Data processing addendum

This Data Processing Addendum (“DPA”) is between the Customer and Meek Media LLP, which operates Statsy (https://statsy.co) (“Statsy”, “Processor”). It forms part of the Terms of Service and applies automatically when the Customer uses Statsy to process personal data. A countersigned copy is available but not needed for this DPA to apply.

If this DPA and the Terms conflict on the protection of personal data, this DPA prevails. If this DPA and the Standard Contractual Clauses conflict, the Clauses prevail.

• Data Protection Law means every law that applies to the processing of Customer Personal Data, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and other US state privacy laws, and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• Customer Personal Data means personal data about visitors to the Customer’s websites, or people the Customer identifies, that Statsy processes for the Customer. It does not include account data about the Customer’s own users of Statsy, which our Privacy Policy covers.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Subprocessor means a third party engaged by Statsy that processes Customer Personal Data.
• Standard Contractual Clauses means the clauses adopted by European Commission Implementing Decision (EU) 2021/914, and the UK International Data Transfer Addendum where relevant.

The Customer is the controller of Customer Personal Data and Statsy is its processor. Under US state privacy laws Statsy acts as the Customer’s service provider, and under the DPDP Act the Customer is the Data Fiduciary and Statsy a Data Processor. The subject matter, duration, nature, purpose and categories of data are set out in Annex I.

• Have a lawful basis for the processing and give visitors the notices, choices and, where required, consent that Data Protection Law demands for the tracking mode the Customer selects.
• Not send Statsy special category data, children’s data collected without required parental consent, payment card numbers, passwords or government identifiers in URLs, events or identify calls.
• Make sure its instructions to Statsy comply with Data Protection Law.

Statsy will:

• Process Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s settings in Statsy are those instructions. Statsy will tell the Customer if it believes an instruction breaks Data Protection Law.
• Not sell or share Customer Personal Data, use it for advertising or profiling, or combine it with data from other customers or other sources, except to provide the service the Customer configured.
• Ensure everyone authorised to access Customer Personal Data is bound by confidentiality and accesses it only as needed to operate, support or secure Statsy.
• Use only aggregated, de-identified measurements (such as event volumes) to run and improve the service. These never identify the Customer, its sites or its visitors.

Statsy maintains the technical and organisational measures in Annex II, appropriate to the risk of the processing. Statsy may update them as technology changes, but will not reduce the overall level of protection.

The Customer gives general authorisation for the Subprocessors in Annex III. Statsy binds each Subprocessor to data protection terms at least as protective as this DPA and remains responsible for its performance.

Statsy will update Annex III and email account owners at least 14 days before a new Subprocessor begins processing. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may stop using the affected part of Statsy or close its account, and receive a pro-rata refund of any prepaid fees for the unused period.

Taking into account the nature of the processing, Statsy will assist the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects and Data Principals, and will give reasonable help with data protection impact assessments and consultations with supervisory authorities. The Customer can look up a visitor’s journey in Statsy itself; Statsy will delete a specific visitor’s data when the Customer asks. If a request reaches Statsy directly, Statsy will pass it to the Customer rather than answer it.

Statsy will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as then known, the nature of the breach, the categories and approximate volume of data and people affected, the likely consequences, and the measures taken or proposed. Statsy will update the Customer as it learns more and will take reasonable steps to contain and remedy the breach.

Notifying a breach is not an admission of fault or liability.

The Customer can export its data from Statsy at any time. When the Customer deletes a site or closes its account, Statsy deletes the related Customer Personal Data from its live systems, and it is removed from encrypted backups within 35 days, unless Data Protection Law requires Statsy to keep it. On request, Statsy will confirm the deletion in writing.

Statsy will make available the information reasonably needed to demonstrate compliance with this DPA. Once every twelve months, on written request, Statsy will answer a reasonable security questionnaire. Where Data Protection Law or a supervisory authority requires more, the Customer or an independent auditor bound by confidentiality may carry out an audit with at least 30 days’ notice, during business hours, without disrupting the service, at the Customer’s cost.

Statsy may process Customer Personal Data in the countries listed in Annex III. Transfers of personal data from the EEA, Switzerland or the UK to a country without an adequacy decision are governed by the Standard Contractual Clauses as described in Annex IV, which are incorporated into this DPA by reference. Transfers of personal data out of India follow the DPDP Act and any restrictions notified under it.

This DPA lasts for as long as Statsy processes Customer Personal Data. Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law does not allow liability to be limited.

This DPA is governed by the laws of India, and the courts of India have jurisdiction over any dispute arising from it, except that the Standard Contractual Clauses are governed by the law and forum they specify.