# Data Processing Addendum (DPA) — TEMPLATE

> **Template — not yet reviewed by a lawyer.** Version 2026-10-07. For TesterAgent Business customers who need a written
> controller–processor agreement. Fill in the bracketed fields, sign and send a copy to [[OWNER: privacy email]].

This Data Processing Addendum ("DPA") forms part of the agreement between:

- **Customer** (the "Controller"): [customer legal name, address, contact], and
- **TesterAgent** (the "Processor"), operated by [[OWNER: your full legal name (LEGAL_OPERATOR_NAME)]], Vientiane, Laos, https://lononla.com

and applies to the TesterAgent Terms of Service (https://lononla.com/terms).

## 1. Roles and scope
1.1 The Customer is the controller of personal data contained in the websites and apps it asks TesterAgent to test ("Customer Personal Data"),
for example names, email addresses, order details or other content visible on tested pages and app screens, including logged-in areas.
1.2 TesterAgent processes Customer Personal Data only as a processor, to provide the service: automated checks of the Customer's websites and
Android apps, screenshots and reports. TesterAgent is an independent controller of the Customer's own account and billing data (see https://lononla.com/privacy).

## 2. Details of the processing
- **Subject matter / nature:** opening the Customer's pages in an automated browser and its apps on a test phone, capturing screenshots, analysing them with rule-based checks, producing reports.
- **Duration:** while the Customer uses the service, plus the retention periods in https://lononla.com/data-retention.
- **Data subjects:** users, customers and staff of the Customer whose data appears on tested pages or app screens.
- **Categories of data:** whatever the tested pages show (e.g. names, contact details, account and order data). The service is not designed for special categories of data; the Customer should test with test accounts and test data.
- **Never processed:** passwords and one-time codes the Customer types in the live login view (they go straight to the test browser and are not recorded).

## 3. Processor obligations
3.1 Process Customer Personal Data only on the Customer's documented instructions — the settings it chooses in the service are such instructions.
3.2 Ensure that anyone with access is bound by confidentiality.
3.3 Apply the technical and organisational measures described in https://lononla.com/security (encryption in transit, hashed passwords and session tokens, sandboxed reports, random screenshot addresses, private-network blocking, deletion schedules).
3.4 Use only the sub-processors listed at https://lononla.com/subprocessors; announce new sub-processors on that page and by email to Business customers at least 14 days in advance; the Customer may object on reasonable grounds and terminate if no solution is found.
3.5 Assist the Customer, taking into account the nature of the processing, with data-subject requests and with security, breach and impact-assessment obligations.
3.6 Notify the Customer without undue delay (target: within 72 hours) after becoming aware of a personal-data breach affecting Customer Personal Data.
3.7 Delete Customer Personal Data on the schedule in https://lononla.com/data-retention, and all of it when the Customer deletes its account (Account → Delete my account), except backups, which expire on their own schedule ([[OWNER: Atlas backup retention, e.g. daily snapshots kept 7 days (BACKUP_RETENTION)]]).
3.8 Make available the information reasonably necessary to demonstrate compliance with this DPA, by written answers and documentation, at most once a year unless a supervisory authority requires more.

## 4. International transfers
Customer Personal Data may be processed in the countries listed for each sub-processor. Where the law requires it, transfers rely on the
sub-processors' own data processing terms, including Standard Contractual Clauses where they offer them. [[OWNER: confirm you accepted the DPA of each provider]]

## 5. Customer obligations
The Customer confirms it is authorised to have the websites and apps tested, that it has a lawful basis for the processing, and that it
uses staging environments and test accounts where possible (see https://lononla.com/acceptable-use).

## 6. Liability, term, law
Liability follows the Terms of Service. This DPA lasts as long as the Customer uses the service. Governing law: [[OWNER: governing law — the laws of the Lao PDR? (LEGAL_GOVERNING_LAW)]].

## Sub-processors at the date of this template

| Sub-processor | Purpose | Location |
|---|---|---|
| MongoDB Atlas (MongoDB, Inc., USA) | Database: accounts, sites, reports, billing status | [[OWNER: MongoDB Atlas cloud + region (DATABASE_LOCATION)]] |
| Cloudinary (Cloudinary Inc., USA) | Storing and serving report screenshots | USA (AWS / Google Cloud; CDN worldwide) |
| Lemon Squeezy (Sold through Link, LLC, f/k/a Lemon Squeezy LLC, USA) | Merchant of Record: checkout, payments, invoices, tax, refunds — an independent controller of your payment data | USA |
| [[OWNER: email (SMTP) provider (EMAIL_PROVIDER)]] | Sending account emails (confirmation, password reset, audit ready, login needed) | [[OWNER: email provider location (EMAIL_PROVIDER_LOCATION)]] |
| [[OWNER: VPS hosting provider (HOSTING_PROVIDER)]] | Server (VPS) running the website, the test browsers and the Android test phone | [[OWNER: VPS data-centre country (HOSTING_LOCATION)]] |
| Cloudflare (Cloudflare, Inc., USA) | DNS, CDN, TLS and attack protection in front of our website | Worldwide network |
| static.cloudflareinsights.com, Google Analytics (analytics) | Visitor statistics on public pages, only after you accept | [[OWNER: analytics provider location]] |

---
Customer: name ______________________ signature ______________________ date __________

TesterAgent: name ______________________ signature ______________________ date __________