DataEasy data processing agreement

Last updated October 30, 2026 · Template text, to be reviewed before publication.

This Data Processing Agreement ("DPA") is entered into between [Company legal name], [Registered address], operating DataEasy ("Processor", "we"), and [Customer legal name] ("Customer", "you"). It supplements our Terms of Service and applies whenever we process personal data on your behalf.

1. Roles

• Controller: you. You decide to measure your websites and why.
• Processor: us. We process visitor data only to provide DataEasy to you.
• Subprocessors: providers we rely on to run the service (section 6).

2. Subject matter and duration

We process personal data to collect, store and report website analytics and revenue attribution, for as long as you use DataEasy and until the data is deleted under section 9.

3. Categories of data and data subjects

• Data subjects: visitors of the websites where you install the DataEasy script, and your customers when you connect a payment provider.
• Data: pseudonymous visitor and session identifiers (stored in first-party cookies), pages viewed, referrers and campaign parameters, custom goals you send, browser/OS/device, approximate location, transient IP addresses, and payment details sent by your provider (amount, currency, customer name and email).
• Special categories: none. You must not send sensitive data in goal names, properties or URLs.

4. Your instructions and responsibilities

We process data only on your documented instructions, which are these terms, the DPA and your settings in DataEasy. You are responsible for having a lawful basis for the tracking, for informing your visitors, and for obtaining consent before the script sets cookies where the law requires it.

5. Our obligations

• Keep the data confidential and ensure our staff are bound by confidentiality.
• Implement the security measures in section 7.
• Help you answer data subject requests and carry out impact assessments, taking into account the information available to us.
• Notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach.
• Make available the information needed to demonstrate compliance with this DPA.

6. Subprocessors

You authorise us to use the subprocessors below. We will notify you at least 30 days before adding or replacing one, and you may object on reasonable grounds.

7. Security measures

• Encryption in transit (TLS) for the script, the ingestion endpoint and the dashboard.
• Row-level access control so each account only reads the websites it has access to.
• Least-privilege access for our staff, with service credentials kept out of source code.
• Signature verification for payment-provider webhooks, and idempotent storage of payments.
• Backups and monitoring provided by our hosting and database providers.

8. International transfers

Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision or the European Commission's standard contractual clauses, which are incorporated by reference.

9. Return and deletion

You can delete a website or your account at any time, which deletes the related analytics data. When the agreement ends, we delete the remaining personal data within 30 days, unless the law requires us to keep it.

10. Audits

On reasonable written notice, and no more than once a year unless a breach occurred, you may request information or an audit to verify compliance with this DPA, at your cost and subject to confidentiality.

11. Liability and governing law

Liability under this DPA follows the limits of the Terms of Service. This DPA is governed by the laws of [Governing law jurisdiction].

Questions about this DPA: ravasini.aziendale@gmail.com.