Data Processing Agreement

“Data Protection Laws” means all privacy and data protection laws that apply to the processing under this DPA: first, the Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”) and the Information Technology Act, 2000 with the SPDI Rules, 2011; and, where they apply, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), the ePrivacy rules as implemented locally, and US state privacy laws such as the California Consumer Privacy Act (“CCPA”).

“Customer Personal Data” means personal data within Customer Data (as defined in the Terms) that Trakily processes on your behalf. Data Fiduciary, Data Processor, Data Principal and personal data breach have the meanings given in the DPDP Act. Where the GDPR applies, they correspond to controller, processor, data subject and personal data breach, and supervisory authority has the meaning given in the GDPR.

• You are the Data Fiduciary (controller), or a processor acting for your own controller, of Customer Personal Data. Trakily is your Data Processor (or subprocessor).
• This DPA does not cover data Trakily handles as a Data Fiduciary, such as your account and billing information. That is described in our Privacy Policy.
• You are responsible for the lawfulness of the processing you instruct, including giving notice to Visitors, obtaining any consent required (under the DPDP Act, or for cookies and similar technologies under ePrivacy rules), and having a lawful basis to share revenue data from your payment provider.
• You must not use the Service to process personal data of children (under 18 under the DPDP Act) without the verifiable parental consent the law requires, or to track or behaviourally monitor children.

Trakily processes Customer Personal Data only on your documented instructions and only to provide the Service. The Terms, this DPA, and your configuration of the Service (for example the script version you install, exclusions, integrations and sharing settings) are your complete instructions. Trakily will tell you if it believes an instruction breaks Data Protection Laws.

If the law requires Trakily to process Customer Personal Data otherwise, Trakily will tell you before doing so unless the law forbids it.

Trakily limits access to Customer Personal Data to personnel who need it to provide, secure or support the Service, and makes sure they are bound by confidentiality obligations. Trakily does not access the contents of your dashboards except to provide support you request, to investigate a security or abuse issue, or when required by law.

Trakily implements reasonable security safeguards, as the DPDP Act and the IT Act require, and appropriate technical and organisational measures under Article 32 of the GDPR, to protect Customer Personal Data and prevent personal data breaches, taking into account the state of the art, the cost of implementation and the risks involved. The current measures are described in Annex: security measures. Trakily may update them over time, provided the overall level of protection is not reduced.

• You give Trakily general authorisation to engage subprocessors. The current list is on our Subprocessors page.
• Trakily will give at least 30 days' notice before adding or replacing a subprocessor, by updating that page and emailing account owners who ask to be notified.
• You may object on reasonable data protection grounds within that period. We will try to find a reasonable alternative; if we cannot, you may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining period.
• Trakily imposes data protection terms on each subprocessor that are at least as protective as this DPA, and remains responsible for their performance.

Services you connect yourself, such as your payment provider, Google, Meta, Slack or Discord, are not Trakily's subprocessors; they act under your own agreements with them.

Taking into account the nature of the processing, Trakily will assist you with appropriate technical and organisational measures in answering requests from Data Principals (data subjects) to exercise their rights, such as access, correction, erasure, grievance redressal and, under the GDPR, restriction, objection and portability. Because Trakily does not hold names or contact details for most Visitors, you will usually need to supply the identifier concerned (for example the visitor id from the _trakily_vid cookie, an identify() user id or a customer email). If Trakily receives a request directly, it will forward it to you and will not respond itself except to direct the person to you.

Trakily will notify you without undue delay, and in any case in time for you to meet your own deadlines, after becoming aware of a personal data breach affecting Customer Personal Data, so that you can inform the Data Protection Board of India and affected Data Principals as the DPDP Act requires, and, where the GDPR applies, the supervisory authority within 72 hours. The notice will describe, as far as is then known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Trakily will provide further information as it becomes available.

Notifying you of a breach is not an acknowledgement of fault or liability.

