Privacy and security
Which legal documents exist, and where are they?
All of them are published openly, with no form and no sign-in: the general terms at /en/terms, the privacy notice at /en/privacy, and the data processing agreement, the technical and organisational measures, the annex listing the further processors and the deletion policy at /en/documents. The same page carries the overview “Service providers and recipients”: it names every recipient with its role, including those that act as their own controller and therefore do not belong in a contractual annex. Further evidence (record of processing activities, retention periods in detail, the breach notification process) is available on request.
Where do I find the terms, the data processing agreement, the TOMs and the list of service providers?
| Document | Answers | Where |
|---|---|---|
| General Terms and Conditions | Formation of contract, prices and billing, term, liability, changes | /en/terms |
| Privacy notice | What is processed when you visit the website and when you create an account | /en/privacy |
| Data processing agreement (Art. 28 GDPR) | Subject matter, instructions, sub-processing, return and deletion | /en/documents/avv |
| Technical and organisational measures (Art. 32 GDPR) | What is built in against unauthorised access, loss and mixing | /en/documents/tom |
| Annex to the DPA: further processors | Who processes on our behalf under Art. 28 GDPR, where, and on what basis for transfers outside the EU | /en/documents/subunternehmer |
| Service providers and recipients | Every recipient with its role, including those acting as their own controller | /en/documents |
| Deletion policy | Which data stays for how long, and what happens when a person is erased | /en/documents/loeschkonzept |
| Legal notice | Who the provider is | /en/imprint |
The split of roles, without which none of it holds
For the measurement data on your website you are the controller; we process it on your behalf. For your account, the contract and billing we are the controller. That is why there are two texts rather than one: the data processing agreement governs the first role, the privacy notice describes the second.
Earlier versions
The terms, the privacy policy and the four contract documents carry a version date, and every version stays available permanently under that date: /en/terms/2026-09-04, /en/privacy/2026-09-25, /en/documents/avv/2026-09-24. Such an address always shows exactly that text, even after we have changed it; an earlier version says at the top that it is no longer current and links to the current one. Every page lists all versions at the bottom. The confirmation you receive when concluding the contract links to the versions you accepted.
What is added on request
- Record of processing activities under Art. 30 GDPR, separately for the controller and the processor role
- Deletion policy with the periods per data category
- Process for data subject requests, with the deadlines from Art. 12 GDPR
- Notification process for a personal data breach (Art. 33, 34 GDPR)
- The data processing agreement as a signed document rather than a page
Legal note
The texts describe what the software actually does and are not legal advice for your case. Every version carries its date and stays available at its address; if a text changes, a new version is created.
Last reviewed on 12 Oct 2026
Also asked
- Where do I find the terms and conditions?
- Is there a model data processing agreement?
- Which documents do I get for a privacy review?
- TOMs under Art. 32 GDPR
- Record of processing activities
- Who is controller and who is processor?
- Contract documents for procurement
- Where do I find an earlier version of the terms?
- Which version did I accept?
- Old version of the data processing agreement
- Permanent link to the agreed version
Related articles
- Where is the data processed?
Is there a data processing agreement, and where are the servers?
Application, database and analytics storage are planned for the europe-west3 region (Frankfurt); what goes beyond that, such as logs and support access at the cloud provider, is listed in the sub-processor list under “Documents”. You conclude the data processing agreement with us in the portal under “Privacy” or in the Shopify app; nothing is measured before that. We have our own agreements with our sub-processors.
- How do I conclude the data processing agreement?
How do I conclude the DPA with Metrunio, and why is nothing measured before?
For every account, measurement starts only once the data processing agreement (DPA) is concluded; until then Metrunio accepts nothing and stores nothing. You conclude it in the portal under “Privacy” or in the setup step “Conclude the DPA”, and for a Shopify store also right in the app: enter the company, its address and the person concluding it, confirm they are authorised, done. Data arrives a few seconds later, without any change to your installation.
- How long is data retained?
Which retention periods apply and can I change them?
Raw events are retained for 180 days by default, 90 days on the free Start plan; the period is configurable per tenant up to the plan’s limit and enforced automatically. Journeys, touchpoints and conversions share the period of the raw events they were derived from and are deleted with them, or earlier if a deletion is requested. If a change of plan lowers the limit below the configured period, we announce the reduction 30 days in advance.
- Do I need a cookie banner for Metrunio?
Do I need consent and an entry in the cookie banner for Metrunio?
Yes: Metrunio measures visits and ad contacts only with consent, so it belongs in your cookie banner and your privacy policy together with its storage entries. Without consent it accepts at most purchases and refunds for revenue reconciliation, without browser, customer or advertising identifiers. The legal framework is Section 25 TDDDG: storing and reading information on a device generally requires consent.