Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) details the privacy and security commitments governing TrackWhy’s processing of customer analytical events. It forms part of the TrackWhy Terms of Service.

Last updated 2026-06-22

1. Definitions

In this DPA, terms like “Controller”, “Processor”, “Personal Data”, “Processing”, and “Supervisory Authority” have the meanings given in the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

2. Roles of the Parties

The customer acts as the Controller of the analytics data. TrackWhy acts as the Processor on the customer’s behalf. TrackWhy will process data only in accordance with the customer’s instructions, specifically to provide, maintain, and optimize the analytics service.

3. Details of Processing

Subject Matter	Aggregate web analytics events and usage tracking.
Duration	For the term of the agreement, up to a retention cap of five years.
Nature & Purpose	Processing browser signals and page paths to construct dashboard analytics reports.
Categories of Data	Non-identifying browser agents, referral URLs, page paths, custom event names, and derived country. (IP addresses are hashed immediately and never stored).

4. Obligations of the Processor

Confidentiality: Ensure all staff authorized to process customer data have committed to strict confidentiality.
Security Measures: Implement technical and organizational measures to ensure database and tracking script security.
Sub-processors: Commit to hiring only compliant infrastructure sub-processors. We will notify customers of changes.
Data Requests: Assist the Controller in responding to data requests from users where possible.

5. Security of Processing

TrackWhy implements standard physical, technical, and administrative protections including encrypted transit (HTTPS/TLS), isolated cloud servers, and restricted dashboard access policies. Our trackers are lightweight (1.7 KB) and collect no cookies, which eliminates the security risks associated with device tracking storage.

6. Data Deletion and Return

Upon termination of the service, TrackWhy will delete or aggregate your analytics data, unless legal or regulatory retention is required.

7. Contact & Jurisdiction

Any questions or notifications regarding this DPA or EU data processing should be sent to hello@trackwhy.com. Governed by [Governing jurisdiction] laws.

See also our Privacy Policy and standard Terms of Service.