Data Processing Agreement
Our data processing agreement under Article 28 of the GDPR, covering our role as data processor when you use our analytics service.
Who's responsible for what
This agreement is between you (the Controller) - the owner of a website using Datrika's analytics - and Konstantin Pankratov, OSVČ, IČO 23231181, operating Datrika (the Processor).
It supplements our Terms of Service and applies automatically as soon as you sign up and start using Datrika - there's nothing separate to sign.
What we do with your data
We process your website visitors' personal data solely to provide you with web analytics. This lasts for as long as your contract with us is active, plus whatever additional time our retention and deletion terms below require.
Why we process your data
The purpose is narrow and fixed: automated collection and aggregation of technical visit metrics, so we can give you analytics for your own site. We don't use your visitors' data for our own purposes, and we don't use it to provide any other service.
What data we handle
| Category | Details |
|---|---|
| Pseudonymous visitor ID | A keyed one-way hash (HMAC-SHA256) of a truncated IP address, user agent, and site ID, keyed with a random salt that rotates every 24 hours. The IP and user agent themselves are never stored. |
| Location | Country, region, and city as reference IDs - not coordinates. |
| Device and browser | Browser, version, operating system, device type, screen resolution, browser language. |
| Traffic source | Referrer and UTM tags (source, medium, campaign, content, term). |
| Custom events | Whatever event names and metadata you choose to send from your own site. |
See our Data policy for how each of these is computed and stored.
Our commitments to you
- Process personal data only on your documented instructions - including choices you make in the product, like which custom events to send.
- Keep anyone with access to the data under a duty of confidentiality.
- Apply the security measures described in “How we keep your data secure” below.
- Only bring on new sub-processors with your general authorization, and hold them to the same standards (see “Our partners”).
- Help you respond to your visitors' data requests, within the limits described in our GDPR page.
- Assist you with your own security, breach-notification, and impact-assessment obligations, to the extent our data and role allow.
- Delete or return your data once our services end (see “When you leave”).
- Give you the information you need to confirm we're holding up our end (see “Checking up on us”).
Your responsibilities
- You decide the legal basis for processing your visitors' data. Given how Datrika works, we believe legitimate interest applies well for most sites - see our GDPR page - but confirming that's right for your site is on you.
- Don't send personal data through custom events. Custom events accept arbitrary key/value metadata that you define, and we don't inspect their content - our limits are purely technical (a key up to 100 characters, a value up to 2,000, up to 20 pairs per event), not a content filter. Keep names, email addresses, phone numbers, physical addresses, payment details, government IDs, and special category data (health, religious or political views, sexual orientation, and similar) out of them.
- Make sure your own use of Datrika complies with the data protection law that applies to your site and your visitors.
How we keep your data secure
| Measure | What we do |
|---|---|
| Pseudonymization | IP addresses are never stored, and the daily salt used in our hashing formula isn’t retained either - see our Data policy. |
| Encryption in transit | TLS/HTTPS for all traffic to our collector and dashboard. |
| Hosting | Servers located in Frankfurt, Germany (Hetzner) - exclusively within the EU. |
| Access control | Only Datrika’s operator has access to production databases. |
| Backups | We don’t currently run an automated backup service - this is a real availability risk we’d rather disclose than hide. |
| Security testing | No formal, recurring penetration testing program at our current scale - security is handled on a best-effort basis by a single operator. |
Our partners
You give us general authorization to use the sub-processors below. If that list changes, we'll let you know in advance and give you a reasonable chance to object.
| Sub-processor | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts our infrastructure and all analytics data | EU (Germany) |
| MaxMind Inc. | Local GeoIP lookup - the database is downloaded and used on our own servers, visitor data is never sent to MaxMind | Database downloaded from the US; no visitor data leaves our infrastructure |
| Resend | Transactional email for your account (e.g. login codes) - not visitor data | US, covered by Standard Contractual Clauses and EU-US Data Privacy Framework certification |
| Stripe | Billing for your account - not visitor data | EU contracting entity (Stripe Payments Europe, Ltd.); processing may also occur in the US via Stripe, LLC, covered by Standard Contractual Clauses and Data Privacy Framework certification |
If something goes wrong
We put reasonable effort into preventing and catching security incidents, but we don't claim our infrastructure is free of vulnerabilities. If we become aware of a breach affecting your data, we'll notify you without undue delay, so you can meet your own breach-notification obligations as a controller.
If you find a security issue yourself, please report it to support@datrika.app before disclosing it publicly.
Liability under this agreement follows the same limits as our Terms of Service, except where GDPR itself (in particular Art. 82) requires otherwise.
When you leave
Export your data before your account or site is deleted - we don't have an automated export tool yet, so ask us at support@datrika.app in advance.
Deletion - whether you close your account, stop paying, or we discontinue the service - is immediate and permanent. There's no waiting period, and since we don't run automated backups, there's no way to recover the data afterwards.
The one exception is payment records, which we're required to keep for 5-10 years under EU accounting rules. Those are billing records for your account, not your visitors' analytics data, and aren't covered by this agreement.
Checking up on us
On reasonable request - no more than once a year - we'll provide information demonstrating our compliance with this agreement. Full on-site audits are available by separate arrangement, scaled to what makes sense for a business run by a single person.
Questions?
For anything about this agreement, reach out at support@datrika.app.