Data Processing Agreement

This Data Processing Agreement ("DPA") is between the customer that has accepted the Numative Terms of Service ("Customer") and Numative ("Numative"), and forms part of those Terms. It applies whenever Numative processes Customer Personal Data that is subject to Data Protection Law. Customer accepts it by accepting the Terms or using the service; no signature is needed. A countersigned copy is available on request from support@numative.com.

Where this DPA conflicts with the Terms, this DPA prevails. Where it conflicts with the Standard Contractual Clauses, the Clauses prevail.

• Data Protection Law means the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law with the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), and laws implementing or supplementing them, each as applicable to the processing.
• Customer Personal Data means personal data that Numative processes on Customer's behalf in providing the service, as described in Annex I. It does not include account data about Customer's own users (names, emails, billing details), which Numative processes as a controller under its Privacy Policy.
• Standard Contractual Clauses or Clauses means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914.
• Subprocessor means a third party Numative engages to process Customer Personal Data.
• Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the GDPR.

Customer is the controller of Customer Personal Data (or a processor acting for its own clients, in which case Customer is responsible for passing their instructions on). Numative is the processor.

Numative processes Customer Personal Data only on Customer's documented instructions, unless required otherwise by law, in which case Numative will tell Customer before processing unless that law prohibits it. Customer's instructions are this DPA, the Terms, and the way Customer configures and uses the service (which sites it tracks, which settings it turns on, what it sends in custom events, what it imports and exports). Numative will tell Customer if it believes an instruction infringes Data Protection Law.

Customer is responsible for having a lawful basis for the processing, for the notices it gives its visitors, and for not sending Numative data that directly identifies people (names, emails, account numbers) or special categories of data, in page addresses, event names or custom properties.

Numative may create anonymized and aggregated data from the processing, such as counts across many sites and the signatures of automated traffic it learns to recognize, and use it to operate, secure and improve the service. That data does not identify any individual, is not Customer Personal Data, and is never sold or used to identify, profile or target anyone.

Numative ensures that everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality, and gives access only to people who need it to run, support or secure the service.

Numative implements the technical and organizational measures in Annex II, which are designed to give a level of security appropriate to the risk, as required by Article 32 GDPR. Numative may update them as long as the overall level of protection does not decrease.

Customer gives Numative general authorization to engage the Subprocessors listed in Annex III. Numative will give at least 30 days' notice before a new Subprocessor starts processing Customer Personal Data, by updating Annex III and emailing the account owner. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may end the affected service and receive a pro rata refund of prepaid fees for it.

Where a Subprocessor has to be replaced urgently to keep the service running or secure (for example because a provider stops its service or suffers a security incident), Numative may, to the extent the Clauses allow, engage the replacement before the notice period ends. It will then notify Customer as soon as possible, and Customer's right to object runs from that notice.

Numative imposes data protection obligations on each Subprocessor that are no less protective than this DPA, and remains liable to Customer for its Subprocessors' performance.

Taking into account the nature of the processing, Numative will help Customer respond to requests from data subjects exercising their rights, and with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR. Numative will pass on to Customer any data subject request it receives that concerns Customer Personal Data rather than answer it directly.

Customer should know that Numative is designed so that it cannot single out a visitor: the visitor identifier is a one-way hash that changes every day, and raw IP addresses and user agents are not stored. In most cases neither party can link a request to a particular visitor's data, and Article 11 GDPR applies.

Numative will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate volume of data concerned, the likely consequences and the measures taken or proposed. Numative will update Customer as more becomes known and take reasonable steps to contain the breach.

Customer can export its analytics data from the product at any time. When Customer deletes a site or its account, or the Terms end, Numative deletes the Customer Personal Data for it within 30 days, unless law requires keeping it. Copies in provider backups expire on those providers' normal backup cycles and are not restored except to recover from an incident.

Numative makes available the information needed to demonstrate compliance with Article 28 GDPR: this DPA, the measures in Annex II, the Subprocessor list, and on request the security documentation of its Subprocessors. If that is not enough to answer a specific question, or a supervisory authority requires it, Customer may audit Numative once in any 12 months, on 30 days' written notice, under confidentiality, and at Customer's own cost. An audit after a personal data breach affecting Customer does not count toward that limit.

