Data processing agreement

This data processing agreement ("DPA") is between Trfyx Software Private Limited, a company incorporated in India ("Trfyx") and the customer who agreed to our terms of service ("Customer"). It forms part of the Terms and applies automatically whenever Trfyx processes Customer Personal Data. No signature is needed. If you need a countersigned copy, email [email protected].

1. Definitions

Data Protection Laws means all laws on data protection and privacy that apply to the processing of Customer Personal Data under the Terms. That includes, where they apply, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023, and the California Consumer Privacy Act as amended ("CCPA").
Customer Personal Data means personal data within Customer Data (as defined in the Terms) that Trfyx processes on Customer's behalf.
Subprocessor means a third party that Trfyx engages to process Customer Personal Data.
Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
Terms such as "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR. They also cover the equivalent terms in other Data Protection Laws, such as "data fiduciary" and "data processor" under Indian law, and "business" and "service provider" under the CCPA.

2. Roles and scope

Customer is the controller of Customer Personal Data, or a processor acting for its own clients. Trfyx is a processor (and, under the CCPA, a service provider) acting on Customer's behalf. Annex I describes the processing. Trfyx acts as an independent controller only for its own account, billing and website data, as described in its privacy policy. This DPA doesn't cover that data.

3. Customer's instructions and obligations

The Terms, this DPA, and the way Customer configures and uses the Service are Customer's complete documented instructions. Additional instructions need to be agreed in writing.
Customer is responsible for the lawfulness of the processing. That includes having a lawful basis, giving notices, obtaining any consents required (for example, for cookies, session recording or identifying users), and handling data subjects' requests.
Customer will not send special categories of personal data, government identifiers, payment card data, passwords or children's data to the Service.

4. Trfyx's obligations

Process Customer Personal Data only on Customer's documented instructions, unless the law requires otherwise. In that case, Trfyx will tell Customer first, unless the law forbids it. Trfyx will tell Customer if it believes an instruction breaks Data Protection Laws.
Make sure everyone authorised to process Customer Personal Data is bound by confidentiality obligations.
Put in place and maintain the security measures in Annex II.
Taking into account the nature of the processing, help Customer respond to data subjects' requests, using the Service's tools (such as deleting a visitor's data) where possible. If Trfyx receives a request directly, it will forward it to Customer and won't respond itself, except to direct the data subject to Customer.
Provide reasonable help with data protection impact assessments and prior consultations with supervisory authorities, using the information available to Trfyx.
CCPA. Trfyx will not sell or share Customer Personal Data; will not retain, use or disclose it outside the direct business relationship with Customer, or for any purpose other than providing the Service; and will not combine it with personal data from other sources except as the CCPA permits. Trfyx certifies that it understands these restrictions.

5. Subprocessors

Customer gives Trfyx general authorisation to engage Subprocessors. The current list is on our subprocessors page.
Trfyx will tell Customer by email at least 14 days before adding or replacing a Subprocessor of Customer Personal Data. Customer may object on reasonable data-protection grounds within that period. If we can't resolve the objection, Customer may end the affected part of the Service and receive a pro rata refund of prepaid fees for it.
Trfyx will bind each Subprocessor to data-protection obligations that give at least the same level of protection as this DPA, and remains liable for its Subprocessors' performance.

6. Security Incidents

Trfyx will notify Customer without undue delay, and where feasible within 72 hours, after becoming aware of a Security Incident. The notice will describe, as far as it is known, the nature of the incident, the data and data subjects affected, the likely consequences and the measures taken or proposed. Trfyx will take reasonable steps to contain and remedy the incident, and will give Customer the information it reasonably needs to meet its own notification obligations. Notifying Customer is not an admission of fault.

7. Location of processing

Trfyx is established in India. Customer Personal Data is hosted by Amazon Web Services in the United States (us-east-1). Trfyx's personnel may access it from India to provide and support the Service. Subprocessor locations are listed on the subprocessors page.

8. International transfers

Where Customer Personal Data subject to the GDPR is transferred to Trfyx, or onward from Trfyx, in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference as follows:

Module Two (controller to processor) applies where Customer is a controller. Module Three (processor to processor) applies where Customer is a processor.
Customer is the data exporter and Trfyx is the data importer.
Clause 7 (docking clause) applies.
Clause 9(a): Option 2 (general written authorisation), with the notice period set out in section 5.
Clause 11(a): the optional language does not apply.
Clause 13: the competent supervisory authority is determined under Clause 13(a), based on Customer's establishment or EU representative.
Clauses 17 and 18: the law and courts of Ireland.
Annexes I and II of the SCCs are completed by Annexes I and II of this DPA.

