Data processing agreement

1. Roles

You are the controller of visitor analytics data. Realific is your processor and processes it only on your documented instructions, which are your configuration of the service.

2. Nature and purpose

Collecting, storing and aggregating page views, events and payments to provide analytics and revenue attribution dashboards, reports and exports to you.

3. Categories of data and data subjects

Visitors to your websites: pseudonymous visitor and session IDs, page addresses, referrers, coarse location, device and browser, event data you send, user IDs and hashed emails you pass to identify(), and payment metadata. Raw IP addresses are not stored.

4. Confidentiality and security

Personnel with access are bound by confidentiality. Measures include encryption in transit and at rest, per-site database isolation, hashed credentials, role-based access and audit logging.

5. Sub-processors

You authorise the sub-processors listed below. We will give at least 30 days’ notice of new sub-processors by updating this page and emailing account owners, and you may object on reasonable grounds.

6. Assistance and breaches

We help you respond to data subject requests, including deleting a visitor across all storage, and notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data.

7. Transfers

Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses (module two, and module three for sub-processors) apply and are incorporated by reference.

8. Deletion and audits

On termination we delete visitor data within 30 days unless the law requires otherwise. We will make available the information needed to demonstrate compliance and allow reasonable audits, no more than once a year, with 30 days’ notice.

Sub-processors