Trakily will give you reasonable information and help, taking into account the nature of the processing and the information available to it, for any data protection impact assessment or audit you are required to carry out in relation to the Service (for example as a Significant Data Fiduciary under the DPDP Act), and for any prior consultation with a supervisory authority under the GDPR.

Customer Personal Data is hosted with DigitalOcean in the United States. Trakily operates from India and accesses it from there to provide and support the Service. Some subprocessors process it in other countries, as listed on the Subprocessors page.

Under Indian law

The DPDP Act permits transfers of personal data outside India except to countries the Government of India restricts by notification. The United States is not restricted. You authorise Trakily to transfer and store Customer Personal Data there for the purposes of this DPA. If a country we use becomes restricted, Trakily will tell you and move the affected processing to a permitted location.

Standard Contractual Clauses (EU)

Where Customer Personal Data is subject to the GDPR and is transferred to Trakily in India or onward to a country without an adequacy decision, the parties agree that the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 (the “SCCs”) apply, are incorporated into this DPA by reference, and are completed as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor acting for your own controller. You are the data exporter and Trakily is the data importer.
• Clause 7 (docking clause) applies.
• Clause 9: Option 2 (general written authorisation) applies. Trakily will inform you of any intended addition or replacement of subprocessors at least 30 days in advance, as described in Subprocessors.
• Clause 11: the optional language on an independent dispute resolution body does not apply.
• Clause 13: the competent supervisory authority is determined as set out in Clause 13(a) and Annex I.C.
• Clause 17: Option 1 applies; the SCCs are governed by the law of Ireland.
• Clause 18: disputes arising from the SCCs are resolved by the courts of Ireland.
• Annex I (list of parties, description of transfer, competent supervisory authority): Part A is you and Trakily, with the contact details in your account and in the Terms; Part B is Details of the processing; Part C is the supervisory authority under Clause 13.
• Annex II (technical and organisational measures) is Annex: security measures.
• Annex III (list of subprocessors) is the Subprocessors page.

UK Addendum

Where Customer Personal Data is subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) applies and is incorporated by reference. Table 1 is completed with the parties' details above; Table 2 with the modules and options selected above; Table 3 with the Annexes described above; and in Table 4 neither party may end the Addendum under its Section 19. References in the SCCs to the GDPR, EU Member States and the EU are read as the Addendum requires.

Switzerland

Where Customer Personal Data is subject to the FADP, the SCCs apply with these adjustments: the Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to the GDPR are read as references to the FADP where it applies; and the term “Member State” does not prevent data subjects habitually resident in Switzerland from bringing claims in their place of habitual residence under Clause 18(c).

Other mechanisms and precedence

For onward transfers to subprocessors, Trakily puts in place equivalent safeguards. Our hosting provider is also certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework. If the SCCs or the UK Addendum conflict with this DPA, they prevail.

• Deleting a Website or an import in the dashboard deletes the related Customer Personal Data from Trakily's live systems straight away.
• Deleting your account suspends it and the Websites you own alone for 30 days (no collection, no share links, widgets or API access), so you can restore it. After that, the account, those Websites and all their Customer Personal Data are deleted.
• Backups are kept for 14 days, so deleted data disappears from them within 14 days.
• When a trial or subscription ends, dashboards lock and collection pauses 15 days later (also 15 days after a failed payment, or after usage passes 120% of the plan's monthly events), but Customer Personal Data is kept so you can resume by choosing a plan, until you delete it or your account.
• Pausing processing. You can pause tracking for a Website in its settings at any time. While collection is paused for any reason, Trakily stores no new Customer Personal Data for that Website; already stored data is kept as described here. On resume, revenue, Search Console and Meta Ads data for the paused period is fetched again from those providers; visitor events from the pause are never collected.
• Storage limit. Whatever your plan, analytics data older than 10 years is deleted automatically.

