Data processing agreement pursuant to Art. 28 GDPR

The subject matter is the provision of the “Metrunio” measurement service: collecting, storing, linking and analysing events for the independent measurement of advertising contacts and conversions on the client’s websites.

The agreement runs for as long as the main contract for the use of the software; no separate termination is required.

It continues to apply beyond that for as long as we still process the client’s data — that is, until return or deletion and until the backups that still contain it have expired. Without that run-on period the agreement would describe thirty days of processing without a basis, and those are exactly the thirty days section 9 promises.

Only data transmitted by the client, or caused to be transmitted by the client, through the provided interfaces is processed. The sole purpose is the provision of the measurement service.

• receiving and validating events (delivery, viewability, click, site visit, interaction, conversion)
• linking events into journeys through unambiguous identifiers
• calculating attribution shares according to the models chosen by the client
• providing reports, exports and interfaces
• on explicit instruction: forwarding conversions to the advertising platforms named by the client
• on a question from an authorised person of the client in the portal: answering through a data assistant. Metrics and individual conversions and journeys go to the language model of a further processor (annex) – at most 300 rows per question; the tenant’s order numbers and journey identifiers only as codes that apply to this one request; earlier answers containing individual records not again; orders reported without consent not individually. A number typed in that cannot be matched to a record of the tenant goes to the model as text

Data subjects are visitors to the client’s websites and — for server-side reported completions — the client’s customers.

• pseudonymous identifiers for session, device, click and impression
• tenant-specific pseudonymised customer identifiers; a plaintext value passed in is pseudonymised on receipt via HMAC and never stored in clear
• order and case numbers, values and currencies
• technical attributes in truncated or hashed form; IP addresses are processed in transit and for rate limiting and stored in the event data only as a truncated hash formed with a secret – in the measurement mode without consent not at all
• the consent state for each event

The processor processes the data solely on the documented instructions of the client. The settings in the product — retention period, attribution windows, forwarding to platforms, consent mapping — constitute instructions; they are traceable in the tenant’s audit log.

If the processor considers an instruction unlawful, it will say so without delay and may suspend execution until the matter is resolved.

All persons involved in the processing are bound to confidentiality and instructed in data protection requirements. Support access to tenant data is possible only after explicit, time-limited authorisation by the client, is separately logged and is shown visibly in the product.

The processor implements the measures described in the separate annex “Technical and organisational measures” pursuant to Art. 32 GDPR. Changes may not fall below the level of protection.

The client consents to the use of the further processors listed in the annex “Sub-processors”.

A change or addition is announced at least 30 days in advance in text form and on the website. The client may object; in that case the client has a right to terminate as of the date of the change. As long as a reasoned objection is unresolved, the new processor receives no data of the client.

With every further processor we conclude a contract in writing, including in electronic form, imposing the same data protection obligations: adherence to instructions, confidentiality, the measures under Art. 32 GDPR at a level that does not fall below this one, assistance with data-subject requests and notification duties, audit and evidence rights, and deletion or return at the end. We are liable for their compliance as for our own conduct.

The processor assists the client in fulfilling data subject rights. The product contains a dedicated area for this: access, rectification, erasure and objection can be carried out there without involving the processor.

An erasure keeps working through a suppression list so that the same identifier is not collected again immediately afterwards. Only a checksum of the identifier is stored, not the identifier itself.

The processor also assists with data protection impact assessments and with notifications under Art. 33 and 34 GDPR. A personal data breach is communicated to the client without undue delay, and at the latest within 24 hours of becoming aware of it.

After the agreement ends, the data is returned or deleted at the client’s choice. The client communicates the choice in text form and may change it until the period expires.

For return, the data stays available for 30 days in the export formats provided; the client collects it directly or asks us for it. Export during the term of the contract is possible at any time at no additional charge.

If the client makes no choice, the data is deleted once the period expires. Deletion is the default, not the only option. It is evidenced on request, stating time and scope.

Log data serving evidentiary purposes, and records subject to statutory retention, are unaffected; they are blocked for every other use.

The processor demonstrates compliance on request and allows for audits, including inspections, by the client or an auditor mandated by it. An audit is announced with reasonable notice and must not unreasonably disrupt operations; after an incident or on reasonable suspicion it is possible without that notice.

The main resources are located in the europe-west3 region (Frankfurt). Individual stores – in particular global logging areas of the cloud provider – and maintenance and support access by group companies of the further processors may be located or take place outside the EU; the annex names recipients, countries and transfer basis per service. Any further transfer to a third country takes place only on documented instruction and under the conditions of Art. 44 et seq. GDPR.