Data processing agreement

This is the agreement required by Article 28(3) of the General Data Protection Regulation (GDPR) between you, as our customer, and Digipeak Media ("we", "us"), the operator of Klyqq. Borgarvägen 16 82453 Hudiksvall Sweden

It applies whenever you use Klyqq to collect or process personal data about other people — in practice, the visitors to your websites and the customers whose purchases you report. It forms part of your agreement with us and takes effect when you accept it, or when you begin using the service, whichever happens first. Where it conflicts with any other agreement between us on the subject of personal data, this document prevails.

Its operative terms follow the European Commission's standard contractual clauses for controller-to-processor relationships (Implementing Decision (EU) 2021/915). We have not rewritten those obligations in our own favour.

You are the controller. You decide what is collected through Klyqq, about whom, and why. You are responsible for having a lawful basis for it, for informing the people concerned through your own privacy notice, and for the instructions you give us.

We are the processor. We process that data only to provide the service, on your instructions, and for no purpose of our own. We do not sell it, we do not use one customer's data to serve another, and we do not use it to train anything.

Separately from this agreement, we are the controller of your own account data — your email address, your password and your configuration. That is described in our privacy policy, not here.

We process personal data only on your documented instructions, including for transfers to another country. Your instructions are: this agreement, the settings you choose in the product, and anything you ask us in writing. Configuring the product is instructing us — switching on conversion upload instructs us to send data to Google or Microsoft, and adding a webhook instructs us to send it to the address you gave.

If we believe an instruction breaks data protection law, we will tell you and may decline to act on it. Where the law requires us to process data for some other reason, we will tell you before doing so unless that same law forbids us from saying.

Everyone who has access to personal data processed under this agreement is bound by a duty of confidentiality, and access is limited to those who need it to run and support the service.

We implement appropriate technical and organisational measures under Article 32 of the GDPR. The measures actually in place are listed in Annex II below, and that list describes the software as it is built rather than as we would like it to be.

You give us general authorisation to engage the sub-processors listed in Annex III. Each is bound by written obligations no less protective than those in this agreement, and we remain fully liable to you for their performance.

If we add or replace a sub-processor we will tell you at least 30 days in advance. If you object on reasonable data protection grounds within that period, we will work with you to find a solution; if none can be found, you may terminate and we will refund any prepaid fees for the period you have not used.

Klyqq stores and processes your data in the European Union. The application runs in Replit's European region and the database is with Neon in Frankfurt, Germany. Both are United States companies, whose staff or systems may in exceptional cases reach the data from outside the EU, for example for operations or support. That possibility is covered by the Standard Contractual Clauses adopted by the European Commission, which form part of our agreements with them.

Where you switch on conversion upload, we send advertising identifiers, conversion times and values to Google or Microsoft, who process them outside the EU under their own safeguards. That transfer happens on your instruction and you can withdraw it at any time by turning the feature off, without affecting the rest of the product.

If someone asks you for access to their data, or for correction, deletion, restriction, portability or to object, we will help you answer within a reasonable time, taking account of what the product can do. Much of it you can do yourself and immediately: Klyqq lets you look up a visitor, delete individual events, delete every event from an IP address, and delete an entire project.

If such a request reaches us directly, we will not answer it ourselves. We will pass it to you, because it is yours to answer.

We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, and in any case within 48 hours. The notice will describe what happened, which categories and roughly how many records are affected, the likely consequences, and what we are doing about it — as far as we know it at the time, and we will follow up as we learn more.

Reporting the breach to a supervisory authority or to the people affected is your decision and your obligation as controller. We will give you what you need to make it.

Taking into account what we know about how the service works, we will give you reasonable help with your obligations under Articles 32 to 36 of the GDPR — security, breach notification, data protection impact assessments and prior consultation.

You can delete data yourself at any time, and deletion in the product is immediate.

When your account ends, we keep the data for 30 days so that you can export it, and then delete it. You can download all of it yourself, at any time, with "Export all my data" in your profile, as CSV files in a zip. If you want it deleted sooner, say so and we will delete it on request rather than wait out the window.

