	United States
Postmark / SendGrid	Transactional email delivery	United States

8.3 Changes to Sub-Processors

The Processor shall notify the Controller of any intended changes to Sub-Processors by updating the list on this page and sending an email notification at least 30 days before the new Sub-Processor begins processing personal data.

If the Controller has a reasonable objection to a new Sub-Processor, the Controller may notify the Processor in writing within 14 days of the notification. The parties shall discuss the objection in good faith. If the objection cannot be resolved, the Controller may terminate the affected Service without penalty.

8.4 Sub-Processor Liability

The Processor remains fully liable to the Controller for the performance of its Sub-Processors' obligations under this DPA.

9. Data Subject Rights

The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under applicable data protection law, including:

• Access: providing copies of personal data processed.
• Correction: correcting inaccurate or incomplete data.
• Deletion: deleting personal data upon request.
• Portability: providing data in a structured, machine-readable format.

Upon receiving a request from a Data Subject directly, the Processor shall promptly forward the request to the Controller unless prohibited by law. The Processor shall not respond to Data Subject requests directly unless instructed by the Controller or required by law.

10. Security Measures

The Processor implements the following technical and organizational measures to ensure a level of security appropriate to the risk:

10.1 Technical Measures

• Encryption in transit: All data transmitted between the Data Subject's browser, the Controller's website, and the Processor's servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Databases and storage volumes are encrypted using AES-256 or equivalent.
• Access controls: Role-based access controls limit employee access to personal data to those who need it for their job functions.
• Authentication: Multi-factor authentication is required for access to production systems.
• Network security: Firewalls, intrusion detection systems, and network segmentation protect infrastructure.
• Logging and monitoring: Access to personal data is logged and monitored for unauthorized activity.
• Vulnerability management: Regular security scans and timely patching of known vulnerabilities.
• Backup and recovery: Regular automated backups with tested recovery procedures.

10.2 Organizational Measures

• Confidentiality: All employees and contractors with access to personal data are bound by confidentiality obligations.
• Training: Personnel receive data protection awareness training.
• Incident response: Documented incident response procedures are in place and tested.
• Vendor management: Sub-Processors are evaluated for security practices before engagement and monitored on an ongoing basis.

11. Data Breach Notification

11.1 Notification to Controller

The Processor shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a Data Breach affecting personal data processed under this DPA.

11.2 Notification Content

The notification shall include, to the extent available:

• A description of the nature of the Data Breach, including the categories and approximate number of Data Subjects and personal data records affected.
• The name and contact details of the Processor's point of contact for further information.
• A description of the likely consequences of the Data Breach.
• A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its possible adverse effects.

11.3 Cooperation

The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Data Breach.

12. Data Hosting and Transfers

Personal data processed under this DPA is primarily hosted on servers located in Australia. Where Sub-Processors located outside of Australia are engaged (see Section 8), the Processor ensures that appropriate safeguards are in place, including contractual data protection obligations and the security measures described in Section 10.

13. Data Return and Deletion

13.1 Upon Termination

Upon termination of the Service, the Processor shall:

• Make the Controller's data available for export for a period of 30 days following termination.
• After the 30-day period, delete all personal data from the Processor's active systems, unless retention is required by applicable law.
• Delete personal data from backup systems within 90 days of the deletion from active systems, as backups are rotated.

13.2 Certification

Upon the Controller's written request, the Processor shall provide written confirmation that all personal data has been deleted in accordance with this Section.

14. Audit Rights

14.1 Information and Audit

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller.

14.2 Audit Procedure

Audits shall be subject to the following conditions:

• The Controller shall provide at least 30 days written notice of an audit request.
• Audits shall be conducted during normal business hours and shall not unreasonably disrupt the Processor's operations.
• The Controller shall bear the costs of the audit, unless the audit reveals a material breach of this DPA by the Processor.
• Audit results and any information obtained shall be treated as confidential.
• Audits shall be limited to once per year unless a Data Breach has occurred.

14.3 Certifications and Reports

Where available, the Processor may satisfy audit obligations by providing relevant certifications, audit reports, or other evidence of compliance with security and data protection standards.

15. Liability

Each party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service. Nothing in this DPA limits either party's liability for breaches of data protection law where such limitation would not be permitted under applicable law.

16. Term and Termination

This DPA takes effect when the Controller agrees to the Terms of Service and remains in effect for as long as the Processor processes personal data on behalf of the Controller. The obligations in Sections 10, 11, 13, 14, and 15 shall survive termination of this DPA.

17. Contact

For questions about this DPA or to exercise any rights under it, contact us at:

• Email: [email protected]
• Website: sourcestream.io

For Data Subject requests, please contact the Controller (the website that uses SourceStream) directly. If you need to reach us regarding a specific Controller, email [email protected] and we will assist in routing your request.