Data Processing Agreement

1. Roles and scope

You are the controller and Otus is the processor of the personal data we process on your behalf through the Otus Analytics service ("Customer Data"), as described in Annex 1. This DPA applies from the moment you create an account, including during the free trial.

Personal data we process as a controller, such as your account, billing and support data and the access tokens of advertising platforms you connect, is covered by our Privacy Policy, not by this DPA.

2. Instructions

We process Customer Data only on your documented instructions. These are this DPA, the Terms of Service, and the settings you choose in the service, such as the tracking mode, connected conversion destinations and exports.

We will inform you if we believe an instruction infringes data protection law. If EU or member state law requires us to process Customer Data in another way, we will tell you beforehand, unless that law prohibits it.

3. Your responsibilities

You are responsible for having a lawful basis for the processing, for informing the visitors of your websites, and for obtaining consent where the law requires it, for example when you use full tracking mode or forward conversions to an advertising platform. When you forward conversions, you are responsible for passing the correct consent state with each event.

You will not send special categories of personal data (Article 9 GDPR), such as health or medical information, data about criminal convictions (Article 10 GDPR), or directly identifying data such as names, email addresses or phone numbers, including in hashed form, through events, event parameters or user properties. This includes data that reveals a visitor's health, such as the medical products, medicines or treatments they view, search for or buy.

4. Confidentiality and security

Everyone at Otus with access to Customer Data is bound by confidentiality. We apply the technical and organisational measures described in Annex 2, and may update them as long as the overall level of protection does not decrease.

5. Sub-processors

You give us general authorisation to engage sub-processors. The current list is in Annex 3.

We will notify you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot accommodate your objection, you may terminate the service before the change takes effect and we will refund any prepaid fees for the remaining period.

Each sub-processor is bound by data protection obligations equivalent to this DPA, and we remain responsible for their performance. We only use sub-processors that process Customer Data within the European Economic Area.

6. Conversion forwarding and transfers

We do not transfer Customer Data outside the European Economic Area, with one exception you control.

If you connect an advertising platform such as Google Ads, we forward conversion data to that platform on your instruction. These platforms are not our sub-processors. They receive the data under your own agreement with them, and some may transfer it outside the EEA. You are responsible for the lawful basis of that forwarding and for any resulting transfer. When you disconnect a platform, we stop forwarding data to it.

7. Assistance

We will help you respond to requests from data subjects exercising their GDPR rights, as far as the nature of the processing allows. Requests we receive directly are forwarded to you without undue delay.

We will also help you meet your own GDPR obligations where they involve our part of the processing, by providing the information you need about how Otus processes and protects your data. This covers keeping data secure (Article 32), reporting a data breach to the supervisory authority (Article 33), informing affected individuals about a breach (Article 34), carrying out a data protection impact assessment (Article 35), and consulting the supervisory authority when that assessment shows a high risk (Article 36).

8. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. We will provide the information you need for your own notification under Article 33 GDPR, in phases if not everything is known yet.

9. Retention and deletion

During your subscription, Customer Data is kept for the retention period of your plan and then deleted or irreversibly aggregated.

If your trial ends without a paid plan, or your subscription ends, we keep Customer Data for 30 days. During that period you can upgrade without losing data, and export it if your plan includes data exports. After those 30 days, we delete Customer Data, and it is removed from backups within a further 30 days, unless the law requires us to keep it.

10. Audits

We will make available the information needed to demonstrate compliance with Article 28 GDPR. You may audit our compliance once a year, or after a personal data breach, with 30 days' notice, at your own cost, and through an auditor bound by confidentiality. We may first answer your questions in writing, and where those answers are sufficient, no further audit is needed.

11. Notices and changes

Notices under this DPA, including breach notifications, are sent to the email address of your account owner. You can send instructions and questions about this DPA to info@otusanalytics.com.

We may update this DPA to reflect changes in the law or the service. We will notify you of material changes at least 30 days in advance. Changes will not reduce the level of protection of Customer Data.

12. General

Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of Customer Data, this DPA prevails. This DPA is governed by Dutch law, and disputes are submitted to the competent court in Amsterdam, the Netherlands.

Annex 1: Description of processing

Purpose: web analytics, reporting, AI-generated summaries, exports and, where you enable it, forwarding of conversions to advertising platforms.

Duration: the term of your trial and subscription, plus the deletion period in Section 9.

Data subjects: visitors of your websites.

Personal data, cookieless tracking mode (default):

• IP address, used to determine the country and to generate the anonymous daily identifier. It is not stored in analytics data. Server logs may contain it for up to 30 days for security and troubleshooting.
• Anonymous daily identifier, generated server-side and rotated every day
• Technical data about the browser and device
• Page, referrer and campaign data
• Engagement and interaction data
• Custom events, parameters and e-commerce data you choose to send

Additionally in full tracking mode: a first-party session cookie, a persistent visitor identifier stored in the browser, and user properties you choose to send.

Additionally with conversion forwarding: advertising click identifiers, the consent state you pass, and conversion details (event, value, currency, time).

Annex 2: Technical and organisational measures

• All infrastructure hosted by Hetzner in Germany and Finland, with all other sub-processors located in the EU
• All data in transit encrypted with TLS
• Access tokens for connected advertising platforms stored encrypted
• IP addresses not stored in analytics data, and server logs deleted after 30 days
• Access to production systems limited to the founders
• Customer Data logically separated per account and site
• Automated deletion based on plan retention and the periods in Section 9

Annex 3: Sub-processors