Data Processing Addendum
Version 1.2 · Effective 5 September 2026
This Addendum forms part of the Terms of Service between you ("Customer") and N888 LIMITED trading as Capitis ("Capitis", "we"). It applies automatically from the moment you send us personal data — you do not need to sign or request it. If your procurement process needs a countersigned copy, email legal@capitis.app and we will sign this text unchanged.
"Data Protection Law" means the UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, the EU GDPR (Regulation 2016/679), and any other data protection or privacy law applicable to a party. The terms controller, processor, data subject, personal data, processing and personal data breach carry their meanings under that law.
1. Who is responsible for what
You are the controller. We are your processor. For the personal data you send us about your end-users — identifiers, clicks, conversions — you decide why and how it is processed. We act only on your instructions. You are responsible for having a lawful basis, for serving privacy notices to your users, and for obtaining consent where consent is what your market requires.
We are a controller for our own account data. Your name, email, sign-in records, API usage logs and billing records are ours to control. That processing is described in the Privacy Policy and is not covered by this Addendum.
The affiliate networks are independent controllers. When a shopper clicks a Capitis tracking link, the click passes to the affiliate network behind that merchant (Awin, Admitad, Rakuten and so on) carrying the tracking reference the network requires. The network processes that click under its own privacy policy, for its own purposes, as an independent controller — not as our subprocessor and not as yours. Neither we nor you control what the network does with it. Your privacy notice must tell your users that this onward disclosure happens. See §8.
2. Your instructions
We process personal data only on your documented instructions. Your instructions are: this Addendum, the Terms of Service, the documented behaviour of the API and dashboard, and any further written instruction we accept.
We will tell you if, in our opinion, an instruction breaches Data Protection Law. We may refuse an instruction that would, and we may suspend processing until it is resolved.
We will not sell your end-users' personal data, and we will not use it to train machine learning models, for advertising of our own, or for any purpose other than providing the Services to you.
3. Confidentiality and people
Everyone we authorise to process your data is bound by a written duty of confidentiality that survives the end of their engagement. Access is granted on a need-to-know basis and removed when the need ends.
4. Security
We implement the technical and organisational measures described in Annex II and set out in full on the Security page, which is incorporated into this Addendum. We may change specific measures as technology moves, but not in a way that materially reduces overall protection.
5. Subprocessors
You give us general written authorisation to appoint subprocessors. Our current subprocessors, what each one does and where it is located, are published at capitis.app/legal/subprocessors.
Before we add or replace a subprocessor we will give you at least 30 days' notice by email and by updating that page. If you have a reasonable, data-protection-based objection, tell us within those 30 days and we will work with you to find an alternative. If we cannot, you may terminate the affected Services without penalty and receive a pro-rata refund of any prepaid fees.
We impose data protection obligations on every subprocessor that are no less protective than those in this Addendum, and we remain fully liable to you for their performance.
6. Helping you meet your obligations
Data subject rights. If one of your end-users contacts us directly with a rights request, we will not respond substantively — we will pass it to you without undue delay, because you are the controller and the request is yours to answer. We do not rest that on being unable to identify the person. Email addresses, telephone numbers and wallet addresses reach us in raw form and we hash them ourselves, and the hashing is deterministic, so a value the data subject gives us can usually be turned back into the fingerprint we hold and matched to their records. What we do not hold is a name, an address or any contact detail of our own, nor any way of confirming that whoever writes to us is the person the record belongs to. We will give you reasonable technical assistance to answer requests yourself: your end-user, identifier, click and conversion records can be read back through the API and the dashboard at any time. Individual identifiers can be revoked immediately through the dashboard or the API, which stops them being used for matching; erasing the stored value itself is a manual step, carried out under §10.
Assessments and consultation. We will give you reasonable assistance with data protection impact assessments, prior consultation with a regulator, and security-incident obligations, taking into account the nature of the processing and the information available to us.
Complaints. The Data (Use and Access) Act 2025 requires controllers to make it easy for individuals to complain and to respond to them. Where a complaint concerns processing we carry out for you, we will support your response.
7. Personal data breaches
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours of becoming aware. The notification will describe what happened, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed. Where we cannot provide all of it at once, we will provide it in stages without further undue delay.
We will not notify a regulator or your data subjects on your behalf unless you instruct us to, or the law requires us to.
Security contact: security@capitis.app.
8. International transfers
Where your data sits. All Capitis production infrastructure — application servers, the primary database, the cache — is hosted in the United Kingdom (Manchester). We do not replicate end-user personal data — identifiers, clicks and conversions — outside the UK. The limited Customer contact data that is processed outside the UK, and the safeguard covering each transfer, is set out at capitis.app/legal/subprocessors.
