Data processing agreement

• Subject matter: audience measurement of the controller’s websites and apps.
• Duration: the term of the contract, then the deletion period set out in “End of the contract”.
• Nature: collection through the tracker or the API, enrichment (city-level location, browser, channel, the referring site’s logo from its domain name only), storage, aggregation, display, alerts, export and deletion.
• Purpose: providing the controller with statistics about the traffic of its sites.
• Data: pageviews and events, timestamps, visit and visitor ids (daily hash by default), referrers and campaigns, country, region, city and city coordinates, browser, OS, device type, screen size, language, engagement, performance and technical errors, properties and revenue sent by the site; and, if the controller enables them, a persistent random id (data-persist) and a user id with traits (identify()). The IP address is only processed in memory and never stored.
• Data subjects: visitors of the controller’s sites and, if it uses identify(), its users.
• Special categories: none. The controller must not send any (GDPR art. 9 and 10).

Penra only processes the data on the controller’s documented instructions: these terms, each site’s configuration in the dashboard (exclusions, retention, tracking options) and API calls. It never uses the data for its own purposes, never sells it and never combines it with other sources. It immediately tells the controller if an instruction seems to infringe the GDPR, and informs it before any processing required by Union or Member State law, unless the law forbids it. Data sent to destinations the controller configures itself (alert webhooks, exports, API and MCP clients, public share links) is sent on its instructions and under its responsibility; those recipients are not sub-processors.

Only authorized people who need it access the data; they are bound by a contractual or statutory duty of confidentiality.

The processor implements the GDPR article 32 technical and organizational measures described in annex 1, and updates them to the state of the art without lowering their overall level.

The controller gives a general authorization to use the sub-processors listed in annex 2 and on the Sub-processors page.

• Any addition or replacement is notified at least 30 days in advance, by e-mail to the account holder and on that page.
• The controller may object on reasonable data protection grounds during that period. If no solution is found, it may terminate the affected service without penalty, with a refund of the unused prepaid period.
• Each sub-processor is contractually bound by obligations at least as protective; Penra remains liable to the controller for their performance.

Data is stored in the European Union (AWS eu-west-1, Ireland) and processed by functions running in Dublin. Any access from a third country by a sub-processor relies on the Commission’s standard contractual clauses (Decision 2021/914) or an adequacy decision (EU-U.S. Data Privacy Framework for certified companies).

• Data subject rights: the dashboard provides the tools needed (raw data export, retention per site, deletion of all of a site’s data). Any request received directly is forwarded to the controller within 5 business days, without answering it on its behalf.
• The processor provides the information needed for impact assessments (art. 35) and prior consultations (art. 36), and cooperates with the supervisory authority.
• It keeps the record of processing activities carried out on behalf of its customers (art. 30.2).

The processor notifies the controller of any personal data breach without undue delay and at the latest 48 hours after becoming aware of it, by e-mail to the account holder. The notice describes, as far as possible, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed; missing information follows as soon as it is known. Security contact: security@globatics.live.

Before the contract ends, the controller can retrieve its data (CSV, JSON and JSONL exports). When a site or the account is deleted, the data is erased immediately from the production database, and from backups within 30 days, unless the law requires keeping it. During the contract, raw events are purged automatically after the retention chosen for each site (760 days by default); live “moments” are erased after 7 days and the webhook delivery log after 30 days.

The processor makes available the information needed to demonstrate compliance with this agreement, first as documents (questionnaire answers, its sub-processors’ attestations). The controller, or an independent auditor bound by confidentiality that it appoints, may carry out an audit once a year, or after a breach, with 30 days’ notice, at its own cost and without disrupting the service or exposing other customers’ data.

Minimization

IP address never stored; random salt renewed every day (only today’s and yesterday’s kept); raw user agent not kept; URL parameters dropped except UTM; click labels truncated, digits and e-mails masked; Global Privacy Control honoured.

Encryption

TLS on every connection, HSTS; database and backups encrypted at rest by the provider.

Access control

Least-privilege application role, row-level security, schema not exposed; passwords hashed (scrypt), tokens and API keys stored hashed; two-factor authentication; rate limits and lockouts.

Isolation

Data keyed by site; authorization checked on every request; share links read-only and free of identifying data.

Traceability

Account security log kept 90 days; server error logging.

Availability

Managed hosting and database, backups according to the provider’s plan (kept 30 days at most); transactional migrations; health checks after every deployment.

Retention and erasure

Automatic purge after each site’s retention; site or account deletion in one transaction.

Organization

Production access limited to authorized people; sub-processors bound by a DPA; automated tests and dependency security updates.

The other providers on the Sub-processors page (payments, Google sign-in, AI assistant, sign-up bot protection) receive no personal data about visitors (the AI assistant only receives aggregated statistics). Icon services queried to show a referring site’s logo only receive its domain name, never data linked to a visitor.