After deletion the data can persist for up to a further seven days in the database's point-in-time restore history, after which it is unrecoverable. We keep nothing beyond that unless the law requires it, in which case we keep only what the law requires and only for as long as it requires.

We will give you the information you reasonably need to show that we meet our obligations under Article 28, and allow and contribute to audits, including inspections, conducted by you or an auditor you appoint. In practice we ask that audits are requested in writing with reasonable notice, happen no more than once a year unless there has been a breach, and respect the confidentiality and security of our other customers' data.

This agreement lasts as long as we process personal data for you. The obligations that by their nature should outlast it — confidentiality above all — continue afterwards.

Questions about this agreement, or a request for a signed copy, go to legal@digipeak.se.

Subject matter and nature of the processing. Recording visits and clicks on your websites and advertising, attributing later conversions back to them, reporting on the result, and — where you switch those features on — uploading conversions to your advertising accounts and sending conversion data to endpoints you configure.

Purpose. To provide you with advertising attribution and reporting.

Duration. For as long as your account exists, subject to section 11 and to the retention limits below.

Frequency. Continuous, for as long as your tracking is installed.

Categories of data subjects. Visitors to your websites and to the pages your advertising points at, and people whose purchases, actions or refunds you report to Klyqq.

Categories of personal data.

• A randomly generated visitor identifier, stored in the visitor's browser
• IP address, and the country derived from it
• Browser user-agent string
• Page address and referring address
• Campaign tags in the link (UTM parameters) and any sub id you pass
• Advertising click identifiers appended by the ad platform (gclid, gbraid, wbraid, msclkid)
• Actions, engagement signals, sales and refunds you choose to report, including the amount and currency of a sale
• Timestamps for all of the above

Special categories of personal data: none. Klyqq is not designed to collect data revealing health, religion, political opinions, trade union membership, sexual orientation, biometric or genetic data, and you must not instruct it to. It also does not collect names, email addresses, phone numbers or payment details from tracked visitors.

Retention limit within the account. IP addresses and user-agent strings are erased from tracking events automatically after 90 days. The remainder of the event is kept for reporting for as long as the account exists.

These are the measures the software implements today.

• Encryption in transit — all traffic to the service and to the database is over TLS.
• Encryption of credentials at rest — the access tokens for your connected Google and Microsoft advertising accounts are encrypted with AES-256-GCM, an authenticated cipher, and are never stored in plain text.
• Passwords are never stored — only a bcrypt hash of them.
• Account isolation — every request re-checks that the account is still valid and that the data it asks for belongs to it, rather than trusting the session alone.
• Rate limiting — on sign-in (by IP and by email address), on registration, on tracking ingest and on inbound postbacks, to bound both abuse and credential guessing.
• Authenticity of inbound conversions — postbacks can be locked to a shared secret, compared in constant time, so a third party cannot forge a sale into your account.
• Bot filtering — automated traffic is classified and marked rather than silently counted.
• Data minimisation by default — country is resolved from the IP address using a database on our own servers, so the address is not sent to any third party for that lookup, and the address itself is erased after 90 days.
• Error monitoring on our own infrastructure — failures are recorded to software we run ourselves, so diagnostic data does not reach a third-party monitoring provider.
• Backups — the database keeps a rolling seven-day point-in-time restore history, allowing recovery from failure or mistake.
• Deletion controls in your hands — you can delete an event, every event from an IP address, or an entire project, immediately and permanently.

The third parties who process personal data on our behalf to run the service:

• Replit, Inc. — application hosting — European Union (Replit's European region); a United States company, with any access from outside the EU under the Standard Contractual Clauses
• Neon — database hosting — European Union (Frankfurt, Germany); a United States company, with any access from outside the EU under the Standard Contractual Clauses
• SiteGround — delivery of transactional email (invitations, password resets, alerts). Only email addresses and the content of those messages are processed; no tracking data.

Google and Microsoft are not sub-processors. When you switch on conversion upload they receive data as independent controllers, on your instruction and into your own advertising account, under their own terms.