Legal
Data Processing Addendum
Last updated 1 June 2026
This addendum forms part of the Terms of Service and applies automatically whenever you process personal data through Tap Next. No signature required — though we will counter-sign a copy on request.
1. Roles of the parties
You are the controller and Tap Next, Inc. is the processor of personal data contained in funnel responses (“Customer Personal Data”). Where you are yourself a processor for your own client, we act as sub-processor and the same terms apply down the chain.
We process Customer Personal Data only on your documented instructions, which comprise these terms, the platform configuration you choose, and any lawful written instruction you give us afterwards. If we believe an instruction breaches data protection law, we will tell you and may pause that processing.
2. Subject matter and duration
| Item | Detail |
|---|---|
| Subject matter | Provision of the Tap Next interactive funnel platform |
| Duration | The term of the subscription, plus the 30-day retrieval window |
| Nature and purpose | Collecting, storing, structuring, analysing and transmitting funnel responses on the controller’s behalf |
| Types of personal data | Identifiers (name, email, phone where collected), response content, approximate location, device and browser data, timestamps |
| Categories of data subject | The controller’s prospects, customers, event guests, survey respondents and website visitors |
| Special categories | Not permitted without a prior written agreement and additional safeguards |
3. Our obligations
- Confidentiality — everyone with access is bound by a written confidentiality obligation that survives their employment.
- Security — we implement the technical and organisational measures described on our Security page, which satisfy Article 32.
- Assistance — we help you respond to data subject requests, and with DPIAs and prior consultations, taking into account the nature of processing and the information available to us.
- Breach notification — without undue delay and within 72 hours of becoming aware, with the detail needed for you to meet your own obligations.
- Deletion — on termination we delete or return Customer Personal Data at your choice, except where law requires retention. Backups age out on a 35-day cycle.
- Audit — we make available the information needed to demonstrate compliance, including our SOC 2 report, and will accept one on-site audit per year with 30 days’ notice, at your cost.
4. Your obligations
You warrant that you have a lawful basis for the processing you instruct, that you have given data subjects the notices required by Articles 13 and 14, and that your funnels do not collect special-category or children’s data unless we have agreed it in writing. You are responsible for the accuracy of the data you collect and for configuring retention appropriately.
5. Sub-processors
You give general authorisation for the sub-processors below. We give at least 30 days’ notice before adding or replacing one; you may object on reasonable data protection grounds, and if we cannot resolve it you may terminate the affected service without penalty.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Primary hosting and storage | EU (Frankfurt) / US (Oregon) |
| Cloudflare | CDN, DNS and DDoS mitigation | Global edge |
| Stripe | Payment processing (billing data only) | US / EU |
| Postmark | Transactional email delivery | US |
| Twilio | SMS notifications, where enabled | US / EU |
| Zendesk | Customer support ticketing | EU |
Each is bound by a written contract imposing data protection obligations no less protective than these. We remain fully liable to you for their performance.
6. International transfers
Where Customer Personal Data leaves the EEA, UK or Switzerland to a country without an adequacy decision, the transfer is governed by the European Commission’s Standard Contractual Clauses (Decision 2021/914), incorporated here by reference:
- Module Two (controller to processor) where you are a controller;
- Module Three (processor to sub-processor) where you are a processor;
- Clause 7 docking is permitted; Clause 9 uses Option 2, general written authorisation, with the 30-day notice above;
- Clause 17 selects the law of Ireland; Clause 18(b) selects the courts of Ireland;
- The UK International Data Transfer Addendum applies to UK transfers, and the Swiss FADP amendments to Swiss transfers.
Annexes I, II and III of the SCCs are populated by sections 2, 3 and 5 of this addendum respectively. We carry out transfer impact assessments and apply supplementary measures including encryption, access logging and a policy of challenging over-broad government requests.
7. Liability and precedence
Liability under this addendum is subject to the limitations in the Terms of Service. Where this addendum conflicts with the Terms, this addendum prevails on data protection matters. Where it conflicts with the SCCs, the SCCs prevail.
8. How to reach us
Questions about this document go to dpo@tap-next.co, or by post to either entity below. We answer legal and privacy mail within five business days.
| Entity | Role | Address |
|---|---|---|
| Tap Next, Inc. | Contracting entity | 1 Sansome Street, Suite 3500, San Francisco, CA 94104, United States |
| Tap Next Europe B.V. | EU/UK representative (Art. 27 GDPR) | Herengracht 124, 1015 BT Amsterdam, Netherlands |