LEGAL · DATA PROCESSINGThis page explains, in plain language, the different roles TapClicks may have when personal information is processed through the Tap website and the Tap Offering. The Tap Offering is covered by the applicable TapClicks Data Processing Agreement. This page is not a data processing agreement and does not amend any contract.
Section 1: The short version
Our roles depend on the context
TapClicks generally acts as a controller or business for information it uses to run its own website and customer relationship. TapClicks generally acts as a processor or service provider when it handles customer-provided or customer-connected data under the customer’s instructions.
Section 2: Who does what
| Context | Customer role | TapClicks role | What this means |
|---|---|---|---|
| Tap website, demo requests, events, sales, and marketing | Visitor or prospect provides information directly | Controller or business | TapClicks decides how to use the information to respond, operate the site, secure systems, and manage permitted communications. |
| Account, billing, support, and service administration | Customer provides user and business contacts | Controller or business for its own operational records; role may vary for support content | TapClicks uses the information to administer the relationship, provide support, bill, secure accounts, and meet legal obligations. |
| Customer data in the Tap Offering | Controller or business, or a processor acting for its own client | Processor, service provider, or subprocessor | TapClicks processes the data to provide the configured services and follow documented customer instructions. |
| Agency or partner client data | The agency or partner must determine its role and have authority from its client | Processor or subprocessor, as stated in the agreement | The contract chain should allocate instructions, rights requests, security, deletion, and transfer obligations. |
| Security, fraud prevention, and legal compliance | Roles depend on the information and law | Often controller or business for limited operational processing | TapClicks may process information needed to protect the service, comply with law, and establish or defend claims. |
Section 3: Customer responsibilities
Customers decide what data to connect or provide, who may access it, how Tap is configured, and how outputs are used. Customers are responsible for:
- Having a lawful basis and all notices, consents, permissions, and third-party rights needed for the data and connected sources.
- Giving TapClicks lawful, documented instructions through the agreement, configuration, and authorized use of the Tap Offering.
- Assigning appropriate user roles and access, protecting credentials, and reviewing connected-source permissions.
- Responding to individuals whose information the customer controls, with TapClicks’ assistance where required by the DPA.
- Avoiding restricted or sensitive data unless the customer agreement expressly authorizes it and the environment is configured for it.
- Reviewing AI-assisted output and applying appropriate human judgment before using it for decisions or communications.
Section 4: How TapClicks approaches customer data
The applicable customer agreement and DPA control TapClicks’ processing of customer personal data. Subject to those agreements, TapClicks’ data-processing framework is designed around the following practices:
- Process customer personal data only on documented instructions and for the agreed services, except where applicable law requires otherwise.
- Limit access to authorized personnel and providers with appropriate confidentiality obligations and a business need for access.
- Maintain administrative, technical, and organizational safeguards appropriate to the nature of the processing and the risks presented.
- Use subprocessors under written obligations designed to protect customer personal data and remain responsible as stated in the DPA.
- Support customers with privacy-rights requests, security incidents, assessments, and regulatory obligations as required by the DPA and applicable law.
- Delete or return customer personal data at the end of the services as provided in the DPA, subject to documented retention requirements and lawful exceptions.
- Maintain information reasonably necessary to demonstrate compliance and provide audit or assurance materials through the process stated in the DPA.
- Review safeguards, subprocessors, transfer mechanisms, and legal documentation as the services, risks, and applicable requirements change.
Section 5: What the formal DPA covers
The formal DPA is the contract that governs TapClicks’ processing of customer personal data. Depending on the agreement and applicable law, it addresses topics such as:
- The subject matter, duration, nature, and purpose of processing.
- The categories of personal data and data subjects.
- Documented instructions and confidentiality obligations.
- Security measures and security-incident obligations.
- Subprocessors and the process for changes to them.
- Assistance with privacy-rights requests, assessments, and regulatory obligations.
- Deletion or return of data at the end of the services.
- International-transfer safeguards and applicable contractual clauses.
- Audit information and compliance documentation.
Section 6: International data transfers
TapClicks does not rely on the retired EU–U.S. or Swiss–U.S. Privacy Shield frameworks. When customer personal data is transferred across borders, the applicable customer agreement and DPA identify the transfer mechanism and safeguards used for the relevant data flow.
Depending on the locations, roles, and applicable law, those safeguards may include an adequacy decision, the European Commission’s 2021 Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, recognized Swiss adaptations, transfer-risk assessments, and supplementary technical, contractual, or organizational measures. TapClicks will refer to the EU–U.S., UK Extension to the EU–U.S., or Swiss–U.S. Data Privacy Framework only when TapClicks’ participation is current, publicly verifiable, and applicable to the transfer at issue.
The controlled DPA page identifies the current contractual transfer terms and their version. Customers with transfer-specific questions may use the DPA request process or contact legal@tapclicks.com.
Section 7: Request or review the DPA
Use the controlled TapClicks legal page to review the current DPA metadata, obtain the approved DPA, or begin the request and execution process.
FORMAL AGREEMENT
TapClicks Data Processing Agreement
The TapClicks DPA covers the Tap Offering.
Review or request the DPARequest: legal@tapclicks.comQuestions? Email legal@tapclicks.com
The controlled page identifies the DPA title, version, effective date, last reviewed date, publishing entity, the Tap Offering covered, and whether the document supersedes an earlier version. It provides the current approved document and a clear path for questions or execution without relying on an unmanaged file-sharing link.
If you are evaluating Tap or need a DPA for your organization, use the controlled request process, contact your TapClicks representative, or email legal@tapclicks.com. Include your legal company name, work email, country or region, relationship to TapClicks, account name if applicable, the Tap Offering under consideration, contracting entity or order-form contact if known, and any deadline.
The DPA becomes binding only as provided in the DPA itself and the applicable customer agreement. Posting or describing it on this page does not by itself amend an existing agreement.
Section 8: Questions
For privacy or DPA questions, email legal@tapclicks.com. For product or account questions, contact your TapClicks representative or Customer Care at customercare@tapclicks.com.