Data Processing Agreement

1. Roles

• You are the controller: you decide to measure your websites, for what purpose, and which script to use.
• Datasense is the processor: we process visitor data only to provide analytics, error tracking and the related features to you.
• Subprocessors are vendors that help us run the service (section 7).

2. Details of processing

• Subject matter and purpose: collecting, storing and reporting website analytics and JavaScript errors for your websites.
• Duration: for as long as you use the service, plus the deletion period in section 9.
• Data subjects: visitors of the websites where you install Datasense.
• Data processed: page URLs and titles, referrers, campaign parameters, browser, operating system and device type, country, region and city derived from the IP address, a daily-rotating hash of IP address and user agent, a per-tab session id, JavaScript error details, and any custom events, goals, revenue events or user identities you send. IP addresses are used transiently to derive location and the hash, and are not stored.
• Special categories: none. You agree not to send special-category data, or direct identifiers beyond the user identities you choose to send (see our Terms, section 5).

3. Cookies and consent

The cookieless script sets no cookies and stores no persistent identifiers on visitors' devices; it uses only a per-tab session id in session storage, deleted when the tab closes. Whether you still need consent or a notice for it under the ePrivacy rules and local law that apply to you is your responsibility to assess. If you switch a site to the cookie script, the cookie script version of this DPA applies to it.

4. Our obligations

• Process personal data only on your documented instructions, which are these terms and your use of the dashboard and API.
• Tell you if we believe an instruction breaks data protection law.
• Make sure everyone with access to the data is bound by confidentiality.
• Never sell the data, use it for our own marketing or profiling, or combine it with other customers' data.
• Help you, as far as reasonably possible, with data subject requests, impact assessments and consultations with regulators.

5. Your obligations

• Have a lawful basis for measuring your visitors, and tell them about it in your privacy policy.
• Check whether the rules that apply to you require a notice or consent for the cookieless script (section 3).
• Only send us the data the service needs, and none of the data excluded in section 2.
• Handle requests from your visitors; we'll help where the data lets us.

6. Security

We maintain technical and organisational measures appropriate to the risk, including:

• HTTPS encryption for all data in transit;
• data minimisation by design: no stored IP addresses, no cookies, and daily-rotating visitor hashes;
• access controls so each customer sees only their own sites, and production access limited to Datasense operators;
• separate credentials with least privilege for each service, and firewalled databases;
• regular backups and monitoring.

7. Subprocessors

You authorise us to use these subprocessors:

• Oracle Cloud Infrastructure: hosting and the analytics database;
• Cloudflare: DNS, network protection and TLS;
• Neon: account and configuration database;
• Resend: transactional email (customer data only);
• Dodo Payments: billing (customer data only).

We'll update this list and email you at least 14 days before adding or replacing a subprocessor that handles visitor data. You can object for reasonable data protection reasons; if we can't address it, you can close your account. We impose data protection terms on each subprocessor at least as protective as this DPA, and remain responsible for them.

8. International transfers

Data may be processed outside the EEA, the UK and Switzerland. For those transfers we rely on adequacy decisions or the Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated into this DPA by reference.

9. Breaches, deletion and audits

• Breaches: we'll notify you without undue delay, and within 72 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
• Deletion: you can export your data at any time. When you delete a site or close your account, we delete the related data within 30 days, and from backups as they roll over, unless the law requires us to keep it.
• Audits: we'll answer reasonable written questions about our compliance and share relevant documentation, at most once a year unless a regulator requires more or there has been a breach.

10. Liability and governing law

Liability under this DPA is subject to the limits in the Terms of Service. If this DPA and the terms conflict on data protection, this DPA wins. It is governed by the laws of India, except where the Standard Contractual Clauses require another law.

Signatures