Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the customer who has accepted our Terms of Service ("Customer", the controller) and [COMPANY LEGAL NAME], company number [COMPANY NUMBER], [REGISTERED ADDRESS] ("Processor", "we"). It forms part of the Terms and applies whenever we process Customer Personal Data in providing nbsanalytics (the "Service").

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 and, where they apply, the EU GDPR (Regulation 2016/679) and national laws implementing the ePrivacy Directive. Terms such as "controller", "processor", "personal data", "data subject" and "personal data breach" have the meanings given in Data Protection Law. "Customer Personal Data" means personal data in the data the Customer's websites, apps and servers send to the Service.

If this DPA conflicts with the Terms, this DPA wins for matters of data protection.

2. Details of the processing

Subject matter	Providing web and product analytics to the Customer.
Duration	For the term of the Customer's account, then until deletion under section 10.
Nature and purpose	Collecting, enriching (location from IP address, browser and device from user agent, traffic source from referrer), storing, aggregating and displaying analytics events so the Customer can understand traffic, conversions and revenue attribution; and the security, support and maintenance needed to do so.
Data subjects	Visitors to the Customer's websites and apps; where the Customer uses identify or payments features, the Customer's own users and customers.
Types of personal data	Pseudonymous visitor and session ids (random ids in first-party cookies in cookie mode, or a daily-salted hash in cookieless mode); pages viewed; referrer and campaign tags; browser, operating system, device type and screen width; approximate location (country, region, city); events and properties the Customer sends. Optionally, where the Customer sends them: its own user id, name and profile image URL, other user traits, and payment amounts and customer references from its payment provider. IP addresses are processed transiently in memory to determine location and, in cookieless mode, to compute the visitor hash. They are never stored.
Special category data	None intended. The Customer must not send it (see the Terms).

3. Processing on instructions

• We process Customer Personal Data only on the Customer's documented instructions — which are the Terms, this DPA and the Customer's configuration of the Service — unless the law requires otherwise, in which case we'll tell the Customer first unless the law forbids it.
• We'll tell the Customer promptly if we believe an instruction breaks Data Protection Law.
• We don't sell Customer Personal Data, use it for our own purposes such as advertising, or combine it with data from other customers to profile individuals. We may use aggregated, anonymous statistics about Service usage (for example, total event volumes) to operate and improve the Service.

4. The Customer's obligations

The Customer is responsible for the lawfulness of the processing it instructs: having a lawful basis, giving visitors clear information in its privacy notice, obtaining any consent required for storing or reading information on visitors' devices (for example when using cookie mode), and not sending data the Terms prohibit.

5. Confidentiality of personnel

Everyone we authorise to process Customer Personal Data is bound by confidentiality and has access only to the extent needed to provide and support the Service.

6. Security

We implement appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32, including those in Annex 1. We may update them as long as the overall level of protection doesn't decrease.

7. Subprocessors

• The Customer gives general authorisation for us to use subprocessors. The current list is on our subprocessors page.
• We'll give at least 30 days' notice of a new or replacement subprocessor by email to account owners and by updating that page. The Customer may object on reasonable data protection grounds within that period; if we can't reasonably address the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.
• We impose data protection terms on each subprocessor that are at least as protective as this DPA, and remain responsible to the Customer for their performance.

8. Assistance

• Data subject requests. Taking into account the nature of the processing, we'll help the Customer respond to requests from data subjects to exercise their rights. If we receive a request directly, we'll pass it to the Customer without undue delay and won't respond ourselves except to redirect it.
• Impact assessments and consultation. We'll give reasonable help with data protection impact assessments and prior consultations with supervisory authorities relating to the Service.

Because visitor data is pseudonymous and IP addresses aren't stored, it is often impossible to single out a particular visitor's data without an identifier the Customer holds (such as a cookie value or its own user id).

9. Personal data breaches

We'll notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. We'll provide further information as it becomes available and take reasonable steps to contain and remedy the breach.

10. Return and deletion

• During the term, the Customer can delete individual sites, which deletes their events, and can export its data as CSV at any time from the site settings.
• Analytics events are kept for the retention period of the Customer's plan and then deleted automatically.
• When the account ends, the Customer may request an export within 30 days. We then delete Customer Personal Data within a further 30 days, and from backups within 90 days of account end, unless the law requires us to keep it.

11. Audits

We'll make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28, including answers to reasonable security questionnaires. Where that isn't enough, or a supervisory authority requires it, the Customer may carry out an audit (by itself or an independent auditor bound by confidentiality) no more than once a year, on at least 30 days' notice, during business hours and in a way that doesn't disrupt the Service or compromise other customers' data. Each party bears its own costs.

12. International transfers

Customer Personal Data is hosted in the European Union (Germany and Finland). We are established in the United Kingdom, which the EU recognises as providing adequate protection; the UK likewise recognises the EEA. Where Customer Personal Data is transferred to a country without an adequacy decision, we'll ensure an appropriate safeguard is in place: for data subject to the EU GDPR, the EU Standard Contractual Clauses (Commission Decision 2021/914, processor-to-processor or controller-to-processor modules as applicable), and for data subject to the UK GDPR, the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs.

13. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law doesn't allow it to be limited. This DPA lasts as long as we process Customer Personal Data.

Annex 1 — Technical and organisational measures

Data minimisation and pseudonymisation

• Raw IP addresses are never written to disk, databases or logs; they are used in memory and discarded.
• Cookieless visitor ids are an HMAC-SHA256 of site, IP address and user agent with a random salt that is replaced every UTC day; old salts are deleted so ids can't be recomputed or linked across days.
• Only the page hostname, path and campaign tags are stored from URLs; other query parameters are dropped.
• IP geolocation uses a locally stored database; no visitor data is sent to a geolocation provider.

Encryption

• TLS for all traffic between browsers, customer servers and the Service.
• Payment-provider credentials encrypted at rest with application-level encryption.
• Passwords stored only as salted, slow hashes.
• Backups encrypted [CONFIRM: at rest in Hetzner Object Storage].

Access control

• Customer data is separated by team and site; every query is scoped to a site the requesting user's team owns.
• Production access limited to named staff, using SSH keys; access reviewed when roles change.
• Site API keys are scoped to a single site and can be revoked by the Customer.

Availability and resilience

• Regular backups of databases to separate storage, with restores tested.
• Hosting in professionally managed data centres with physical access controls (Hetzner, ISO 27001 certified).
• Rate limiting and input validation on public endpoints.

Organisational

• Confidentiality obligations for all personnel.
• Security updates applied promptly; dependencies monitored for known vulnerabilities.
• A documented process for detecting, responding to and notifying personal data breaches.

Annex 2 — Subprocessors

As listed on our subprocessors page, which forms part of this DPA.

Contact

Data protection questions: [CONTACT EMAIL]. If you need a countersigned copy of this DPA, email us and we'll send one.