Data processing agreement
Haimoo Analytics data processing agreement (DPA)
The customer is the controller of its website analytics, and Haimoo Company Oy is the processor. This agreement follows Article 28 GDPR and the structure of the standard contractual clauses in Commission Decision (EU) 2021/915. It is part of the service agreement and needs no separate signature. The English version is binding.
1–4 Processing
Haimoo processes data only on the customer's instructions.
1. This agreement applies for as long as Haimoo processes the customer's analytics data. 2. Haimoo processes the data only on the customer's documented instructions, which are this agreement and the settings the customer makes in the service. Haimoo informs the customer if, in its opinion, an instruction infringes the law.
3. Persons processing the data are committed to confidentiality. 4. Haimoo implements the technical and organisational measures described in Annex 2.
5 Subprocessors
New subprocessors are announced 30 days in advance.
The customer gives general prior authorisation for the subprocessors named in the subprocessor list. Haimoo gives at least 30 days' notice of any new or replaced subprocessor, and the customer may object to the change. Haimoo binds its subprocessors to the same data protection obligations and remains responsible for them.
6–8 Assistance and breaches
Personal data breaches are notified without undue delay.
6. Haimoo assists the customer with data subject requests and with its obligations on security, personal data breaches and impact assessments (Articles 32–36 GDPR).
7. Haimoo notifies the customer of a personal data breach without undue delay after becoming aware of it, describing its nature, likely consequences and the measures taken as far as they are known. 8. Analytics data is stored in Finland. Data is transferred outside the EU and EEA only in accordance with Chapter V GDPR.
9–11 Termination and audits
Data is deleted within 30 days after the agreement ends.
9. Haimoo deletes the customer's analytics data within 30 days after the agreement ends unless the law requires it to be kept. Before that, the customer can export its data as CSV. Deletion and return are done by hand. The data leaves the encrypted backups within 14 days at the latest.
10. Haimoo makes available the information needed to demonstrate compliance with this agreement and allows reasonable document or remote audits agreed in advance. 11. On data protection matters, this agreement prevails over the service agreement. Finnish law applies.
Annex 1
Description of the processing
Purpose: website usage statistics for the customer. Data subjects: visitors to the customer's website. No special categories of personal data are processed, and the customer must not send them in events. Location: Hetzner, Helsinki data centre, Finland.
Stored data: page path, referrer, UTM parameters, device, browser and operating-system category, country and city, a daily rotating site-specific pseudonymous identifier, a session identifier, and event name and time. For online shops also order number, amount, currency and products, without the buyer's name or contact details. The IP address and User-Agent are processed transiently and are not stored in events. Events are kept for the website's retention period, by default 1095 days, and older events are deleted automatically every day.
If the customer turns on the optional site speed measurement, page speed measurements (Core Web Vitals: page path, device class mobile or desktop by browser window (viewport) width, rounded measured values and time) are also stored without a visitor or session identifier and are kept for at most 90 days.
Annex 2
Technical and organisational measures
All traffic uses HTTPS, with HSTS and security headers enabled. The database listens only on the server's internal address. Event records have no IP address field, and the full User-Agent string is not stored. The visitor identifier is site-specific and rotates daily. The tracking script sets no cookies.
User passwords are stored as bcrypt hashes, and a customer sees only its own websites. The database is backed up daily in encrypted form and copied to a second server in the same data centre. Old events are deleted automatically every day according to the retention period. Production dependencies are checked for known vulnerabilities on every code change.