Legal information · GDPR
Data processing agreement
This is a translation for your convenience. In the event of any discrepancy between the language versions, the Slovak version prevails.
Ten dokument jest dostępny w języku angielskim, niemieckim i słowackim. Wiążąca jest wersja słowacka.
1 Parties and conclusion
1.1
The controller is the customer — an entrepreneur or another legal entity that measures its websites with the Visitics service, or operates the AI chatbot on them, and determines the purposes and means of this processing. The processor is Esentra, s.r.o., with its registered office at Levočská 7711/47, 080 01 Prešov, Slovakia, company ID (IČO): 47 183 721, registered in the Commercial Register of the District Court Prešov, section Sro, insert No. 28128/P.
1.2
This agreement forms part of the contract for the provision of the service under the general terms and conditions (the "Terms"). It is concluded in electronic form by giving consent when an organization is registered and is effective for as long as the service is provided. In matters of personal data protection this agreement prevails over the Terms. Terms are to be interpreted in accordance with Article 4 GDPR.
2 Subject matter, nature, purpose and duration of the processing
2.1
For the controller, the processor operates the measurement of traffic on its websites: it receives data from the tracking script, stores it, creates daily statistical summaries from it and makes them available to the controller in the dashboard, in e-mail reports and through the API.
2.2
If the controller switches on the AI chatbot, the processor operates it on the controller's websites: it receives the visitors' messages, creates the answers with an artificial intelligence model operated on the processor's own servers in the European Union, stores the conversation transcripts and the requests for contact, passes the requests to the controller by e-mail and in the dashboard and, on the controller's instruction, sends the controller's reply to the visitor. The AI Analyst works exclusively with the statistical summaries of the controller's websites. If the controller switches on surveys (Feedback), the processor shows them to the visitors of the controller's websites according to the controller's settings, stores the answers with the context of the visit, passes a contact the visitor has agreed to give to the controller's Inbox and — where the controller's plan includes it — labels the texts with a topic and a sentiment, asks one follow-up question to a vague answer (only if the controller switches it on) and drafts replies for the controller's members, always with the artificial intelligence model on the processor's own servers in the European Union.
2.3
The processing is automated and comprises in particular collection, recording, organisation, storage, retrieval, consultation, combination within the controller's website, disclosure to the controller and erasure. The processor does not process the data for its own purposes, does not combine it between websites of different controllers and does not disclose it to third parties other than the sub-processors under Article 8.
2.4
The processing lasts for as long as this agreement is in force; the individual categories of data are kept for no longer than set out in Article 4.
3 Categories of data subjects and of personal data
3.1
The data subjects are the visitors of the controller's websites. The measurement processes:
- IP address and browser identifier (User-Agent) — exclusively transiently on receipt of a request, to compute the daily pseudonymous fingerprint and to determine the country, region and city from a local database; they are not stored,
- daily pseudonymous visitor fingerprint (8 bytes) — computed with a random daily key that is irreversibly destroyed after two days; after that the fingerprint can neither be attributed to a person nor linked to another day,
- visit data — addresses of the pages viewed without parameters (e-mail addresses and long numbers in the address are replaced), the source of the visit (referring domain, UTM parameters), device type, browser, operating system, language, country, region and city, time on the page and scroll depth,
- interactions — clicks (position, element and its text), frustration signals, JavaScript errors, speed metrics, the start and submission of forms without the content of the fields, and events sent by the controller.
3.2
If the AI chatbot is switched on, the following is also processed about the visitors who use it:
- messages and answers — e-mail addresses, telephone numbers, payment card numbers and IBANs written in a message are masked automatically before the message is stored or passed to the model,
- context of the visit — the address of the current page, the products viewed in this visit and the contents of the cart if the shop's add-on provides it; the daily pseudonymous fingerprint joins the conversation with the visit on the same day (orders after a conversation, the control group),
- data from the contact form in the chat — name, e-mail address, telephone number and message, only if the visitor fills them in; the artificial intelligence model does not process them,
- ratings of the answers, the language of the browser and the time of the messages.
3.3
If surveys (Feedback) are switched on, the following is also processed about the visitors who answer them:
- answers — ratings, the options chosen and texts; e-mail addresses, telephone numbers, payment card numbers and IBANs written in a text are masked automatically before the answer is stored,
- context of the visit — the address of the page, the device type, the country, the channel of the visit and the frustration signals of the same visit; the daily pseudonymous fingerprint joins the answer with the visit on the same day and limits the surveys to one a day; no lasting identifier is created,
- the place on the page the visitor points at — the address of the element and its position on the page, never a screenshot,
- contact — name, e-mail address and telephone number, only if the visitor fills them in and ticks the consent; the text of the consent is kept as evidence,
- data of the page passed by the controller (at most five short values, for example a customer type) and the order number if the controller's page passes it.
