Data processing agreement

1. Roles

The customer is the controller of visitor data and Calmstats is the processor. Calmstats processes that data only to provide the Service and only on the customer's documented instructions, which are these terms and the settings the customer chooses in the dashboard. If we believe an instruction breaks data protection law, we will tell the customer.

2. Details of the processing

• Subject matter and purpose: website analytics, revenue attribution, alerts and reports.
• Duration: for as long as the customer uses the Service, plus the deletion periods below.
• Data subjects: visitors of the customer's websites and, where the customer connects them, the customer's own buyers.
• Categories of data: random visitor and session IDs, pages viewed, referrers, campaign tags, device category, screen width, country, scroll and activity signals, a daily-rotating hash of the IP address, events and properties the customer sends, and payment amounts and dates from connected payment accounts.
• Special categories: none. Customers must not send sensitive data to the Service.

3. Confidentiality and security

People who can access customer data are bound by confidentiality. We keep appropriate technical and organisational measures in place, including encryption in transit, encrypted storage of connection secrets, access limited by role, row-level access controls in the database, and logging of production jobs. Raw IP addresses are not stored with analytics data.

4. Subprocessors

The customer gives Calmstats general authorisation to use subprocessors for hosting, data storage and email delivery. We bind each one by contract to data protection terms at least as protective as these, and remain responsible for their work. The current list is available on request at hello@calmstats.com. Customers who ask to be notified will hear from us before a new subprocessor is added, and may object on reasonable grounds; if we can't resolve the objection, the customer may cancel and receive a prorated refund of the unused period.

5. International transfers

Customer data is stored in Australia. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the parties agree to the applicable Standard Contractual Clauses (Module 2, controller to processor, and Module 3 for onward transfers to subprocessors) and the UK addendum, which are incorporated by reference.

6. Assistance and data subject requests

Taking into account the nature of the processing, we will help the customer respond to requests from data subjects and with data protection impact assessments and consultations with authorities. If we receive a request directly from a visitor, we will pass it to the customer and not answer it ourselves unless the customer asks us to.

7. Personal data breaches

We will notify the customer without undue delay, and where possible within 72 hours, after becoming aware of a breach affecting their data, with the information the customer needs to meet its own obligations.

8. Deletion

Analytics data is deleted automatically after the retention period of the customer's plan. Customers can purge a website's data or delete a website at any time. When an account closes, we delete its data within 30 days, apart from backups, which are overwritten on their normal cycle, and records we must keep by law.

9. Audits

We will make available the information reasonably needed to show compliance with this agreement. If that is not enough, the customer may request an audit once a year, at its own cost, with reasonable notice and subject to confidentiality.

10. Other privacy laws

Where the California Consumer Privacy Act or similar laws apply, Calmstats acts as a service provider: we do not sell or share customer personal data, and do not use it for any purpose other than providing the Service.