Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Akovana UAB, company code 302859437, registered at Didzioji Street 18, 01128 Vilnius, Lithuania, operating the Service under the name OpenMetrica ("Processor"), and the customer ("Controller"), and governs the processing of personal data in connection with the Service.

This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

"Personal Data" means any information relating to an identified or identifiable natural person as defined in Article 4(1) GDPR.

"Processing" means any operation performed on Personal Data as defined in Article 4(2) GDPR.

"Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

Subject matter: Provision of web analytics services

Duration: For the term of the Agreement

Nature and purpose: Collection of pageview and event data, derivation of pseudonymous visitor values, and aggregation into website statistics

Categories of data subjects: Visitors to the Controller's websites

Types of Personal Data processed:

• Page URLs and referrer URLs
• Browser type and operating system (non-identifying categories)
• Country-level geolocation
• Screen size category
• IP address and User-Agent of each request, processed at ingestion and not stored
• Two one-way values derived from them, a daily visitor hash and a 90-day funnel pseudonym, and a session identifier
• Time of each pageview or event, UTM parameters, and the names and properties of custom events the Controller's site sends

Note: IP addresses are processed at ingestion and are not stored. OpenMetrica sets and reads no cookies. The data collected is designed to be non-personal by default.

OpenMetrica as the Processor shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure that persons authorized to process the data have committed to confidentiality
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject requests
• Delete or return all Personal Data upon termination of the Agreement
• Make available all information necessary to demonstrate compliance with Article 28 GDPR
• Submit to and contribute to audits and inspections by the Controller or an appointed auditor

OpenMetrica uses the following sub-processors:

• Hetzner Online GmbH (Germany) — Server infrastructure and data hosting
• Stripe, Inc. (USA, with EU data processing) — Payment processing
• Postmark / ActiveCampaign (USA, with EU data processing) — Transactional email delivery

The Controller grants general authorization for the use of sub-processors, subject to the Processor informing the Controller of any intended changes. The Controller may object to changes within 14 days.

OpenMetrica implements the following technical and organizational measures:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Access control with role-based permissions and two-factor authentication
• Regular security audits and penetration testing
• Automated backups with encrypted storage
• Incident detection and response procedures
• ISO 27001-compliant data center facilities

In the event of a personal data breach, the Processor shall notify the Controller without undue delay and no later than 48 hours after becoming aware of the breach.

The notification shall include:

• A description of the nature of the breach
• Categories and approximate number of data subjects affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

All analytics data is processed and stored exclusively within the European Union. OpenMetrica does not transfer analytics data to any country outside the EU/EEA.

Where sub-processors are based outside the EU (e.g., Stripe for payment processing), appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and supplementary measures as required.

This DPA shall remain in effect for the duration of the Agreement. Upon termination, the Processor shall, at the Controller's choice, delete or return all Personal Data within 30 days and certify the deletion in writing.