OptikAnalytics Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between OptikAnalytics LLC ("OptikAnalytics," "Processor," "we," "us," or "our") and the customer ("Customer," "Controller," "you," or "your") who's agreed to the Agreement.

This DPA governs the processing of personal data by OptikAnalytics on behalf of the Customer in connection with the provision of the OptikAnalytics web analytics service (the "Service"), in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, the UK GDPR, the California Consumer Privacy Act ("CCPA/CPRA"), and other applicable data protection laws.

By using the Service, you accept this DPA. No separate signature is required, but a countersigned copy is available on request.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
• "Processing" means any operation performed on Personal Data, as defined in Article 4(2) GDPR.
• "Controller" means the Customer, who determines the purposes and means of processing End User Personal Data through the Service.
• "Processor" means OptikAnalytics LLC, which processes Personal Data on behalf of the Controller.
• "End User" means a visitor to a website on which the Customer has installed the OptikAnalytics tracking script.
• "Analytics Data" means the website traffic and visitor behavior data collected by the Service on behalf of the Customer.
• "Data Protection Laws" means the GDPR, UK GDPR, CCPA/CPRA, ePrivacy Directive, PECR, and all other applicable data protection and privacy legislation.
• "Sub-processor" means any third party engaged by OptikAnalytics to process Personal Data on behalf of the Customer.
• "Standard Contractual Clauses" ("SCCs") means the standard contractual clauses approved by the European Commission (Decision 2021/914), Module 2 (Controller to Processor).

2. Roles and scope

2.1 Roles

The Customer is the Controller. OptikAnalytics is the Processor. This DPA applies to all Personal Data processed by OptikAnalytics on behalf of the Customer in connection with the Service.

For the Customer's own account data (name, email, billing information), OptikAnalytics acts as an independent Controller, as described in the OptikAnalytics Privacy Policy.

2.2 Scope of processing

OptikAnalytics processes Personal Data solely for the purpose of providing the Service to the Customer, as described in Annex 1.

3. Customer obligations

The Customer warrants that:

1. It's established a valid legal basis under Article 6 GDPR for the processing of Personal Data through the Service.
2. Its privacy notices accurately describe the processing performed through the Service.
3. It's implemented appropriate consent mechanisms where required, particularly when using Advanced Mode (which may set cookies and process IP addresses).
4. Its instructions to OptikAnalytics comply with applicable Data Protection Laws.
5. It won't use the Service to collect special categories of Personal Data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR).

The Customer remains responsible for its obligations as Controller under Chapters III and IV GDPR.

4. Processor obligations

OptikAnalytics shall:

1. Process on instructions only. Process Personal Data only on documented instructions from the Customer, which include this DPA, the Agreement, and the configuration settings selected by the Customer within the Service. If required by law to process Personal Data outside these instructions, OptikAnalytics will inform the Customer before processing, unless prohibited by law.
2. Maintain confidentiality. Ensure that all persons authorized to process Personal Data are bound by confidentiality obligations.
3. Implement security measures. Implement appropriate technical and organizational measures as described in Annex 2, in accordance with Article 32 GDPR.
4. Assist with data subject rights. Assist the Customer, by appropriate technical and organizational measures, in fulfilling its obligations to respond to data subject requests under Chapter III GDPR. OptikAnalytics will promptly forward any data subject request it receives directly to the Customer and won't respond without the Customer's written authorization, unless required by law.
5. Assist with compliance. Assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to OptikAnalytics.
6. Delete or return data. At the Customer's choice, delete or return all Personal Data after the end of the provision of the Service, and delete existing copies, unless applicable law requires storage. Deletion follows the schedule described in the Agreement: 30-day grace period after cancellation, then permanent deletion from active systems, with backup purge within 60 days.
7. Demonstrate compliance. Make available to the Customer all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or a qualified third-party auditor bound by confidentiality obligations.
8. Notify of instruction issues. Immediately inform the Customer if, in OptikAnalytics's opinion, an instruction infringes the GDPR or other applicable Data Protection Laws.

5. Sub-processors

5.1 Authorization

The Customer provides general written authorization for OptikAnalytics to engage the Sub-processors listed in Annex 3. OptikAnalytics ensures that each Sub-processor is bound by data protection obligations no less protective than those in this DPA.

5.2 Changes to sub-processors

OptikAnalytics will notify the Customer of any intended changes to Sub-processors (additions or replacements) via email or through the Service at least 30 days before the change takes effect. The Customer may object to a new Sub-processor on reasonable data protection grounds within that 30-day period. If the objection can't be resolved, the Customer may terminate the Agreement without penalty.

5.3 Liability

OptikAnalytics remains fully liable to the Customer for the performance of each Sub-processor's obligations under this DPA.

6. International data transfers

All Analytics Data is processed and stored on servers located in the United States, hosted by Cloudways (DigitalOcean infrastructure).

Where Personal Data is transferred from the European Economic Area, United Kingdom, or Switzerland to the United States or any other country not recognized as providing an adequate level of data protection, OptikAnalytics relies on the Standard Contractual Clauses (Module 2: Controller to Processor) as approved by the European Commission (Decision 2021/914).

