Data processing agreement

This agreement applies when VALUNLABS LLC, which provides Plaintrace (the processor), processes personal data on behalf of a customer (the controller) to provide website analytics. It forms part of the terms of service.

Subject matter and duration

Measuring visits to the controller’s websites and reporting on them, for as long as the controller’s account exists.

Categories of data subjects and data

Data subjects: visitors to the controller’s websites.

Data: pseudonymous daily visitor hashes; sanitised page addresses and titles; referrers and UTM parameters; browser, operating system, device type and language; country, region and city; engagement time and scroll depth; events and properties defined by the controller; heatmap clicks if enabled; a keyed hash of a user id if the controller calls identify; payment records (amounts, fees, refunds, the credited visit) if the controller connects Stripe. IP addresses are processed transiently in memory and are not stored.

Processor obligations

Plaintrace processes data only on the controller’s documented instructions, keeps it confidential, assists with data subject requests and impact assessments where it can, and informs the controller without undue delay of any personal data breach.

Security measures

Encryption in transit; encrypted secrets at rest; daily-rotated, deleted salts; no storage of raw IP addresses; access limited to staff who need it; durable queuing; automated tests for these guarantees. See security.

Sub-processors

All processing and storage takes place in the EU. The list of sub-processors will be published here before launch, and the controller will be told of changes in advance with the right to object.

Deletion

Deleting a site deletes its analytics data. On termination, data is deleted unless the law requires it to be kept.

Audits

Plaintrace makes available the information needed to show compliance and allows for reasonable audits.