Sending data to us from the EEA. On 19 December 2025 the European Commission renewed its adequacy decisions for the United Kingdom, valid until 27 December 2031. Transfers from the EEA to Capitis therefore rely on that adequacy decision and need no additional safeguard. If the adequacy decision is revoked, suspended or allowed to lapse, the parties will from that date be deemed to have entered into the EU Standard Contractual Clauses, Module Two (controller to processor), Commission Implementing Decision (EU) 2021/914, with the annexes below completed by Annexes I–III of this Addendum, the optional docking clause included, clause 11(a) redress option not selected, clause 17 governed by Irish law and clause 18(b) naming the courts of Ireland.
Sending data to us from the UK. Domestic; no transfer safeguard needed.
Onward transfers from us. Some subprocessors are outside the UK. Each transfer is covered by the UK International Data Transfer Addendum (version B1.0) to the EU Standard Contractual Clauses, or by the provider's own approved mechanism where one applies. The mechanism used for each subprocessor is stated on the subprocessors page.
Affiliate networks. The onward disclosure of click data to affiliate networks described in §1 is a controller-to-controller disclosure made on your instruction, not a processor transfer. The network determines its own transfer mechanism. You are responsible for making the disclosure lawful at your end — that is the whole point of the privacy-notice requirement in the Publisher Policy.
9. Audit
We will make available all information reasonably necessary to demonstrate compliance with this Addendum, including our security documentation and a completed security questionnaire, on request and no more than once a year.
You may audit us in person, or through an independent auditor who is not our competitor and who signs a confidentiality agreement, on 30 days' written notice, no more than once in any twelve months, during business hours, and without unreasonably disrupting our operations. You bear the cost. The once-a-year limit does not apply after a personal data breach affecting your data, or where a regulator requires an audit.
10. Deletion and return
On termination or expiry, and at your choice, we will delete or return your end-users' personal data. Unless you tell us otherwise within 30 days of termination, we will delete it within 30 days of that period ending and confirm deletion in writing on request.
How that is actually done. Closing your account from Team & settings, or through
POST /v1/account/closure, records the date and starts the 30 days. A scheduled job runs daily
and erases the data of every account whose 30 days have passed. No person has to remember, and no
request to us is needed: deletion is the default and happens on its own.
Deletion is the default; return is the choice you make instead. Choose "give me a copy first"
when you close the account, or set disposition to return on that request, and the data is made
available to download before it goes. You can also take a copy at any time while the account is
open — from the same screen, or GET /v1/account/export — without telling us first.
What "return" can contain. Email addresses and phone numbers are returned as fingerprints, not as addresses. Capitis never stores the original: it is hashed the moment it arrives and only the fingerprint is written, which is described in Annex II and on the Security page. A return therefore gives you back everything we hold, which is less than what you sent us.
You can change your mind inside the 30 days. Reopening the account before the deadline cancels the erasure entirely. After the deadline the data is either due to go or already gone, and the account cannot be reopened.
Every step — the request, a cancellation, and the erasure itself with its row counts — is written to your audit log, which is what lets us confirm a deletion to you in writing.
What is kept regardless. Click and conversion records are the commission audit trail, and a network can reverse or confirm a conversion long after the click, so we keep them after termination for as long as commission may still be restated or paid — as Terms §11 states and Annex I records. The IP address and user agent on a click are erased 90 days after the click in any event.
We may keep data where the law requires, and we keep aggregated, statistical data that cannot be attributed to any individual. Backups roll off on their own cycle, described on the Security page; data in backups is not restored into production after a deletion request.
11. Liability, order of precedence and law
Each party's liability under this Addendum is subject to the limitations and exclusions in the Terms of Service. Nothing in this Addendum limits either party's liability where Data Protection Law does not allow it to be limited.
If this Addendum conflicts with the Terms of Service on a data protection matter, this Addendum wins. If it conflicts with the Standard Contractual Clauses where those apply, the Clauses win.
This Addendum is governed by the laws of England and Wales, except where the Standard Contractual Clauses specify otherwise.
Annex I — Details of the processing
A. Parties. Data exporter: the Customer, acting as controller, whose details are those held in its Capitis account. Data importer: N888 LIMITED trading as Capitis, 20 Wenlock Road, London, England, N1 7GU, acting as processor. Contact: privacy@capitis.app.
