Data processing agreement

Parties and acceptance

This data processing agreement (DPA) forms part of the terms of service and is accepted when the customer subscribes. The customer is the controller of visitor data for its websites. The processor is Julio Rodríguez Cruz, trading as OVERTRACKING, NIF 53194665N, Avenida Gregorio Espino, 36205 Vigo (Pontevedra), Spain. Requests and documented instructions can be sent through the contact form.

Subject matter and duration

OVERTRACKING processes visitor data on the customer’s behalf to provide cookieless web analytics during the service contract and until the data is returned or deleted under this agreement. This agreement prevails over conflicting general terms concerning this processing.

Nature, purpose and data subjects

Processing consists of receiving, pseudonymising, organising, storing, consulting, aggregating and deleting data to provide traffic reports, events, goals, performance and error analysis, and heatmaps configured by the customer. Data subjects are visitors to the customer’s websites. The customer determines the purposes, settings and lawful basis, provides the required information to visitors and ensures its instructions comply with data protection law.

Types of data

Data includes visited URLs and referrers, user agent, browser language, screen resolution, events and JavaScript errors, and heatmap snapshots when enabled. IP addresses are used only for geolocation and a pseudonymous fingerprint generated using a non-reversible hash with a daily, site-specific salt. IP addresses are not stored in plain text. The pixel does not use cookies. The customer must avoid including sensitive or unnecessary personal data in URLs, events or captured content.

Documented instructions and confidentiality

OVERTRACKING processes data only on documented instructions from the customer, including instructions about transfers, unless required by Union or Member State law. In that case, it informs the customer before processing unless that law prohibits disclosure on important public interest grounds. OVERTRACKING immediately informs the customer if it considers an instruction to infringe data protection law. Authorised personnel are subject to confidentiality obligations and receive access only as needed for their duties.

Security of processing

OVERTRACKING implements technical and organisational measures appropriate to the risk under Article 32 GDPR, considering the nature, scope, context and purposes of processing. The annex below describes the measures, which are reviewed and maintained throughout the service.

Subprocessors

The customer grants general written authorisation for the providers in the subprocessors list. OVERTRACKING informs customers by email in advance of additions or replacements, allowing reasonable time to object on data protection grounds before the change takes effect. The parties seek a suitable alternative; if none is available, the customer may terminate the affected service before the change. OVERTRACKING imposes equivalent data protection obligations on subprocessors and remains responsible to the customer for their performance.

Assistance to the customer

Taking account of the nature of processing, OVERTRACKING assists the customer with appropriate measures to respond to access, rectification, erasure, restriction, portability and objection requests. Requests received directly are forwarded to the customer without undue delay. Taking account of the information available, OVERTRACKING also assists with security, breach obligations, data protection impact assessments and prior consultation with supervisory authorities under Articles 32–36 GDPR.

Personal data breaches

OVERTRACKING notifies the customer without undue delay and at the latest within 48 hours after becoming aware of a personal data breach affecting data processed on its behalf. The notice describes the nature of the breach, affected categories and approximate numbers where known, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases without undue further delay. OVERTRACKING cooperates with containment, investigation and the customer’s notifications.

International transfers

Analytics data is hosted in the European Union. Where a subprocessor processes data outside the European Economic Area, OVERTRACKING ensures an appropriate Chapter V GDPR transfer mechanism, including the European Commission’s standard contractual clauses where applicable, and any necessary supplementary measures. The subprocessors list identifies providers and locations.

Return and deletion

At the end of the service, the customer chooses return or deletion of the personal data processed on its behalf, and OVERTRACKING deletes existing copies unless Union or Member State law requires storage. Retained data remains protected and is processed only for that legal requirement. Backup copies remain isolated from ordinary use and are deleted according to the applicable backup cycle.

Information and audits

OVERTRACKING makes available information necessary to demonstrate compliance with Article 28 GDPR and allows and contributes to reasonable audits, including inspections, by the customer or an independent auditor it appoints. Audits are coordinated with reasonable notice, confidentiality and security safeguards, without restricting supervisory authority powers or other mandatory rights.

Annex: technical and organisational measures

The following measures apply to the service:

TLS encryption in transit.
Account-based access and two-factor authentication (2FA).
Website isolation with server-side authorisation checks.
Backups and recovery procedures.
Access logs and permission reviews.
Data minimisation and visitor pseudonymisation.
Cookieless tracking pixel.