Data Processing Agreement.
Article 28 GDPR DPA between you (controller) and kindstats (processor). Incorporated by reference into our Terms of Service.
1. Parties
This Data Processing Agreement ("DPA") is entered into between the customer identified in the kindstats subscription ("Controller") and Nineties Engineering OÜ, Sepapaja 6, 15551 Tallinn, Estonia, registry code 16206643 ("Processor"), each a "Party".
2. Definitions
Capitalised terms not defined here have the meaning given in the GDPR (Regulation (EU) 2016/679). "Personal Data" means any information about an identified or identifiable natural person processed by Processor on behalf of Controller through the kindstats service.
3. Subject & duration of processing
Processor processes Personal Data in order to provide the kindstats analytics service described in the Terms of Service. The duration of processing is the term of the subscription, plus the retention windows set out in section 12.
Analytics data is retained for 36 months from collection, subject to earlier deletion at Controller's request or following termination under section 12.
The nature, purpose, categories of data subjects and categories of Personal Data are set out in Annex A.
4. Processing instructions
Processor processes Personal Data only on Controller's documented instructions, including those set out in the Terms of Service, this DPA, and the configuration choices Controller makes inside the kindstats dashboard (allowed domains, exported events).
Processor will inform Controller if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.
5. Confidentiality
Processor ensures that personnel authorised to process Personal Data are subject to a written duty of confidentiality and have received training on data-protection obligations.
6. Security measures
Processor implements the technical and organisational measures described in Annex B to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature of the processing and the rights and freedoms of data subjects.
7. Sub-processors
Controller grants Processor general authorisation to engage sub-processors. The current list is maintained in Annex C and at kindstats.com/dpa#annex-c.
Processor will notify Controller of any intended addition or replacement of a sub-processor at least 30 days in advance, giving Controller a reasonable opportunity to object on legitimate grounds. If Controller objects, the Parties will work in good faith to find a workable solution; if none can be found, Controller may terminate the subscription pro rata.
Processor remains fully liable to Controller for the performance of any sub-processor's data-protection obligations.
8. International transfers
Processor processes Personal Data exclusively inside the European Economic Area. Processor will not transfer Personal Data to a country outside the EEA without (a) Controller's prior written consent and (b) implementation of appropriate safeguards under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses.
9. Data-subject rights & assistance
Taking into account the nature of the processing, Processor assists Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling Controller's obligation to respond to requests from data subjects under Chapter III GDPR.
If a data subject contacts Processor directly with a request concerning Controller's data, Processor will forward the request to Controller without undue delay and will not respond to it itself unless instructed by Controller.
Processor also assists Controller in ensuring compliance with Articles 32–36 GDPR (security, breach notification, data-protection impact assessments and prior consultation), taking into account the information available to Processor.
10. Incident notification
Processor notifies Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Controller's data. The notification will include the information set out in Article 33(3) GDPR, to the extent it is then known.
11. Audit rights
Processor makes available to Controller all information necessary to demonstrate compliance with Article 28 GDPR. Processor will allow for and contribute to audits, including inspections, conducted by Controller or another auditor mandated by Controller, no more than once per calendar year and subject to reasonable confidentiality and scheduling.
Where appropriate, Processor may satisfy audit requests by providing third-party certifications (e.g. ISO 27001 reports from sub-processors) and a written response to a reasonable security questionnaire.
12. Return & deletion
On termination of the subscription, Processor will, at Controller's choice, return or delete all Personal Data, unless storage is required by Union or Member-State law. Production data is deleted 30 days after termination; backup copies expire on their normal rotation, after which Personal Data becomes unrecoverable. On request, Processor will confirm deletion in writing.
13. Controller obligations
Controller warrants that it has a lawful basis for the processing and the right to provide the Personal Data to Processor. Controller is responsible for (a) the lawfulness of the processing, (b) providing any required privacy notices to its website visitors, and (c) notifying supervisory authorities or data subjects where required.
If you accept this DPA on behalf of another organisation, you warrant that you have full legal authority to bind that organisation to this DPA.
14. Liability
Each Party's liability under this DPA is subject to the limitations of liability set out in the Terms of Service, except where such limitation is not permitted under Article 82 GDPR or other mandatory law.
15. Annexes
Annex A, Description of processing
| Subject matter | Provision of cookieless web analytics for Controller's websites. |
|---|---|
| Nature & purpose | Collecting, aggregating and reporting pageview and event data so Controller can understand traffic to its own websites. |
| Duration | Term of the subscription, plus retention windows set in §12. |
| Categories of data subjects | Visitors to Controller's websites. |
| Categories of personal data | Page URLs, referrer hosts, country/region (from local GeoIP), device class, browser/OS family, daily-rotated salted hash of (site, IP, UA), and any custom event payloads Controller chooses to send. |
| Special categories | None expected. Controller agrees not to send special-category data (Art. 9 GDPR) via custom events. |
Annex B, Technical & organisational measures
- Encryption. TLS 1.2+ in transit; AES-256 at rest on managed databases and object storage.
- Access control. SSO + hardware-key MFA for all production access. Role-based access; least-privilege defaults. Quarterly access reviews.
- Network. Private VPC for all production services. No public database endpoints. WAF on customer-facing edges.
- Backups. Encrypted daily database backups, 30-day retention, restore-tested monthly.
- Logging & monitoring. Centralised, immutable audit logs for production access; alerting on anomalous activity.
- Secure development. Code review on every change. Dependency scanning. Annual external penetration test.
- People. Background-checked staff. Confidentiality undertakings. Annual data-protection training.
- Incident response. Documented runbook with named owners; tested at least annually.
- Data minimisation. IP addresses not stored; visitor identifiers rotate daily and are unrecoverable thereafter.
Annex C, Sub-processors
| Service | Legal entity & registered address | Purpose |
|---|---|---|
| Bunny | BunnyWay d.o.o. Dunajska cesta 165, 1000 Ljubljana, Slovenia | CDN & script serving, backups, DNS & domains |
| Hetzner | Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany | Application backends & backups |
| Scaleway | Scaleway SAS 8 Rue de la Ville-l’Évêque, 75008 Paris, France | Application backends, backups & transactional email |
| Creem | Armitage Labs OÜ Rotermanni 14, Tallinn 10111, Estonia | Merchant of record for subscription billing, payments & applicable taxes |
| Zone | Zone Media OÜ Lõõtsa tn 5, 11415 Tallinn, Estonia | DNS & domains |
Last updated: 3 November 2026. Material changes are notified by email at least 30 days in advance.