tidekeeper

Data processing agreement

This agreement is between you, the customer that made the account (the controller), and Point Free ApS, CVR 46560590 (the processor, "we"). It is the agreement Article 28 of the GDPR asks for, about the personal data your sites send to tidekeeper. You accept it when you make an account, or on the Plan screen; who accepted it, and when, is on record there. It is part of the terms of service at /terms, and where the two differ about personal data, this agreement holds.

1. What is processed

Annex 1 says what is processed, whose it is, for what, and for how long.

2. What you are responsible for

That you may have us process the data: a lawful basis for it, and visitors' consent wherever the law asks for it.
What you tell your visitors, and answering them.
How you set tidekeeper up: which sites, which mode, which query parameters are kept, and what you send with events and visitors. Send nothing Annex 1 does not list, and no special category of personal data.
That your instructions are lawful.

3. What we do

Process the data only on your documented instructions: this agreement, the terms, the settings you choose in tidekeeper, and what we agree in writing. If EU or Danish law requires other processing, we tell you first, unless that law forbids it. If we think an instruction breaks the GDPR, we tell you, and need not follow it.
Keep the data confidential, and let near it only people who need it for their work and are bound to confidentiality.
Protect it with the measures in Annex 2. We may change them, as long as the protection does not get weaker.
Use other processors only as section 4 says.
Help you answer visitors who use their rights, first with the tools in tidekeeper (Data requests). A request a visitor sends to us, we pass on to you; we do not answer it ourselves unless you ask us to.
Help you with security, breach notification, impact assessments and prior consultation (Articles 32 to 36), with what we know about tidekeeper.
Tell you without undue delay after we become aware of a personal data breach that touches your data, with what we know then and what we are doing about it, and more as we learn it.
When your account ends, delete the data, and from backups as they expire, within 30 days, unless EU or Danish law makes us keep it. You can export it before it ends; that export is how it is returned to you.
Give you what you need to see that we keep this agreement, as section 6 says.

Help that goes beyond what tidekeeper and its documentation already give is at your cost, agreed beforehand.

4. Other processors

You allow us to use the processors listed at /subprocessors.
We tell owners by email at least 30 days before we add or replace one. Where a sudden change is needed to keep tidekeeper running or safe, we tell you as soon as we can instead.
You may object in writing, on grounds of data protection, before the change applies. If we cannot meet the objection, you may close the account before the change applies.
Each processor is bound by contract to duties on data protection like these. We answer to you for what they do as for what we do.

5. Where the data is

We store and process the data in the EEA. It goes outside the EEA only where you tell us to send it there (for example, by connecting a tool outside the EEA to tidekeeper, or by having reports mailed to an address hosted there) or under the safeguards Chapter V of the GDPR asks for.

6. Information and audits

We answer your reasonable written questions about how we keep this agreement, and give you the documentation we have.
Where that is not enough, or an authority asks for it, you may have an audit made, at most once a year: with 30 days' notice, in working hours, by an independent auditor who is bound to confidentiality and is not our competitor, and without access to other customers' data. You pay for the audit, and for our time on it at a rate agreed beforehand.

7. Liability, how long, and law

This agreement lasts as long as we process personal data for you.
Liability under it is limited as the terms say.
Danish law applies, and the courts the terms name.

Annex 1: what is processed

Subject and purpose: counting visits to the sites you add, and showing the figures to you and to whoever you share them with.
Nature: receiving, enriching, storing, counting, showing, exporting and deleting.
Whose data: the visitors of your sites, and the people you name with a user ID of your own.
For how long: while your account exists, and as section 3 says after.

In easy mode, for each request:

The visitor's network address and browser description. Used once, on our machine, to find the country (and region, where the site's settings ask for it), to reduce the browser to its family, system and kind of device, and to make the visitor key; then dropped. A web server error can name the address, in a log kept for two days.
The visitor key, made from these, the site and that day's secret. Kept until the end of the UTC day, when the secret is destroyed and the key is removed from that day's records.
The page (its address, with only the query parameters you choose to keep), where the visitor came from, campaign tags, the window's width, the time, and the events the site's settings turn on (such as links out, downloads and time on the page) or that you send.

In hard mode, as well, for visitors who agreed:

A random ID, kept in a cookie for as long as your banner says.
The pages, events, clicks and purchases under that ID, and a user ID and properties if you send them. Deleted the number of days you choose after the visitor's last visit, at most 395.
Their answer to the banner, with the version of the words they were shown. Kept as proof of it, also after the rest of their data is deleted.
For visitors who said no, or whose browser sends Global Privacy Control: that answer, with no ID.

Annex 2: how the data is protected

Everything between browsers and tidekeeper goes over TLS.
tidekeeper runs on machines in the EU, reached only by named people with keys of their own.
Each day's visitor secret is kept in memory and on the machine's own disk, never in the database or in a backup, and destroyed at the end of the UTC day.
Visitors' network addresses are not written to any access log.
Members of an account see only what its owners let them. A hard-mode visitor's record is opened only by members their owners allow, and every opening is logged.
Our people reach customers' data only where they need to, to run, secure or repair tidekeeper, or where the law makes us.
The database is backed up at least daily, encrypted, and backups are kept no longer than 30 days.