Data processing agreement

This Data Processing Agreement describes the terms for DataVisitors to process personal data on a customer's behalf. It forms part of a service agreement that incorporates it. It starts when the parties accept that service agreement or a separate written DPA. Publication of this document alone does not execute an agreement.

The customer is the person or organisation identified in the service agreement. DataVisitors means the service provider identified in that agreement. Contact us to record the parties' full legal details in a signed agreement when required.

“Customer personal data” means personal data you submit to the service, or instruct it to collect, for your projects. This includes personal data in events, identification traits, imports, and optional feedback or measurement features.

You act as controller when you decide the purposes and means of processing. We act as processor. If you act for another controller, we act as your subprocessor. You must have authority to appoint us and give the instructions described here.

We act as controller for our own account administration, billing, security, and support records. The Privacy Policy covers that separate processing.

This agreement addresses processor duties under applicable data protection law, including Article 28 of the European Union General Data Protection Regulation where it applies. References to United Kingdom or other privacy laws apply only when the processing falls within their scope. This document is not a certification of compliance.

We will process customer personal data only under your documented instructions, including instructions about international transfers. Your agreement, enabled settings, authorised API requests, and written instructions that we accept define those instructions.

If applicable law requires other processing, we will inform you before processing unless the law prohibits that notice. We will inform you if we consider an instruction unlawful. We may suspend the affected instruction while the parties resolve the concern.

You must establish a lawful basis for collection and processing. Give the required information to individuals. Obtain consent when necessary. Configure the tracker and optional features to reflect their choices.

Send only data needed for your purpose. Keep account access, integrations, and recipients current. Do not submit special categories of personal data, criminal records, passwords, authentication secrets, or full payment-card details.

You determine whether the service, its processing locations, retention arrangements, and security measures meet your requirements. Tell us about requirements that the standard service does not address before processing begins.

We will limit access to people who need it to deliver, secure, or support the service. Anyone authorised to process customer personal data must have a duty of confidentiality.

We will not sell customer personal data, use it for targeted advertising, or combine it across customers to create advertising profiles. Processing remains limited to the contracted service, your instructions, and applicable legal duties.

Where applicable law treats us as a service provider or contractor, those restrictions also govern that relationship. We will notify you if we determine that we cannot meet an applicable processing obligation. You may take reasonable steps to stop or correct unauthorised processing.

We will maintain technical and organisational measures appropriate to the nature of the data and the risks of processing. Annex 2 describes the current measures. We may update those measures without materially reducing the overall protection.

You remain responsible for the security of your own applications, credentials, authorised devices, exports, and destinations. Neither a hidden interface control nor a privacy setting replaces your obligation to limit the data you send.

We will assist you with applicable requests for access, correction, restriction, objection, portability, and erasure. The available export and person-erasure controls support that assistance. Additional requests can go through the contact page.

If an individual contacts us about customer personal data, we will direct or forward the request to the relevant customer where we can identify that customer. We will not decide the request for you unless you instruct us or the law requires it.

We may need information that connects a request to a particular project or record. We will not collect new identifying data solely to identify a person in otherwise unidentifiable statistics.

We will notify you without undue delay after we become aware of a personal data breach affecting customer personal data. We will provide the facts available at that time. Further information can follow in stages.

The notice will describe the incident, affected data and individuals where known, likely consequences, mitigation, and a contact for follow-up. We will take reasonable steps to contain and investigate the incident. A notice does not itself establish liability.

We will provide reasonable assistance with your security duties, required breach notices, data protection impact assessments, and consultations with a supervisory authority. You remain responsible for deciding which notices and assessments your activities require.

Subject to the service agreement, you give general written authorisation for the providers in Annex 3 to process the relevant data. We will impose data protection obligations that provide equivalent protection for the processing they perform. We remain responsible to you for their performance of those obligations.

We will give written notice at least thirty days before a new or replacement subprocessor begins the affected processing. You may object during that period on reasonable data protection grounds. We will discuss an alternative or other practical solution.

If we cannot resolve the objection, you may terminate the affected service before the change takes effect. Contact us to arrange the return or deletion of the affected data. A provider that acts independently for a separate activity is responsible for that activity under its own terms.

The service uses providers that can process data in more than one country. Annex 3 and the subprocessor page describe their roles. We do not promise a specific residency region through this agreement alone.

Where a restricted international transfer requires a safeguard, the parties must put the applicable safeguard in place before that transfer. This can include an adequacy decision or the applicable standard contractual clauses with completed annexes and supplementary measures where required.

