Legal
Data Processing Addendum
Media Track Limited · Company No. 16249153 · ICO Registration ZB963026
Effective: 14 October 2026 · Version 1.2
1. Parties and Scope
This Data Processing Addendum (“DPA”) forms part of the agreement (“Service Agreement”) between:
- Processor: Media Track Limited, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, company number 16249153, ICO registration ZB963026 (“Mediatrack”).
- Client: The entity identified in the Service Agreement that has engaged Mediatrack to provide services (“Client”).
This DPA applies to all personal data processed by Mediatrack on the Client’s behalf in connection with the mediatrack.ai platform.
This DPA applies regardless of whether the Client is the data controller (the advertiser), or is itself a processor acting on behalf of a data controller (for example, an agency acting for an advertiser, or a publisher acting for an agency). In all cases, Mediatrack processes personal data on the Client’s documented instructions.
2. Client Warranty of Authority
The Client warrants and represents that:
- 2.1It has all necessary authority, consents, and agreements in place to instruct Mediatrack to process personal data on its behalf.
- 2.2Where the Client acts as a processor on behalf of a third-party data controller (such as an advertiser or brand), the Client has a written data processing agreement with that controller which authorises the Client to engage sub-processors including Mediatrack.
- 2.3Where the Client acts as a sub-processor (for example, a publisher acting on behalf of an agency), the Client has confirmed through the contractual chain that the data controller has authorised the use of sub-processors including Mediatrack.
- 2.4The data controller in the chain has a valid lawful basis for the collection and processing of personal data through landing pages hosted on the Mediatrack platform.
- 2.5The Client has provided (or will provide at campaign setup) accurate data controller details including the controller’s name and privacy contact, so that Mediatrack can populate the landing page privacy notice correctly.
The Client indemnifies Mediatrack against any claim, loss, or liability arising from the Client’s breach of these warranties.
3. Roles
Mediatrack is the data processor. The Client instructs Mediatrack to process personal data for the purpose of delivering the platform services.
If the Client is itself a processor (e.g. an agency or publisher), Mediatrack is a sub-processor. The obligations in this DPA apply equally.
Mediatrack does not determine the purposes or means of processing. Mediatrack does not use Client data for its own marketing, analytics, or any purpose other than delivering the agreed services.
4. Processing Details
- Subject matter
- Hosting, operating, and optimising landing pages, lead generation campaigns, ad creative, call tracking, and reporting on behalf of the Client.
- Nature and purpose
- Collection, storage, routing, analysis, optimisation, reporting, and deletion of personal data submitted through landing pages and call tracking, to deliver the platform services.
- Types of personal data
- Names, email addresses, telephone numbers, postal codes, form responses, consent records, IP addresses, URL parameters and referral data, call metadata, call recordings and call transcripts (including calls answered by the AI phone receptionist, where enabled), and website interaction data. Where a Client’s form asks for it, this includes special category data such as details of an injury or health condition (see clause 7).
- Categories of data subjects
- Website visitors, lead form respondents, callers, and any individuals whose data is submitted through landing pages or call tracking hosted on the platform.
- Duration
- For the term of the Service Agreement. Lead data is deleted 90 days after collection or within 30 days of the end of the campaign, whichever is first (clause 5.9).
5. Mediatrack’s Obligations
Mediatrack shall:
- 5.1Instructions: Process personal data only on the Client’s documented instructions. Mediatrack shall immediately inform the Client if, in its opinion, an instruction infringes UK GDPR.
- 5.2Confidentiality: Ensure that all persons authorised to process personal data are bound by appropriate confidentiality obligations.
- 5.3Security: Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out in Schedule 1.
- 5.4Sub-processors: Not engage additional sub-processors without providing the Client with 30 days prior notice. The Client provides general authorisation for the sub-processors listed in Schedule 2. The Client may object to a new sub-processor on reasonable data protection grounds. If the objection cannot be resolved, the Client may terminate the Service Agreement.
- 5.5Data subject rights: Assist the Client in responding to data subject requests within 48 hours of receipt. Mediatrack shall not respond directly to a data subject without the Client’s instruction, unless required by law.
- 5.6Breach notification: Notify the Client without undue delay and in any event within 24 hours of becoming aware of any actual or suspected personal data breach. The notification shall include: the nature of the breach, categories and approximate numbers of data subjects affected, likely consequences, and measures taken or proposed.
- 5.7ICO notification: The decision whether to notify the ICO and/or affected data subjects rests with the data controller (the Client, or the Client’s upstream controller). Mediatrack will provide sufficient information to enable this decision.
- 5.8DPIA assistance: Assist the Client in carrying out data protection impact assessments and prior consultations with the ICO where required.
