Data processing terms (when applicable)

When these terms apply

Installing or licensing a PMS plugin does not by itself make Pikus Media AB a processor of the customer’s website data. Consent records and Commerce Ledger records stay in the customer’s WordPress installation. These terms apply only where Pikus Media AB actually processes personal data on a business customer’s documented instructions, for example during support with authorised access or a future hosted processor service. PMS processes billing, licensing security and fraud-prevention data for its own purposes as an independent controller under the privacy policy.

Customer instructions and purpose

Where these terms apply, the customer instructs Pikus Media AB to provide the specifically requested support or processor service and protect transmission. Ordinary signed classification requests contain bounded cookie names and normalized script URLs without cookie values, page content, URL queries or visitor consent records; those technical requests do not normally make PMS a processor of the customer’s visitor database. The customer remains responsible for lawful instructions and must not submit unnecessary personal or special-category data.

Subject matter, data and duration

The subject matter is licensed cookie classification and related support. Processing lasts while the service request, support matter or licence relationship requires it. Data subjects can include customer staff and website visitors whose IP address may appear in ordinary hosting security logs. Data types are technical cookie names, normalized script hosts and paths, licence identifiers, account contacts, IP addresses, timestamps and support content. Technical observations need not identify a person but are protected as customer data.

Confidentiality and security

Pikus Media AB restricts access to authorised persons, uses encrypted transport, access controls, logging, signed responses, bounded requests and protected server-side catalogue storage. Authorised persons are subject to confidentiality obligations.

Subprocessors

LH.pl provides EEA hosting infrastructure. Pikus Media AB imposes data-protection obligations equivalent to this agreement on subprocessors and remains responsible for their processor duties. We will give reasonable advance notice through the service or account contact before adding or replacing a material subprocessor, allowing the customer to object on reasonable data-protection grounds.

Assistance and incidents

Taking account of the nature of processing, Pikus Media AB will reasonably assist with data-subject requests, security enquiries, impact assessments and regulator consultations. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting processor data.

Deletion, return and audit

At the customer’s choice and at the end of processor services, customer personal data is deleted or returned where technically available unless law requires retention. Classification requests are not written to the licence database; ordinary security logs follow the privacy-policy retention. We provide information reasonably necessary to demonstrate Article 28 compliance and permit proportionate audits on reasonable notice. Audits must protect other customers, security and confidential catalogue information.

International transfers

Processor data is hosted in the EEA. Any transfer outside the EEA requires a lawful transfer mechanism. Contact hej@pikus.media to request a signed copy or discuss customer-specific instructions.