This page does not itself execute standard contractual clauses, a United Kingdom transfer addendum, or a transfer assessment. A provider's general policy does not by itself prove that a safeguard covers your transfer. Contact us to agree the required documents and locations before sending affected data.

We will make available the information needed to demonstrate our compliance with this agreement. We will allow and contribute to audits or inspections by you or an independent auditor you appoint.

Arrange ordinary audits with reasonable notice. Auditors must protect confidential information and other customers' data. The parties will agree a scope and method that avoid unnecessary service disruption. These arrangements must not prevent a required regulatory inspection or an urgent audit following a material incident.

We will cooperate with applicable supervisory authorities. We will notify you of a legally binding request for customer personal data unless the law prohibits notice.

At the end of the processing service, you may choose return or deletion of customer personal data, subject to lawful retention duties. Request the available exports before closing access. Contact us for data or assistance outside those exports.

Closing a project stops new collection after its access is revoked. It does not immediately erase all existing records. Events retain their assigned expiry periods. Stored identification traits use a separate retention period. Individual erasure processes the selected person's records asynchronously.

The standard interface does not provide immediate deletion of an entire project's history. For a project-wide deletion request, contact us to arrange its scope and completion in writing. Scheduled expiry does not remove a separate deletion duty imposed by applicable law or agreed instructions.

Backups are not rewritten for each erasure. We will restrict retained copies to recovery or legally required purposes. Routine database backups normally rotate over about thirty days, but the last usable backup can remain longer if replacement backups fail. Separate application archives can retain account-related data for up to two years. Restored data must remain subject to applicable deletion instructions.

We will delete remaining copies when their applicable retention ends, unless law requires further retention. We will identify the legal basis for any such exception. Confidentiality and security duties continue for all retained personal data.

This agreement continues while we process customer personal data for you. The Terms of Service govern liability and general contractual matters, subject to mandatory law. This agreement takes priority for personal data processing. Applicable transfer clauses take priority over a conflicting term in either document.

Changes that affect your processing obligations require appropriate notice. A change to subprocessors follows section 8. Send instructions, objections, audit requests, and requests for an executed agreement through the contact page.

Subject matter and purpose. Analytics for the customer's websites, applications, and servers. The service helps the customer understand usage, acquisition, performance, and conversions.

Nature of processing. Collection, validation, data reduction, storage, aggregation, reporting, authorised disclosure, export, and deletion. Imports add records from sources you connect. Reports and webhooks disclose information to recipients you select.

People concerned. Visitors, application users, customers, authorised staff, and other people whose activity the customer sends. Optional feedback features can include the person who submits a message or rating.

Data categories. Event names and times; page or screen details; referral hosts; campaign labels; device and browser categories; language; permitted location fields; visitor and session identifiers. Optional fields include customer-supplied identifiers, traits, custom properties, revenue amounts, heatmap positions, performance measurements, and feedback.

Request data. IP addresses and user-agent strings reach the collection endpoint. Normal analytics event storage omits the raw IP address and full user-agent string. Network providers and operational logs can process them separately. No analytics cookie is required by the tracker.

Sensitive data. Special categories of personal data and other restricted data listed in section 3 are outside the intended processing scope. Automatic filtering does not guarantee that every sensitive value is removed.

Frequency and duration. Processing occurs as integrations send events or imports run. Event retention is 90 days on Free, 365 days on Starter, 730 days on Growth, and 1095 days on Business. Each event receives its period at collection. Storage maintenance removes expired records. Traits expire one year after their last write. Section 11 covers termination and backups.

• Data reduction removes page query strings and fragments, reduces referring URLs, and filters common secret and personal-data patterns from custom properties.
• Stateless measurement uses identifiers that rotate daily and differ between projects. It does not provide a promise that all records are legally anonymous.
• Workspace permissions and project-scoped access restrict customer data. Public reports use separate controls and permitted report data.
• Password protection, optional account two-factor authentication, restricted operator access, and request limits protect access to the service.
• Private credentials receive protected storage. Relevant access and account changes generate security or audit records.
• Encrypted network transport protects requests in transit. Restricted infrastructure access protects stored data and configuration.
• Backup and recovery procedures support restoration. Retention and individual-erasure procedures limit continued storage.

These measures do not represent a certification, independent audit opinion, or guaranteed availability level. The security page describes the current practices and limitations.

The register below identifies known providers and their processing roles. Confirm the applicable locations and any required transfer documents before beginning processing that depends on those facts. The subprocessor page provides the change and objection procedure.