- 5.9Deletion: Delete lead data 90 days after collection, or within 30 days of the end of the campaign, whichever is first. On termination of the Service Agreement, delete all remaining personal data within 30 days of termination. Deletion is currently carried out as a manual monthly process. Provide written confirmation of deletion on request.
- 5.10Audit: Make available to the Client all information necessary to demonstrate compliance with this DPA. Allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client.
- 5.11No selling or sharing: Not sell, rent, share, or disclose personal data to any third party for any purpose other than delivering the agreed services.
- 5.12Landing page privacy notice: Auto-generate and display a privacy notice on each landing page identifying the data controller (using details provided by the Client at campaign setup), Mediatrack as processor, data collected, purposes, recipients, retention, rights, and ICO complaint right.
- 5.13Cookie consent: Landing pages use a single strictly necessary first-party cookie. Where the Client switches on the consent banner for a landing page, non-essential cookies (including client tracking pixels) are not set on that page until the visitor has given consent. The Client remains responsible for PECR compliance for any tracking it adds.
6. Client’s Obligations
The Client shall:
- Provide accurate data controller details at campaign setup (controller name, contact email/URL) so that landing page privacy notices can be correctly populated.
- Ensure that the data controller has a valid lawful basis for the collection and processing of personal data.
- Where the Client is an agency or publisher, maintain a written data processing agreement with the upstream data controller that authorises the engagement of sub-processors.
- Respond to data subject requests forwarded by Mediatrack within a reasonable time.
- Notify Mediatrack of any relevant instructions, restrictions, or regulatory requirements that affect the processing.
- Comply with all applicable data protection legislation.
7. International Transfers and Special Category Data
Primary data storage is in the United Kingdom (Supabase eu-west-2, Vercel lhr1). Some sub-processors process limited data outside the UK. Where personal data is transferred outside the UK, appropriate safeguards are in place including Standard Contractual Clauses and/or the UK-US Data Privacy Framework. Details are set out in Schedule 2.
Special category data (for example, details of an injury or health condition) is collected only where the Client’s form asks for it. It is used only to pass the enquiry to the Client. It is stored on the platform with the rest of the enquiry, in delivery records and, where the Client turns on lead alerts, in the alert email. It is visible only to authorised Media Track staff and to the Client. It is deleted in line with clause 5.9. It is not used for scoring, profiling, reporting or AI processing.
8. Term and Termination
This DPA remains in force for the duration of the Service Agreement. On termination, clause 5.9 (deletion) applies. Clauses 5.2 (confidentiality), 5.10 (audit), and 5.11 (no selling/sharing) survive termination.
9. Liability
Mediatrack’s liability under this DPA is subject to the limitations set out in the Service Agreement. The Client’s indemnity under clause 2 is not subject to the liability cap.
10. Changes to This DPA
Mediatrack may update this DPA with 30 days prior written notice. The current version is published at mediatrack.ai/legal/dpa. Continued use of the platform after the notice period constitutes acceptance.
11. General
- This DPA is governed by the laws of England and Wales.
- This DPA is incorporated into and forms part of the Service Agreement.
- If any provision is found to be invalid, the remaining provisions continue in force.
- By using the Mediatrack platform, the Client accepts this DPA.
Schedule 1: Security Measures
Mediatrack implements the following technical and organisational measures:
- TLS 1.2+ encryption of all data in transit.
- AES-256 encryption of data at rest in Supabase.
- Role-based access controls with least-privilege principles.
- Comprehensive audit logging of all data access.
- Strong password policy (minimum 12 characters, mixed case, numbers, symbols).
- Device security requirements: up-to-date OS, endpoint protection, disk encryption, screen lock.
- No personal data stored on staff endpoint devices.
- Vendor due diligence for all third-party sub-processors.
- Lead data deleted in line with clause 5.9 (currently a manual monthly process).
Schedule 2: Sub-Processors
The Client provides general authorisation for the following sub-processors. Mediatrack will notify the Client at least 30 days before adding or replacing a sub-processor.
Sub-processor list version 1.2, 14 October 2026.
