Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between WebAnalytics365 by TechFirio LLC ("Processor") and the customer that uses WebAnalytics365 services ("Controller").

The Processor will process personal data on behalf of the Controller for the purpose of providing web analytics, click measurement, fraud detection, and uptime monitoring services. This DPA remains in force for as long as the Processor processes personal data on behalf of the Controller.

The Processor processes data to:

• Measure traffic, visits, and user behavior.
• Perform click-tracking and ad attribution.
• Detect bots, invalid traffic, and click fraud.
• Provide uptime monitoring and alerts.
• Generate aggregated reports and analytics for the Controller.

The personal data processed may include, but is not limited to:

• IP addresses (may be truncated or masked).
• Online identifiers (cookies, session IDs, click IDs).
• Device information (user agent, OS, browser version).
• Location information at a general level (country, region, city).

Data subjects include visitors and users of the websites, applications, or digital properties owned or controlled by the Controller that implement WebAnalytics365 tracking.

The Processor shall:

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorized to process the data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Assist the Controller in fulfilling data subject rights where technically feasible.
• Notify the Controller without undue delay in case of a personal data breach.

The Controller shall:

• Ensure it has a valid legal basis for collecting and sharing personal data with the Processor.
• Provide accurate and lawful instructions to the Processor.
• Implement appropriate transparency measures (e.g., privacy notices, consents).
• Remain responsible for its own compliance with applicable data protection laws.

The Processor may engage sub-processors for hosting, security, IP intelligence, and infrastructure, such as cloud providers, CDN, and proxy detection services.

The Processor will ensure sub-processors are bound by written agreements that provide data protection obligations at least as protective as those in this DPA.

Where personal data is transferred to a third country outside the EU/EEA, the Processor will implement appropriate safeguards, such as Standard Contractual Clauses (SCCs), or rely on an adequacy decision where applicable.

The Processor implements technical and organizational security measures, including:

• Encryption in transit (HTTPS/TLS 1.3)
• Encryption at rest for sensitive data
• Network firewalls and DDoS protection
• Role-based access control
• Audit logging and monitoring
• Regular security assessments

Taking into account the nature of processing, the Processor shall assist the Controller by appropriate technical and organizational measures, where possible, in fulfilling the Controller's obligation to respond to data subject requests (e.g., access, deletion, restriction).

In the event of a personal data breach affecting data processed on behalf of the Controller, the Processor shall notify the Controller without undue delay (within 72 hours where feasible) after becoming aware of the breach, providing information to help the Controller meet its own reporting obligations.

Upon termination of services or upon written request of the Controller, the Processor will delete or return personal data, unless storage is required by law. Anonymized and aggregated analytics data may be retained for statistical purposes.

The Controller may request information necessary to demonstrate compliance with this DPA and applicable data protection laws. Where required, reasonable audits may be carried out, subject to confidentiality and security considerations, with at least 30 days' prior written notice.

The liability of each party under this DPA shall be subject to the limitations and exclusions of liability set out in the main service agreement between the parties.

This DPA shall be governed by the laws of the State of Delaware, USA. For EU-based Controllers, GDPR requirements shall take precedence where there is any conflict with local law.

For questions regarding this DPA or data processing by WebAnalytics365, please contact our privacy team.