Data Processing Agreement

Processing of connection metadata (timestamp, source identifier, destination host, bytes transferred, status code) for the purpose of routing, billing, security and abuse handling, for the duration of the service plus 30 days.

wproxy processes this data only on documented instructions: these terms, the configuration you set in the dashboard and API, and applicable law. We will inform you if an instruction, in our view, infringes UK or EU data-protection law.

Measures include TLS in transit, encryption at rest for logs, role-based access for staff, audit logging of production access, and a 30-day retention cap. Details are on the Security page. We notify you of a personal-data breach affecting your data without undue delay and at latest within 72 hours of becoming aware of it.

Infrastructure is hosted with EU/UK providers listed in the dashboard under Settings → Compliance. We impose equivalent obligations by contract and remain liable for their performance. Material additions are notified at least 14 days in advance, with a right to object on reasonable grounds.

On termination we delete traffic metadata on the standard 30-day cycle. Account records follow the retention periods in the Privacy Policy. A deletion certificate is available on written request for enterprise accounts.