3.4
If the controller uploads a photograph as the avatar of the AI chatbot's agent, the person shown (as a rule an employee of the controller) is also a data subject; the photograph is processed only for display in the chat window.
3.5
The measurement uses no cookies and no storage in the visitor's browser. The window of the AI chatbot keeps the conversation in the browser's session storage (sessionStorage) only after the visitor has opened it; the storage is erased when the tab is closed. Surveys store nothing in the browser; the token of the answers exists only in the memory of the page.
3.6
Special categories of personal data under Article 9 GDPR and personal data relating to criminal convictions and offences under Article 10 GDPR are not processed purposefully: the controller must not send them in events and the AI chatbot does not ask for them. If a visitor writes such data into the chat on their own initiative, it remains only in the conversation transcript for the period under Article 4; a controller whose website concerns such matters (for example health) sets a shorter retention period for the transcripts. The same applies to the texts of survey answers: the survey window asks visitors not to write personal data and the controller does not ask for such data in its questions.
4 Retention periods
| Data | Retention period |
|---|---|
| Raw records of visits and events with the daily fingerprint | 30 days |
| Assignment of visits to the control group of the AI chatbot (with the daily fingerprint) | 30 days |
| Click positions for heatmaps (without the fingerprint) | 90 days |
| Transcripts of AI chatbot conversations and requests for contact | the period set by the controller in the range of 30 to 365 days, by default 90 days; then the texts, names, e-mail addresses and telephone numbers are erased and only aggregate counts remain |
| Survey answers (masked texts and the context of the visit, without a lasting identifier) | for the history of the plan under point 6.3 of the Terms, unless the controller deletes them earlier |
| Surveys shown in a visit and their control group (with the daily fingerprint) | 30 days |
| Contacts from surveys and their messages in the Inbox | until the item is resolved, then for the period set by the controller in the range of 30 to 730 days, by default 180 days |
| Daily summaries (aggregate counts without data on individuals) | for the history of the plan under point 6.3 of the Terms |
| Avatar and logo of the AI chatbot | until the controller removes or replaces them, at the latest until the website is deleted |
5 Instructions of the controller
5.1
The processor processes personal data only on documented instructions from the controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the processor is subject; in such a case the processor informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
5.2
The instructions are this agreement, the Terms and the settings the controller chooses in the service (in particular the measured website, content groups, goals, consent mode, respecting the Global Privacy Control signal, excluded IP addresses and, for the AI chatbot, the feed, the knowledge pages, own answers, the retention period of transcripts and the control group), including the consent to the processor's support looking into the dashboards under clause 7.3.
5.3
Where, in the processor's opinion, an instruction infringes the GDPR or other data protection provisions, the processor informs the controller without undue delay and suspends the processing concerned until the matter has been clarified.
6 Obligations of the controller
6.1
The controller is responsible for the lawfulness of the processing, in particular for the legal basis, for informing visitors under Article 13 GDPR and for assessing whether the measurement requires consent under Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications or under the corresponding law of the state in which it operates the website. It handles the requests of data subjects and, where necessary, carries out a data protection impact assessment.
7 Confidentiality and security
7.1
The processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; access to the data is limited to the persons who need it, with permissions matching their tasks, and only under the conditions of clause 7.3.
7.2
The processor has implemented the technical and organisational measures under Article 32 GDPR set out in Annex 1 and regularly evaluates and updates them in line with the state of the art.
7.3
Persons acting on behalf of the processor (support) look into the dashboards of the controller's websites only:
- on the controller's instruction, which is the consent an owner or admin of the organization gives in the settings of the organization, stating the websites, the scope (read only or also with changes of the website settings), access to visitors' chat transcripts and contacts and the duration (24 hours, 3 days or 7 days); the controller may withdraw the consent at any time with immediate effect, or
- in an emergency, being a security incident, a decision or order of a public authority or the need to avert damage threatening the controller, visitors or the service; in that case only a person with the highest platform administrator role, stating the reason, read only, without access to visitors' chat transcripts and contacts, and the owners and admins of the organization receive an e-mail about the access and its reason without undue delay. By concluding this agreement the controller instructs the processor to carry out such emergency access.
8 Sub-processors
8.1
The controller gives the processor general written authorisation to engage sub-processors. The current list is set out in Annex 2. No external provider of artificial intelligence models is engaged.
8.2
The processor informs the owners of organizations by e-mail at least 30 days in advance of any intended addition or replacement of a sub-processor. Within this period the controller may object on reasonable grounds relating to data protection. If the processor does not accommodate the objection, the controller may terminate the contract with effect from the day the new sub-processor is engaged and the processor refunds the proportionate part of the fee for the unused period.
8.3
The processor imposes on every sub-processor by contract the same data protection obligations as set out in this agreement, in particular the obligation to provide sufficient guarantees to implement appropriate technical and organisational measures. Where a sub-processor fails to fulfil its obligations, the processor remains fully liable to the controller as if it had breached them itself (Article 28(4) GDPR).