United Kingdom. For data subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0) applies. Its tables are completed with the information in this DPA, and either party may end the Addendum as set out in its Section 19.

Switzerland. For data subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act, the Federal Data Protection and Information Commissioner as the competent authority, and "Member State" including Switzerland.

If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

9. Audits

Trfyx will make available the information reasonably needed to show compliance with this DPA, starting with written answers to Customer's security questionnaire. If that isn't enough, or a supervisory authority requires it, Customer may audit Trfyx once a year. Customer must give at least 30 days' notice, carry out the audit during business hours without disrupting the Service, pay its own costs, and keep the results confidential. The auditor must be independent and bound by confidentiality.

10. Deletion and return

During the term, Customer can export Customer Personal Data and delete it through the Service. When the Terms end, Customer may ask Trfyx in writing to delete the remaining Customer Personal Data. Trfyx will do so within 30 days of the request. Otherwise it is deleted automatically under the retention periods in Annex I. Backups are overwritten within 35 days. Trfyx may keep data where the law requires, and will continue to protect it under this DPA.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the SCCs don't allow this. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. This DPA lasts as long as Trfyx processes Customer Personal Data.

Annex I: Description of the processing

Data exporter	Customer, as identified in its Trfyx account. Contact: the account owner's email address.
Data importer	Trfyx Software Private Limited. Contact: [email protected].
Data subjects	Visitors to Customer's websites and apps; Customer's end users and buyers whom Customer identifies or whose purchases it tracks; authors of public posts that mention Customer (social mentions).
Categories of data	Online identifiers (random visitor and session IDs); page URLs, titles and referrers; campaign and ad click parameters; browser, device, screen size, language and time zone; approximate location derived from the IP address (the IP address itself is processed only transiently and is not stored); interaction data (events, scroll depth, time on page, clicks, mouse movements); session recordings; page-speed metrics; data Customer chooses to send, such as user IDs, names, email addresses, profile pictures, custom properties and payment details (amount, currency, product, buyer email); public posts and the authors' public names and usernames.
Special categories	None. Customer must not send them.
Frequency	Continuous, for as long as Customer uses the Service.
Nature and purpose	Collecting, storing, aggregating, analysing and displaying data to provide web and product analytics, session recording, heatmaps, funnels, revenue attribution, alerts and reports to Customer under the Terms.
Retention	Events and sessions up to 3 years; page-speed metrics 400 days; heatmap data 90 days; session recordings 30 days; payment-provider webhook logs 30 days; backups up to 35 days. Customer can delete data earlier, as described in section 10.
Subprocessor transfers	As listed on the subprocessors page, for the same nature, purpose and duration as above.

Annex II: Technical and organisational security measures

Encryption in transit. All traffic to the Service, including tracking requests, uses HTTPS (TLS).
Data minimisation. IP addresses are used only transiently and are not stored with analytics data. Privacy mode replaces persistent visitor IDs with daily-rotating one-way hashes. Session recordings mask typed input by default and never capture password or payment card fields. Customers can add masking, exclusion rules and opt-outs.
Infrastructure. Hosted on Amazon Web Services. Databases are not reachable from the public internet. Production access is limited to authorised personnel who need it.
Secrets. User passwords are stored as salted scrypt hashes. API keys issued by Trfyx are stored hashed. Customers' payment provider API keys are encrypted at rest with AES-256-GCM.
Access control in the product. Role-based workspace permissions (owner, admin, editor, member, viewer), per-website access, verified email addresses, session revocation, and bot protection on sign-in.
Tenant separation. Customer data is logically separated by workspace and website. Incoming events are accepted only for domains registered to the website.
Availability. Nightly analytics backups kept for 14 days; database backups with point-in-time recovery, kept for up to 35 days; rate limiting and abuse protection on public endpoints.
Retention. Automatic expiry of data under the periods in Annex I.
Personnel. Confidentiality obligations for everyone with access to Customer Personal Data. Staff access customer accounts only to provide support or keep the Service secure.
Incident response. A process to investigate, contain and notify Security Incidents under section 6.

Annex III: Subprocessors

See the subprocessors page, which forms part of this DPA.