Data processing and sub-processors
When Sadang runs on your website, you decide what is collected and why. We process it on your behalf, under a data processing agreement.
Draft for legal review. This page is being reviewed before it is final. Details marked "to be confirmed" are still open.
Roles
You (our customer) are the controller of personal data collected on your website. Human Digital Solutions Co. Ltd is your processor. Our data processing agreement sets out our obligations; ask us for a copy to sign.
What we process for you
- Consent choices and receipts (with the visitor reference hashed).
- With the visitor's consent and your configuration: page and interaction events, a visitor reference, campaign sources and click identifiers, form interaction data, page speed measurements, script errors, heatmaps, masked screenshots, and the call tracking numbers shown. Masked session recordings are in development.
- Email addresses from submitted forms, when form analytics is on and the visitor allowed analytics: Sadang sends a hashed form of the address and, today, the plain address too. A fix so that only the hash is sent is in progress.
- A record that the banner was shown, sent before the visitor chooses, with the page path, banner version and a visit reference.
- Technical data: IP address and browser details, used for delivery, bot filtering and region detection.
Where it is processed
| Deployment | Hosting |
|---|---|
| United Kingdom | Amazon Web Services, London region (eu-west-2) |
| Thailand | Amazon Web Services, Bangkok (ap-southeast-7); email through Amazon SES in the United States, with the sending relay in Singapore |
Each site uses one deployment. Visitors to a site using the UK deployment, wherever they are, are processed in the UK. Where personal data is processed outside a deployment's country, we use a transfer mechanism recognised by the law that applies: for the UK, adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; for Thailand, a basis under sections 28 and 29 of the PDPA. We give at least 30 days' notice before adding or replacing a sub-processor.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage and email (Amazon SES) | London (eu-west-2) for the UK deployment; Bangkok (ap-southeast-7) for Thailand, with Thai email through the United States and Singapore |
| Human Advertising Ltd, trading as uForge (company number 07455860, Doncaster, United Kingdom) | Operates the UK deployment of uForge, on which Sadang runs | United Kingdom |
Region detection uses a country database that runs on our own servers; your visitors' IP addresses are not sent to its provider.
Destinations you choose
If you connect advertising platforms - Google Ads, Meta, TikTok, Microsoft Advertising or LINE - Sadang sends them conversion events on your instruction, and only for visitors who allowed marketing. These platforms are your recipients, not our sub-processors.
Retention
Consent receipts: three years by default. Screenshots: deleted by a daily sweep once the retention period you set has passed. Events and other measurement data: there is no automatic deletion yet; ask us at dpo@sadangattribution.com to delete your site's data at any time. Within 30 days after your agreement ends, we delete your data from the live platform unless the law requires us to keep it.