9 Transfers to third countries
9.1
Personal data is processed exclusively in the European Union and is not transferred to third countries or international organisations. A transfer would be possible only on the controller's prior instruction and under the conditions of Chapter V GDPR.
10 Assistance
10.1
Taking into account the nature of the processing, the processor gives the controller reasonable assistance in fulfilling its obligation to respond to requests for exercising the data subject's rights and in ensuring compliance with the obligations under Articles 32 to 36 GDPR. The controller can itself search, export and erase the transcripts of AI chatbot conversations in the dashboard.
10.2
As the measurement does not identify visitors and the fingerprint changes daily, the measured data usually cannot be attributed to a particular person (Article 11 GDPR). A request of a data subject delivered directly to the processor is forwarded by the processor to the controller without undue delay; the processor does not respond to it on the merits.
10.3
Assistance through the functions of the service is free of charge. Assistance beyond them that is not necessitated by a breach of the processor's obligations may be charged by the processor at a reasonable rate after prior agreement.
11 Personal data breach
11.1
The processor notifies the controller of a personal data breach without undue delay, at the latest within 24 hours after becoming aware of it. The notification contains in particular a description of the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed (Article 33(3) GDPR); information not available at once is provided in phases without undue further delay.
12 Erasure or return of personal data
12.1
At the choice of the controller, the processor deletes the personal data or returns it to the controller by means of the export under Article 13 of the Terms after the end of the provision of the service, and deletes existing copies unless Union or Member State law requires storage of the personal data.
12.2
When a website is deleted in the service, its measured data is erased immediately. When an organization is deleted, the measurement of its websites stops immediately and the data is erased after 7 days, during which the controller may export the data and withdraw the deletion; the owners of the organization receive a confirmation of the erasure by e-mail. Where the contract ends other than by deletion of the organization, the data is erased after the 30-day period for its export has expired. It is removed from backup copies in their regular rotation, at the latest within 90 days. The erasure is postponed only where and for as long as Union or Member State law, or a decision of a public authority issued under it, requires the data to be kept. On request the processor issues a confirmation of the erasure.
13 Demonstrating compliance and audits
13.1
On written request the processor makes available to the controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR.
13.2
The processor allows for and contributes to audits, including inspections, conducted by the controller or by an auditor mandated by it who is bound by confidentiality and is not a competitor of the processor. An audit is announced at least 30 days in advance, as a rule takes place at most once a year during working hours and must not endanger the security of other customers' data. The costs of the audit are borne by the controller unless the audit reveals a material breach of the processor's obligations.
14 Liability
14.1
The liability of the parties towards data subjects is governed by Article 82 GDPR. Between the parties, Article 12 of the Terms applies. The controller compensates the processor for damage incurred as a result of carrying out an unlawful instruction of the controller.
15 Final provisions
15.1
This agreement is governed by the law of the Slovak Republic. It is amended under the procedure of Article 15 of the Terms; the list of sub-processors under the procedure of Article 8.
Annex 1 – Technical and organisational measures
- encrypted transfer of data by TLS (HTTPS) with enforced HTTPS (HSTS) and security headers (Content Security Policy, protection against framing),
- data minimisation on receipt: the IP address and the browser identifier are not stored, the visitor fingerprint is computed with a daily key destroyed after two days, the content of forms is not recorded, e-mail addresses and numbers in page addresses and in AI chatbot messages are masked,
- logical separation of the data of individual websites and controllers; role-based access to the dashboard with the option to restrict access to selected websites,
- passwords stored only as Argon2id hashes, two-factor authentication (TOTP) with an encrypted secret, mandatory for platform administrators and, at the request of the owner of an organization, for all its members, protection against password guessing by limiting attempts,
- platform administrator roles with the least permissions needed (for example billing only, support only or read only), confirming sensitive steps again with a code, shorter sign-ins of administrators (ended after 60 minutes of inactivity, at the latest after 24 hours) and an e-mail notice of every sign-in of an administrator,
- support looking into dashboards only under clause 7.3, with a record of every page viewed and every change,
- sessions with a strictly necessary cookie flagged HttpOnly and SameSite, sign-out after inactivity, an overview of active sign-ins and remote sign-out, CSRF protection of forms,
- the artificial intelligence model server reachable only from the application server over a private network, not from the internet; protection against misuse of feed and page downloads for internal addresses (SSRF); limits on messages and conversations,
- uploaded images are redrawn and stored without metadata,
- automatic erasure of data after the periods under Article 4,
- a record of changes in the organization (who, what, when) including changes made by platform administrators, regular backups with restricted access and regular software updates,
- persons with access to the data bound by confidentiality and access limited to the persons who need it.
Annex 2 – Sub-processors
Providers of server hosting (application server, database and artificial intelligence model server) and of the e-mail service with their seat and data centres in the European Union. Their business names, seats and data locations will be added before the provision of the service begins; changes are notified under the procedure of Article 8.