The SCCs are incorporated into this DPA by reference, with:

• Clause 7: The optional docking clause is included.
• Clause 9(a): General written authorization (Option 2), with 30-day prior notice.
• Clause 11: The optional redress clause isn't included.
• Clause 13: The competent supervisory authority is the authority of the EEA member state in which the Customer is established, or, if the Customer isn't established in the EEA, the authority of the member state where the Customer's EU representative is appointed.
• Clause 17: Governing law is the law of Ireland.
• Clause 18: Disputes shall be resolved before the courts of Ireland.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs is incorporated.

7. Data breach notification

In the event of a Personal Data breach affecting Customer data, OptikAnalytics will:

1. Notify the Customer without undue delay and no later than 48 hours after becoming aware of the breach.
2. Provide the Customer with sufficient information to meet its obligations under Articles 33 and 34 GDPR, including:

• The nature of the breach
• The categories and approximate number of data subjects affected
• The likely consequences
• The measures taken or proposed to address the breach

1. Cooperate with the Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

8. Audits

The Customer may audit OptikAnalytics's compliance with this DPA once per calendar year, with at least 30 days' written notice. Audits may be conducted by the Customer or a qualified third-party auditor bound by confidentiality obligations. OptikAnalytics will provide reasonable cooperation and access to relevant documentation.

OptikAnalytics may satisfy audit requests by providing:

• Written confirmation that all requirements in this DPA are continuously upheld
• Relevant documentation, certifications, or third-party audit reports
• Responses to reasonable written questions

9. CCPA/CPRA provisions

To the extent the CCPA/CPRA applies:

1. OptikAnalytics acts as a "Service Provider" as defined under the CCPA.
2. OptikAnalytics won't sell or share (as defined under the CCPA) Personal Data.
3. OptikAnalytics won't retain, use, or disclose Personal Data outside of the direct business relationship with the Customer, except as permitted by the CCPA.
4. OptikAnalytics won't combine Personal Data received from the Customer with Personal Data received from other sources, except as permitted by the CCPA.
5. OptikAnalytics certifies that it understands and will comply with these obligations.

10. Liability

Each party's liability under this DPA is subject to the limitations set forth in the Agreement. Where OptikAnalytics acts as Processor, it's liable only for processing that doesn't comply with the obligations specifically directed to Processors under GDPR Article 28.

11. Term and termination

This DPA is effective for the duration of the Agreement. It terminates automatically when the Agreement terminates, subject to OptikAnalytics's obligations to delete or return Personal Data as described in Section 4.6.

12. Conflict

In case of conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict with respect to the processing of Personal Data. The SCCs, where applicable, prevail over this DPA.

13. Contact

For questions about this DPA or to request a countersigned copy:

OptikAnalytics LLC

Email: hello@optikanalytics.com

Website: optikanalytics.com

Annex 1: Description of processing

Subject matter: Provision of the OptikAnalytics web analytics service

Duration: For the term of the Customer's subscription, plus the data deletion period described in the Agreement

Nature and purpose: Collection, storage, and processing of website visitor analytics data to provide dashboards, reports, session replays, and heatmaps to the Customer

Categories of data subjects: End Users (visitors to websites where the Customer has installed the OptikAnalytics tracking script)

Categories of Personal Data (Lightweight Mode): Page URLs, referrer URLs, UTM parameters, country (derived from IP, then IP discarded), device type, browser, OS, screen resolution, session duration, goals, custom events. No cookies, no IP storage, no cross-site tracking

Categories of Personal Data (Advanced Mode): All Lightweight Mode data, plus: outbound link clicks, session replay recordings, click and scroll heatmap data, IP addresses, persistent identifiers via cookies or local storage

Sensitive data: None. The Service isn't designed to collect special categories of data

Annex 2: Technical and organizational security measures

OptikAnalytics implements the following measures pursuant to Article 32 GDPR:

Encryption

• Data in transit: TLS 1.2+ (HTTPS) for all connections
• Data at rest: Encrypted storage on hosting infrastructure

Access control

• Role-based access controls for internal systems
• Authentication required for all administrative access
• Principle of least privilege applied to all personnel

Infrastructure

• Hosted on Cloudways (DigitalOcean) infrastructure in the United States
• Managed firewalls and network isolation
• Automated backups with encrypted storage

Organizational

• All personnel with access to Personal Data are bound by confidentiality obligations
• Regular security reviews of infrastructure and application code
• Incident response procedures for prompt breach detection and notification

Data minimization

• Lightweight Mode: No cookies, no IP storage, no cross-site tracking, no fingerprinting
• Advanced Mode: IP addresses processed for session identification; input fields hidden by default in session replays
• Country derived from IP at the moment of the request, then IP discarded (Lightweight Mode)

Annex 3: Approved sub-processors

Cloudways / DigitalOcean

Purpose: Application hosting, data storage, and backups

Location: United States

Paddle (Paddle.com Market Limited)

Purpose: Payment processing, billing, invoicing, tax handling (Merchant of Record)

Location: United Kingdom / EU

ZeptoMail by Zoho

Purpose: Transactional email delivery (account confirmations, billing receipts, security alerts)

Location: See Zoho's data processing information

This list is current as of the date above. Changes will be communicated in accordance with Section 5.2.