Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the Terms of Service between the business using Analytica (“Client”, the controller) and Good Days OÜ, registry code 12627359, Estonia (“Analytica”, the processor). It applies when Analytica processes personal data on the Client’s behalf, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). The Client accepts this DPA when creating an account; acceptance is recorded with date and time.

1. Subject and duration

Analytica processes personal data only to provide the service described in the Terms: monitoring and managing the Client’s advertising accounts, website analytics, protection against invalid ad clicks and reporting. The DPA lasts as long as the Client uses the service and until the data is deleted under section 9.

2. Data subjects and categories of data

• Visitors of the Client’s websites, if the Client installs the Analytica website script:
  • pages viewed, page titles, referrer, time on page, scroll depth and number of interactions (no form contents or typed text);
  • browser and device type, screen size, language, time zone, shortened IP address (used for analytics; no cookies are set);
  • for visits from Google Ads clicks only: the click identifier (gclid) and a device fingerprint (browser, screen, time zone, language, processor cores, graphics renderer) together with the full IP address, kept for up to 60 days to detect and block invalid clicks;
  • if the Client enables sales tracking: order number, order value, currency and purchased items (no names, addresses or payment details).
• People in the Client’s advertising and Google accounts: names and email addresses of account users as returned by Google, and audience or customer lists only if the Client asks Analytica to work with them.
• The Client’s staff who use Analytica: name, email address, messages to the assistant and approvals.

The Client must not send special categories of personal data (Article 9 GDPR) to Analytica.

3. Instructions

Analytica processes personal data only on the Client’s documented instructions: these Terms and this DPA, the settings the Client chooses in Analytica, and changes the Client approves. If Analytica believes an instruction breaks data protection law, it informs the Client. Analytica does not use the Client’s data for its own purposes, does not sell it and does not use it to train general-purpose AI models.

4. Confidentiality

Only people who need access to run, support or secure the service can access personal data. They are bound by confidentiality.

5. Security

Analytica applies the technical and organisational measures described in the Privacy Policy, including encryption in transit (TLS 1.2+), encrypted storage of access credentials, separation of clients’ data, servers reachable only through a reverse proxy, restricted staff access, encrypted backups in the EU, and IP shortening in analytics reports.

6. Sub-processors

The Client authorises these sub-processors:

• Hetzner Online GmbH (Germany; data centres in Germany and Finland) — servers, databases, backups;
• OpenAI (business API; United States) — text and image model processing for the assistant: the relevant part of account data and the Client’s requests, without website visitor fingerprints or IP addresses. Data sent through the API is not used to train models;
• Google (Ireland / United States) — the Google services the Client connects, and IP exclusions in Google Ads when click protection is enabled;
• Stripe (Ireland / United States) — billing of the Client; it does not receive website visitor data.

Analytica binds each sub-processor to data protection obligations equivalent to this DPA. Transfers outside the EEA rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Analytica informs the Client by email at least 14 days before adding or replacing a sub-processor; the Client may object and, if no solution is found, end the service.

7. Assistance

Analytica helps the Client respond to data subject requests (access, deletion, objection) and with data protection impact assessments, as far as the service allows. Requests that reach Analytica directly are forwarded to the Client.

8. Personal data breaches

Analytica notifies the Client without undue delay, and in any case within 48 hours after becoming aware of a breach affecting the Client’s personal data, with the information available at that time, so the Client can meet its own 72-hour obligation.

9. Deletion and return

After the Client closes the account or disconnects a service, Analytica deletes the related personal data within 30 days, unless the law requires keeping it (for example accounting records). Before closing, the Client can ask for an export of its data.

10. Audits

On request, Analytica provides the information needed to show compliance with this DPA. Audits beyond that are agreed in advance, at the Client’s cost, at most once a year, and must not reveal other clients’ data.

11. The Client’s responsibilities

The Client is responsible for the lawfulness of the processing it instructs, including informing website visitors in its own privacy policy that it uses Analytica for analytics and click-fraud protection, and collecting consent where the law requires it.

12. Final provisions

If this DPA conflicts with the Terms, this DPA prevails for data protection matters. Estonian law applies. Analytica may update this DPA; the Client is asked to accept a new version in the service. Contact: info@analytica.ee.