Data processing addendum
This addendum forms part of the terms of service between [Company name] ("Processor") and the customer ("Controller"). It applies where the Processor processes personal data of visitors to the Controller's websites on the Controller's behalf, and reflects Article 28 of the UK GDPR.
1. Details of the processing
| Subject matter | Providing website analytics to the Controller. |
|---|---|
| Duration | For as long as the Controller has an account, subject to deletion described below. |
| Nature and purpose | Collecting, storing and analysing behavioural events from the Controller's websites to produce reports and findings for the Controller and, where the Controller enables them, running an automated chat with visitors and sending the emails the visitor asked for. |
| Types of personal data | Pseudonymous visitor and session identifiers; pages, product and search activity; engagement time and scroll depth; coarse device facts (device type, browser, operating system, language, time zone, screen size) and an approximate region; click labels; cart, checkout and purchase events; referrer hostname. Where the Controller enables the chat and email: chat messages, and email address, optional first name and the visitor's consent record. No payment details are intended to be collected. Where the Controller switches them on: approximate or precise location (rounded to about a kilometre), an IP address in the form the Controller chooses (shortened, hashed or full), a telephone number given with separate consent, and a log of each consent given or withdrawn. |
| Data subjects | Visitors to the Controller's websites. |
2. The Processor will
- Process the data only on the Controller's documented instructions (the settings and use of the service are those instructions) and tell the Controller if an instruction appears to breach data protection law.
- Ensure people authorised to process the data are bound by confidentiality.
- Apply appropriate security measures, described on our security page.
- Not use the data for its own purposes, for advertising, or sell it.
- Help the Controller respond to rights requests, for example through the dashboard's tools to erase a visitor and to delete a site.
- Help the Controller meet its obligations on security, breach notification and impact assessments, taking into account the nature of the processing.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.
- Delete the data when the Controller deletes a site or account, and in any case after 395 days for raw events. Copies in backups are removed as the backups expire.
- Make available the information needed to show compliance and allow reasonable audits on reasonable notice, at the Controller's cost, no more than once a year unless a breach has occurred.
3. The Controller will
- Have a lawful basis for the processing and give visitors the information the law requires.
- Obtain any consent required before telling Unagi that a visitor has consented (
Unagi.consent(true)), and withdraw it when a visitor withdraws. - Switch on the chat and email only where it has a lawful basis for them, including the consent or soft opt-in the law requires for marketing emails, keep its offers truthful, and give accurate sender and postal details.
- Not send special-category data, payment details or direct identifiers to the service.
4. Sub-processors
The Controller gives general authorisation for the Processor to use sub-processors. The current sub-processors are our infrastructure provider, Namecheap, hosting servers in [server location]; where the Controller enables the chat, Anthropic (generating replies); and where the Controller enables email, Resend (delivering email). The Processor will impose equivalent data protection obligations on sub-processors, remains responsible for their performance, and will tell the Controller before adding or replacing one so the Controller may object.
5. International transfers
The Processor will only transfer personal data outside the UK where an appropriate safeguard permitted by UK data protection law is in place.
6. Contact
Questions about this addendum: uk@youok.uk.