B. Description of the transfer.
| Categories of data subjects | The Customer's end-users (shoppers who click Capitis tracking links or whose identifiers the Customer submits); the Customer's own personnel who hold Capitis accounts. |
| Categories of personal data | Identifiers received in raw form: email address, telephone number and wallet address, submitted through the API, the audience CSV import or a partner webhook. No route accepts a value the Customer has hashed itself. The API hashes each raw value with HMAC-SHA256 as it arrives and writes only the hash to the identifier record; the raw value is not stored in that record, though the free-text metadata object on an end-user is stored exactly as the Customer sends it. Payment card tokens, and any bank-link or other reference the Customer supplies, are stored as given — opaque references issued by a payment or banking provider, or chosen by the Customer, not hashes; a card token that looks like a real card number (13 to 19 digits passing the standard checksum) is rejected outright. Where the Customer supplies them, a card's brand, last four digits and expiry month and year are stored alongside its token. Stored identifier values: HMAC-SHA256 fingerprints of email address, telephone number and wallet address, of which the email and telephone fingerprints alone are wrapped in a further keyed hash at rest. Customer-assigned end-user references. Click records: timestamp, IP address, user agent, the country the edge network reports for the click where one is supplied, destination merchant, a single free-text campaign field, the network the click was routed to, the destination URL, tracking token. The referring URL is not recorded, and no device classification or fraud score is computed. Conversion records: order value, currency, merchant, commission amount and status, order reference supplied by the network. |
| Special category data | None. The Customer must not submit special category data, criminal offence data, or data concerning children under 16. Because the metadata object is stored exactly as sent, it must not be used to carry email addresses, telephone numbers or other direct identifiers: those belong in the identifier fields, where they are hashed. |
| Frequency | Continuous, for the duration of the Terms of Service. |
| Nature and purpose | Issuing and resolving affiliate tracking links; recording clicks and attributing conversions; matching identifiers across publishers so that a returning shopper can be recognised; deciding geographic eligibility, because many merchant programmes pay only on traffic from certain countries; calculating commission and platform fees; producing reports for the Customer; keeping a click and conversion record against which a network's traffic-quality query or an abuse complaint can be answered. No automated fraud, bot or click-farm detection is carried out on this data. |
| Retention | Stored identifier values: revocation by the Customer or its end-user marks the identifier revoked and stops it being used for matching, but does not by itself erase the stored fingerprint; erasure is the manual step described in §10. IP address and user agent on click records: 90 days, after which a nightly job blanks both columns on every older click. The rest of the click record, and conversion records: for the life of the account, and after termination for as long as commission may still be restated or paid, because they are the commission audit trail and a network may reverse a conversion months later. Operational logs: 90 days, after which those rows are deleted outright. Billing records: 7 years, as UK tax law requires. |
| Subprocessor processing | As set out in Annex III, for the duration and purposes stated there. |
C. Competent supervisory authority. Where the EU Standard Contractual Clauses apply under §8, the supervisory authority of the EEA member state in which the Customer is established, or the Irish Data Protection Commission where the Customer is not established in the EEA. For UK processing, the Information Commissioner's Office.
Annex II — Technical and organisational measures
The full description is published at capitis.app/legal/security and forms part of this Addendum. In summary:
- Pseudonymisation. Email addresses, telephone numbers and wallet addresses are received in raw form — no route accepts a value the Customer has hashed itself — and the API process hashes each one with HMAC-SHA256 as it arrives, writing only the hash to the identifier record. Email and telephone hashes are then stored under a second keyed hash using a server-side secret held only in the API environment, so a stolen database alone does not permit matching against a guessed value. Wallet hashes are stored without that second step, the address already being public on the blockchain. Payment card tokens are not hashed at all: they are opaque references issued by a card vault and must stay usable in that form, so they are protected instead by a check that rejects any value that looks like a real card number.
- Encryption. TLS 1.2 or above for all data in transit, with HTTP Strict Transport Security and a hardened set of browser security headers. Data at rest is protected by host access control and a default-deny host firewall; disk-level encryption on the host is a published gap, listed at capitis.app/legal/security.
- Access control. Administrative access to the host is by SSH key only, with password authentication and password-based root login disabled at the server, over a firewall that permits no other inbound traffic. Every API request is scoped to a single publisher.
- Tenant separation. Every query filters by publisher at the application layer; API keys are stored hashed and are scoped to one account.
- Resilience. Nightly database backups, size-verified on write, retained for 14 days; health and readiness checks on every service with automatic restart.
- Logging. Application and access logging with credential redaction; a per-publisher audit log of security-relevant actions.
- Secure development. Linting, type checking and the automated test suite run in continuous integration on every change; typed schemas validated at the API boundary; database changes applied only through version-controlled migration files, never by hand on a live database. Two limits, stated plainly: there is no independent second-party code review, and a failing continuous-integration run does not stop a change reaching the main branch.
- Incident response. A documented process, a named contact, and the 48-hour notification commitment in §7.
The Security page also lists, openly, the measures we have not yet implemented. That list is part of this Annex; we would rather you knew.
Annex III — Authorised subprocessors
The current list, with each subprocessor's role, location and transfer mechanism, is maintained at capitis.app/legal/subprocessors and is incorporated here. Changes are notified as set out in §5.
Questions about this Addendum: legal@capitis.app · Privacy: privacy@capitis.app
N888 LIMITED, 20 Wenlock Road, London, England, N1 7GU — Company Number 17434249