Data Processing Addendum for Visdenda

1. Parties and roles

This Data Processing Addendum (the “DPA”) forms part of the agreement between you (the “Controller”) and Visdenda (the “Processor”) for the use of the service. It applies to personal data that the service processes on your behalf.

You are the controller for visitor data collected by the page beacon and the crawler probe on sites you control, and for any personal data in the sites, audits, and account settings you submit. We are the processor for that data and act only on your documented instructions. For your own account identity, Search Console data, and Analytics data, we act as described in the privacy policy.

2. Scope and instructions

Processing covers: collecting page views, sessions, per-page time, referrer hosts, device class, country, sampled Core Web Vitals, crawler user agents, paths, response statuses, and network classification for the sites you register; storing and aggregating it; and showing it in your console, exports, and API.

The subject matter, duration, nature, and purpose of the processing are the service described on the pricing page and in the documentation. We process only to provide that service, to secure it, and to comply with law. We notify you if an instruction would violate applicable data protection law.

3. Our obligations as processor

We process personal data only on your instructions, keep personnel who handle it under confidentiality obligations, and implement the technical and organisational measures in section 6. We assist you with data subject requests, impact assessments, and prior consultations to the extent the law requires, taking into account the nature of the processing.

We do not sell personal data, do not use it for advertising, and do not use it to train machine-learning models. We do not disclose it to third parties except to the sub-processors listed below, or when the law requires it.

4. Your obligations as controller

You are responsible for the lawfulness of the processing, for the content of your own site's privacy notice, and for obtaining consent where your jurisdiction requires it. You must not install the collector or probe on sites you do not control, and you must not send us personal data you are not allowed to process.

You will answer data subject requests that concern your site's visitors; we assist as described in section 8.

5. Sub-processors

You authorise the following sub-processors. We give at least 30 days' notice before adding a new one, and you may object on data protection grounds; if we cannot resolve the objection, you may terminate the affected service.

Cloudflare, Inc. — hosting, edge delivery, primary database, and object storage.

Google LLC — Search Console, Google Analytics 4, Chrome UX Report, and PageSpeed Insights APIs, when you connect those sources.

Paddle.com Market Ltd — payment processing and tax. Paddle acts as merchant of record and is the controller for buyer payment data.

Functional Software, Inc. (Sentry) — error monitoring, when enabled. It receives technical diagnostics only.

Each sub-processor is bound by data protection terms no less protective than this DPA, and remains liable to you for its performance.

6. Security measures

Encryption in transit (TLS 1.2+) and at rest on the hosting platform; secrets scoped per environment with least privilege; collector tokens stored as SHA-256 hashes and usable only for write-only telemetry; visitor IP addresses not stored, and probe IPs kept only as salted hashes for at most two days.

Access to production data is limited to personnel who need it, is logged, and is reviewed. Payment card data never reaches our servers. Retention follows the periods in the privacy policy: 90 days for sessions, page traffic, and performance samples; 30 days for crawler hit detail; 30 days after account deletion.

7. International transfers

Where personal data leaves the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), with the sub-processors listed above as recipients. You can request the executed modules and the transfer impact assessment.

8. Data subject requests

If a data subject contacts you, you can export or delete site data from the console, or ask us and we respond within 30 days. If a data subject contacts us directly about data we process for you, we forward the request to you without responding to it ourselves, unless the law requires otherwise.

9. Breach notification

We notify you without undue delay, and no later than 72 hours after confirming a personal data breach affecting your data. The notice states what happened, the data and subjects affected, the likely consequences, and the measures taken or proposed. We cooperate on notifications to authorities and data subjects where required.

10. Deletion and return

On termination, you can export your data before the account closes. We delete account, site, and telemetry data within 30 days of termination or your deletion request, and backups rotate on the same schedule. We may retain records required by law (for example, billing records) for the period the law requires.

11. Audits and information

We answer written security and data protection questionnaires once a year at no charge. If law or a supervisory authority requires an on-site audit, we allow it during business hours with reasonable notice, at your cost, under confidentiality, and without access to other customers' data. Audit rights do not extend to penetration testing of production systems.

12. Liability and term

Liability under this DPA is subject to the limitations in the main agreement. This DPA takes effect when you accept it and continues for as long as we process personal data for you. If a clause conflicts with the main agreement on data protection, this DPA prevails.