Before deleting, you can export your data from the dashboard or ask us at [email protected] for a copy in a common format. Trakily may keep data where the law requires it, and will keep it protected and process it only for that purpose. The minimal billing record and deletion log Trakily keeps after an account deletion are Trakily's own records, not Customer Personal Data (see the Privacy Policy).

Trakily will make available the information reasonably needed to show that it meets its obligations under this DPA, by answering security questionnaires and providing relevant documentation. If that is not enough to satisfy a requirement of Data Protection Laws, or a supervisory authority requests it, you may carry out an audit, at your own cost, with at least 30 days' notice, during business hours, no more than once a year, and under appropriate confidentiality terms. Trakily does not currently hold third-party security certifications.

To the extent the CCPA or similar US state laws apply, Trakily acts as your service provider or processor. Trakily will not sell or share Customer Personal Data, will not retain, use or disclose it for any purpose other than providing the Service, will not combine it with personal data from other sources except as those laws permit, and will notify you if it can no longer meet these obligations.

Where the GDPR, the UK GDPR or the FADP applies to Customer Personal Data, the sections above set out the terms required by Article 28(3) of the GDPR (and their UK and Swiss equivalents): processing only on documented instructions, including for transfers; confidentiality; security under Article 32; the conditions for engaging subprocessors; assistance with data subject requests, security, breach notification, impact assessments and prior consultation; deletion or return at the end of the Service; and information and audits. Transfers are covered by the Standard Contractual Clauses and the UK Addendum.

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow it. This DPA is governed by the laws of India, and the courts at Jaipur, Rajasthan have exclusive jurisdiction, as in the Terms, except that the SCCs and the UK Addendum are governed by the law and courts they specify. If this DPA conflicts with the Terms on a data protection matter, this DPA prevails. This DPA ends automatically when Trakily stops processing Customer Personal Data for you. Grievances about Trakily's handling of personal data can also be raised with our Grievance Officer.

This annex describes the measures Trakily currently applies. It is written to describe what we actually do, not to claim certifications we do not hold.

Encryption

• All traffic to the dashboard, API and tracking endpoint is served over HTTPS (TLS).
• Integration secrets (payment provider API keys, webhook secrets, OAuth refresh and access tokens) are encrypted with AES-256-GCM at the application level before being written to the database, using a key held separately from the database.
• The database and its backups are stored on DigitalOcean infrastructure in the United States.

Access control and authentication

• Account passwords are stored only as salted scrypt hashes; minimum length is enforced.
• Sessions use random tokens in HTTP-only cookies, expire after 30 days without use, and are all revoked when a password is reset. Password reset links expire after 1 hour and work once; reset requests are throttled.
• Each Website has role-based access (owner, member, viewer). Every dashboard and API request is checked against the user's role for that Website.
• API keys are scoped to a single Website and can be revoked at any time.
• OAuth flows for Google and Meta use encrypted, expiring state values bound to the user and Website that started them.
• Access to production systems is limited to personnel who need it.

Data minimisation

• IP addresses are used transiently during event processing and are not stored with analytics events.
• Location is reduced to country, region and city; the user agent is reduced to browser, version, operating system and device type.
• Custom properties are limited in number and length; campaign and click parameters are separated from page URLs.
• The cookieless mode uses daily-rotating salts; each day's salt is deleted two days after that day ends.
• Integrations request read-only access wherever the provider offers it.

Integrity and availability

• Incoming payment-provider webhooks are verified against their signatures before being processed.
• The tracking endpoint filters known bots, validates every event against the Website's allowed hostnames, and supports rate limiting and a flood protection mode during traffic floods.
• Uploaded import files are size-limited and checked before processing.
• The Service is hosted with DigitalOcean in the United States. The database is not reachable from the internet, and is backed up every night; each backup is kept for 14 days.

Organisational measures

• Confidentiality obligations for everyone with access to Customer Personal Data.
• Subprocessors are selected for their security practices and bound by data protection terms.
• An incident response process for investigating and notifying personal data breaches.