Audits are carried out remotely, through written questions, review of documentation and video calls. Numative runs no offices or data centers of its own: Customer Personal Data is held in the facilities of the Subprocessors in Annex III, which are audited by independent auditors, and Numative will share their audit reports and certifications where they make them available. An inspection in person takes place only where a supervisory authority requires it, or where the Clauses require it and a remote audit cannot answer the question. It is then carried out by Customer or an independent auditor bound by confidentiality, during business hours, at a location Numative chooses.

Numative is based in the United States and processes Customer Personal Data there (Annex III). To the extent a transfer of Customer Personal Data to Numative is a restricted transfer under Data Protection Law, the Standard Contractual Clauses apply to it and are incorporated into this DPA by reference, completed as follows. The full text of the Clauses is published by the European Commission at eur-lex.europa.eu.

United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) applies and is incorporated by reference. Table 1 is completed by Annex I.A, Table 2 by the selections above, and Table 3 by Annexes I to III. For Table 4, either party may end the Addendum as set out in its Section 19.

Switzerland. For transfers subject to the FADP, the Clauses apply with these changes: references to the GDPR are to the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; "Member State" does not exclude data subjects in Switzerland from suing for their rights where they habitually reside; and the Clauses also protect the data of legal entities for as long as the FADP does.

Numative assessed the laws and practices of the United States that apply to these transfers before relying on the Clauses. The transfer impact assessment is published for Customer to use in its own records.

If a public authority asks Numative for Customer Personal Data, Numative will tell Customer promptly unless the law prohibits it, ask the authority to go to Customer directly, review the request for legality, challenge it where there are reasonable grounds, and disclose only the minimum the request lawfully requires. Numative will not provide any authority with direct or unrestricted access to its systems.

Each party's liability under this DPA is subject to the limitations in the Terms, except where the Clauses or Data Protection Law do not allow that. This DPA lasts as long as Numative processes Customer Personal Data, and its deletion, confidentiality and transfer terms survive the end of the Terms until that data is deleted.

Numative may update this DPA to reflect changes in law, guidance or the service, with notice on this page. No update will reduce the protection it gives Customer Personal Data.

A. Parties. Data exporter: Customer, as identified in its Numative account, acting as controller (or processor under Module Three). Its contact person is the account owner. Data importer: Numative, Illinois, United States, acting as processor; contact support@numative.com. Both parties sign by accepting the Terms.

B. Description of the transfer.

C. Competent supervisory authority. The supervisory authority of the EU Member State where Customer is established; if Customer is not established in the EU but has appointed a representative under Article 27 GDPR, the authority of the Member State where that representative is; otherwise the authority of the Member State where the affected data subjects are. For the UK, the Information Commissioner's Office; for Switzerland, the Federal Data Protection and Information Commissioner.

• Data minimization by design. The tracker sets no cookies and stores nothing on the visitor's device. Raw IP addresses and user agents are not stored. Only the browser and OS major version and a screen-size bucket are kept. Query strings are dropped by default, and URL fragments other than app routes never leave the browser. Visitors sending Do Not Track or Global Privacy Control are not recorded (on by default).
• Pseudonymization. Visitors are counted with a SHA-256 hash of the IP address, user agent and site, salted with a secret that changes every day and differs per site. The hash cannot be reversed, cannot be linked across days, and cannot be linked across sites. Collection refuses to run without the secret rather than fall back to a weak salt.
• Encryption. All traffic to and from the service uses TLS. Data at rest is encrypted by the hosting providers. Integration credentials (such as Google OAuth tokens) are additionally encrypted by Numative with a key held outside the database.
• Access control. Customer data is separated by organization and every read is scoped to it. Customer users have owner, admin and member roles and can turn on two-factor sign-in with an authenticator app; API keys are scoped and cannot create other keys. Numative staff access production systems only through the providers' authenticated consoles, with multi-factor authentication, and only to run, support or secure the service.
• Input validation and abuse protection. The collection endpoint validates and caps every field, rejects events for domains a site does not own, rate-limits by source, and classifies automated traffic before storage.
• Availability and resilience. The service runs on managed infrastructure with provider-managed redundancy and backups. Collection is built to keep accepting visits when a non-essential component fails.
• Monitoring and incident response. Application errors and service health are monitored continuously. Suspected incidents are investigated, contained and, where they affect Customer Personal Data, notified as described in this DPA.
• Deletion. Deleting a site removes its analytics data; retention limits are enforced automatically per plan.
• Subprocessor management. Each Subprocessor is bound by a data processing agreement with Standard Contractual Clauses or an equivalent transfer mechanism, and is chosen for its security practices.

Current as of November 6, 2026.