Informacje prawne
Umowa o przetwarzaniu danych (DPA)
Ostatnia aktualizacja: 01.10.2026
This document is provided in English. The original is in Ukrainian; in case of any discrepancy between the language versions, the Ukrainian version prevails.
Contents
1. Introduction
1.1. This Data Processing Agreement (the “DPA”) is an annex to the Public Offer and governs the processing of personal data carried out by Individual Entrepreneur Andrii Vasylovych Vdovyn (the “Processor”) on behalf of the Customer (the “Controller”) when providing the Autofix service.
1.2. This DPA applies solely to the Autofix service, in which the browser of a visitor to the Customer's Website requests a fixes file from the Processor's server.
1.3. This DPA does not apply to the Accessibility Panel and Audit services, because:
- the Panel runs in the browser (client-side) and does not transfer data to the Processor’s servers
- the Audit scans only publicly accessible pages (in the same way as search engine bots)
2. Definitions
- Personal data — any information relating to an identified or identifiable natural person.
- Processing — any operation performed on personal data.
- Controller — the Customer, who determines the purposes and means of processing the personal data of visitors to its Website.
- Processor — InclusiveWeb (Individual Entrepreneur A.V. Vdovyn), which processes data on behalf of the Controller.
- Sub-processor — a third party engaged by the Processor to process data.
3. Subject matter of processing
3.1. What is processed
When providing the Autofix service, the Processor’s server receives and processes:
- Requests from the visitor’s browser to the Processor’s server for the fixes file (IP address, User-Agent, Website identifier)
- Fix rules generated from the results of the Audit of the Customer’s Website
3.2. What is NOT processed
- POST requests (forms, authentication, checkout, payment)
- API calls
- Visitors’ cookies (they are not read, modified or stored)
- Authorization headers (Authorization, Cookie)
- Static resources (CSS, JS, images, fonts, PDF) — they are delivered directly
- Requests to admin panels (/wp-admin, /admin)
3.3. Nature of processing
- Browser-side processing — fixes are applied to the page in the visitor’s browser. The Processor does not receive or process the HTML of the Customer’s Website.
- Transit processing — the Processor serves the fixes file to the browser. The Website’s HTTP traffic does not pass through the Processor’s servers, and page content is neither received nor stored.
- Purpose of processing — solely to apply accessibility fixes approved by the Customer based on the Audit results.
4. Categories of data and data subjects
4.1. Categories of personal data
| Data | Processed | Stored |
|---|---|---|
| Visitors’ IP addresses | In the fixes file request | No |
| Visitors’ User-Agent | In the fixes file request | No |
| URLs of visited pages | Not transferred to the Processor | No |
| Page content | Not processed | No |
| Cookies | Not processed | No |
| Form data | Not processed | No |
*URL hashes (not the URLs themselves) are stored to detect changes on pages.
4.2. Data subjects
Visitors to the Customer’s Website whose browser loads the fixes file from the Processor’s server.
5. Processor obligations
The Processor undertakes to:
- 5.1. Process data solely to provide the Autofix service and in accordance with the Controller’s instructions.
- 5.2. Not store page content or visitors’ personal data.
5.3. Implement technical and organisational security measures:
- Encryption in transit (HTTPS/TLS)
- Restricted access to infrastructure
- Browser-side processing — page content is not transferred
- Fail-open principle (on error, the original page is shown)
- 5.4. Notify the Controller without delay of any security incident affecting the data.
- 5.5. Delete all fix rules and the Website configuration within 30 days after the service ends.
- 5.6. Provide the Controller with the information necessary to demonstrate compliance.
6. Sub-processors
6.1. List of sub-processors
| Sub-processor | Role | Jurisdiction | Data |
|---|---|---|---|
| Cloudflare, Inc. | CDN for delivering scripts and fixes files | USA / Global | Delivery of scripts and fixes files |
| OpenAI | AI generation of alt text | USA | URLs of public images, page context |
Payment providers are not sub-processors under this DPA, as they do not process data of visitors to the Customer's Website. They process the Customer's own payment data as described in Section 7 of the Privacy Policy: JSC Universal Bank (monobank) — processing of payments in UAH; Creem (creem.io) — processing of USD payments, taxes and refunds as the Merchant of Record.
6.2. Changes to sub-processors
The Processor will notify the Controller of any change of sub-processors 30 days before it takes effect. The Controller may object within 14 days.
7. Data subject rights
7.1. Since the Processor does not store visitors’ personal data, data subject requests (access, erasure, restriction) are addressed to the Controller.
7.2. The Processor will assist the Controller in fulfilling such requests within its technical capabilities.
8. Security incidents
8.1. The Processor will notify the Controller of a security incident within 72 hours of becoming aware of it.
8.2. The notification will include:
- The nature of the incident
- The categories and volume of data
- The measures taken
9. Term
9.1. This DPA remains in effect for the entire term of the Autofix service.
9.2. After the service ends, the Processor deletes all configuration data within 30 days.
10. Governing law
This DPA is governed by the laws of Ukraine, in particular the Law of Ukraine “On Personal Data Protection”.
Have questions? Contact us