RouteShot
Sign in Request access

Data Processing Agreement

RouteShot LLC — Processor · Last updated 2026-09-20

This is RouteShot's standard DPA. Bracketed fields [like this] are completed on execution for your organization. For a countersigned copy, ask through the contact page.

Parties and Effective Date

This Data Processing Agreement ("DPA") is entered into as of [Effective Date] by and between:

  • [Customer Legal Name], a [state/country and entity type] (the "Controller" or "Customer"); and
  • RouteShot LLC, a [state] limited liability company (the "Processor" or "RouteShot").

This DPA forms part of, and is subject to, the [Master Services Agreement / Terms of Service] between the parties (the "Agreement") governing Customer's use of the RouteShot website-capture service (the "Service"). Each party is a "party" and together the "parties."

Background

In providing the Service, RouteShot may process personal data on behalf of Customer. This DPA sets out the terms on which RouteShot processes that personal data and reflects the parties' agreement on data protection, including, where applicable, the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA ("CCPA").

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement. "Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings given under Data Protection Law. "Data Protection Law" means all privacy and data-protection laws applicable to the processing under this DPA, including the GDPR, UK GDPR, and CCPA. "Subprocessor" means any third party engaged by RouteShot to process Personal Data. "Customer Personal Data" means Personal Data that RouteShot processes on Customer's behalf under the Agreement, as described in Annex I.

2. Roles and Scope

As between the parties, Customer is the Controller (or a processor acting on behalf of a third-party controller) and RouteShot is the Processor of Customer Personal Data. The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are described in Annex I.

Customer is responsible for the lawfulness of the Personal Data it provides and of RouteShot's processing under Customer's instructions, and warrants it has all necessary rights and, where required, consents and authorizations to capture the websites and content it directs the Service to process.

3. Processing Instructions

RouteShot will process Customer Personal Data only on Customer's documented instructions, including as set out in the Agreement, this DPA, and Customer's configuration and use of the Service, unless required to do otherwise by applicable law (in which case RouteShot will, where legally permitted, inform Customer). RouteShot will inform Customer if, in its opinion, an instruction infringes Data Protection Law.

4. Confidentiality

RouteShot will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and process the data only as necessary to provide the Service.

5. Security Measures

RouteShot will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, taking into account the state of the art, the costs of implementation, and the nature, scope, and purposes of processing. Those measures are described in Annex II and may be updated over time provided the level of protection is not materially reduced.

6. Subprocessors

Customer provides general authorization for RouteShot to engage the Subprocessors listed in Annex III. RouteShot will impose data-protection obligations on each Subprocessor substantially equivalent to those in this DPA and remains responsible for its Subprocessors' performance. RouteShot will give Customer notice of any intended addition or replacement of a Subprocessor [at least 30 days] in advance, during which Customer may object on reasonable data-protection grounds; the parties will then work in good faith to resolve the objection.

7. Assistance to Customer

Taking into account the nature of the processing, RouteShot will provide reasonable assistance to enable Customer to: (a) respond to requests from Data Subjects to exercise their rights; and (b) meet its obligations regarding security, breach notification, data-protection impact assessments, and prior consultation with supervisory authorities. If RouteShot receives a request directly from a Data Subject relating to Customer Personal Data, it will not respond other than to direct the Data Subject to Customer, unless legally required.

8. Personal Data Breach

RouteShot will notify Customer without undue delay, and in any event within [72 hours] of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the likely consequences, and the measures taken or proposed. RouteShot will take reasonable steps to mitigate the breach and cooperate with Customer's response.

9. International Transfers

RouteShot stores and processes Customer Personal Data in the United States. Where Customer's provision of Personal Data to RouteShot involves a transfer subject to GDPR or UK GDPR, the parties will give effect to an appropriate transfer mechanism, including the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable), which are incorporated by reference and completed using the information in Annex I and Annex III.

10. Return and Deletion

On expiry or termination of the Agreement, or on Customer's written request, RouteShot will delete Customer Personal Data within [30 days], except where retention is required by law. Captures (screenshots and PDFs) are retained for [90 days] by default during the term unless a different retention period is agreed. Deletion of a project or job in the Service deletes its stored assets; limited job metadata (actor, timestamp, URLs, outcome) is retained for the audit trail as described in Annex I. On request, RouteShot will confirm deletion in writing.

11. Audits and Records

RouteShot will make available information reasonably necessary to demonstrate compliance with this DPA, including its trust documentation, completed security questionnaire, and, when available, third-party audit reports. Customer may audit RouteShot's compliance no more than [once per twelve months] (or following a Personal Data Breach) on reasonable prior written notice, during business hours, subject to confidentiality, and in a manner that does not disrupt RouteShot's operations or compromise other customers' data.

12. California Consumer Privacy (CCPA/CPRA)

To the extent RouteShot processes Personal Data subject to the CCPA, RouteShot acts as a "service provider." RouteShot will not: (a) sell or share such Personal Data; (b) retain, use, or disclose it for any purpose other than performing the Service, or as otherwise permitted by the CCPA; (c) retain, use, or disclose it outside the direct business relationship; or (d) combine it with Personal Data from other sources except as permitted by the CCPA. RouteShot certifies it understands and will comply with these restrictions.

13. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

14. Term and Termination

This DPA takes effect on the Effective Date and continues for as long as RouteShot processes Customer Personal Data under the Agreement. Provisions that by their nature should survive termination will survive.

15. General

In the event of a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA prevails. Except as amended by this DPA, the Agreement remains in full force. This DPA is governed by the governing law of the Agreement, unless Data Protection Law requires otherwise.

Annex I — Details of Processing

  • Subject matter: capture of websites (screenshots and PDFs) that Customer directs the Service to process.
  • Duration: the term of the Agreement, plus the retention and deletion periods in Section 10.
  • Nature and purpose: automated capture of web pages at configured viewports for review, compliance, QA, and archival, and delivery of the resulting output to Customer.
  • Types of Personal Data: any Personal Data appearing on the pages Customer directs the Service to capture; account data of Customer's authorized users (name, work email, role); and job metadata (actor, timestamp, URLs, outcome). RouteShot does not submit forms or collect site-visitor analytics.
  • Categories of Data Subjects: Customer's authorized users, and any individuals whose Personal Data appears on the captured pages.

Annex II — Technical and Organizational Measures

RouteShot maintains measures including the following (see the security page for detail):

  • Encryption of data in transit (TLS) and at rest.
  • Tenant isolation by row-level security on every database table, organization-prefixed private storage with signed-URL access, and per-job worker scoping.
  • Customer-supplied credentials held in a dedicated secrets vault, write-only from the interface, decrypted only by the capture worker at job start, never written to logs or job records.
  • Least-privilege access to production data, restricted to authorized personnel.
  • Audit logging of sensitive actions and per-job records (actor, time, URLs, outcome).
  • Automated database backups performed by the managed platform.
  • No submission of forms and no collection of site analytics or visitor data; data minimization by design.
  • Use of established cloud providers that maintain their own security certifications.

Annex III — Approved Subprocessors

The current list of subprocessors, with purpose and location, is on the subprocessors page.