Used for every site
| Sub-Processor | What it does | Data it receives | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting | Every page visit and every form submission passes through its London servers on the way to our database: the visitor’s IP address, the pages they view and the full form contents. It does not keep or use the data beyond short-lived system logs. | London | N/A |
| Supabase Pte. Ltd. | Database | The full lead (name, phone, email, postcode and form answers), page visit records (pages, timings and the last question reached, never the answers or the IP address) and call recordings. | London (eu-west-2) | N/A |
| Amazon Web Services | Data centres underneath Vercel and Supabase only | Only the data held by Vercel and Supabase, as listed above. We do not send it anything directly. | London (underlying Vercel and Supabase) | N/A |
| Web fonts on every page, address lookup where a form has one, and staff email | Web fonts: the visitor’s IP address and browser details (no form data). Address lookup: the postcode typed in. Staff email: lead alert copies and the weekly lead list (name, email, phone, address and postcode) end up in staff mailboxes. | Outside the UK possible | UK transfer safeguards apply (see below) | |
| Tailwind Labs | Styling file loaded on every page | The visitor’s IP address and browser details, nothing else. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Sentry | Error monitoring | Technical error reports, including the page address. If an error happens while a lead is being handled, the report can include the lead’s details. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Resend | Email sending | Lead alert emails, only where a client switches alerts on: the lead’s name, phone, email, postcode and form answers, including any injury answers (a copy goes to a Media Track inbox). The weekly lead list: name, email, phone, address and postcode, no answers. Call-back request emails: the caller’s name and phone number. | Outside the UK possible | UK transfer safeguards apply (see below) |
Only where the feature is used
| Sub-Processor | What it does | Data it receives | Location | Transfer safeguard |
|---|---|---|---|---|
| Twilio Inc. | Call tracking | The tracking phone number, the call itself and the recording. The caller’s number and the call audio pass through it. The recording is copied to our London database and then deleted at Twilio. Applies only where call tracking is enabled for the client’s page. Recordings we hold are deleted after 90 days. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Vapi | AI phone receptionist: answers when the client does not pick up or outside office hours | It hears the whole call and saves the caller’s name, number, answers and a transcript. Applies only where the AI receptionist is switched on for the client’s page. Vapi may hold its own copy under its own settings. | Outside the UK possible | UK transfer safeguards apply (see below) |
| OpenAI (via Vapi) | The receptionist’s language model | What is said on receptionist calls. It is not used for training. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Voice and speech-to-text providers (via Vapi) | Turn the receptionist’s replies into speech and transcribe the caller (providers being confirmed) | The call audio and text. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Unsplash | Stock images loaded on some pages | The visitor’s IP address and browser details, nothing else. | Outside the UK possible | UK transfer safeguards apply (see below) |
| FLG360 | CRM and lead routing, only where a client’s leads are routed through FLG | The full lead: name, phone, email, postcode and form answers. | UK | N/A |
Current list also published at mediatrack.ai/legal/sub-processors.
Schedule 3: Landing Page Privacy Notice Template
The following template is auto-generated on each landing page. Fields in [brackets] are populated from the Client’s campaign setup.
Privacy Notice
This page is hosted by Media Track Ltd (mediatrack.ai) on behalf of [Controller Name].
Data controller:
[Controller Name]
[Controller Contact Email or URL]
What we collect:
When you submit an enquiry, we collect the information you provide in the form, which may include your name, email address, phone number, and postcode, and, where the form asks for it, details of an injury or health condition. Where call tracking is enabled for this page and you call the number on it, we also record the call and keep a transcript, including where the call is answered by an AI phone receptionist (only where that is also enabled). We also collect technical information such as your IP address and the campaign source that referred you.
Why we collect it and lawful basis:
To respond to your enquiry and provide you with information about the product or service you have asked about. The lawful basis is [consent / legitimate interest] as determined by the data controller.
Who receives your data:
Your enquiry is passed to [Controller Name] (the data controller) and/or their appointed representatives so they can respond. This page is hosted and operated by Media Track Ltd (mediatrack.ai, ICO registration ZB963026) as a data processor. Mediatrack uses sub-processors for infrastructure, communications, and lead routing. The full list is published at mediatrack.ai/legal/sub-processors.
Call tracking and the AI phone receptionist:
This applies only where call tracking is enabled for this page. Our telephone provider, Twilio, handles the tracking number, your phone number and the call audio, and the recording where recording is on. Only where the AI phone receptionist is also enabled and answers your call, Vapi (our AI call provider), together with the AI language model and voice providers it uses, receives the call audio, your phone number and the name of the business, and returns a transcript, a summary and any name, callback number and notes you give. Vapi may hold its own copy under its own settings. Details are in the sub-processor list.
International transfers:
Your data is stored in the United Kingdom. Some sub-processors may process limited data in the United States under Standard Contractual Clauses.
How long we keep your data:
Your enquiry is deleted 90 days after you submit it, or within 30 days of the end of the campaign, whichever is first. Call recordings held by Media Track are deleted 90 days after the call. The transcript, AI summary and caller number of that call are removed at the same time. Where a call has no recording, its transcript and call record are kept while the call record is held, and the client can ask us to delete them. Recordings or records that the client makes or holds themselves are kept under the client’s own retention policy.
Automated decision-making:
No decisions about you are made based solely on automated processing.
Your rights:
Under UK data protection law, you have the right to access, correct, delete, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time. To exercise these rights, contact [Controller Name] at [Controller Contact] or Mediatrack at privacy@mediatrack.ai. You also have the right to complain to the ICO at ico.org.uk.
This page is operated by Media Track Ltd (company number 16249153, ICO registration ZB963026) on behalf of [Controller Name].