Legal

Data processing agreement

This agreement belongs to the terms and conditions and applies automatically as soon as you create an account. You do not need to sign anything or request anything. If you do need a signed copy, for your own records for instance, we will send one on request to [email protected].

It sets out what article 28 of the GDPR prescribes.

The parties and their roles

You are the controller: you decide which data you measure, about whom, and for what.

We, Piex Commerce (Frans Halsstraat 19, 2162 CK Lisse, the Netherlands, Chamber of Commerce 93463480), are the processor: we run the measurement server that data passes through, and we do nothing with it beyond what you instruct.

If you are yourself a processor for someone else — an agency working for its client, for instance — you are responsible for the arrangements with that party. With Tagyard the account is in the client’s name, and then that client is our counterparty.

What we process, and for what

Subject matter and duration

We process personal data solely to deliver the service set out in the terms: running your tagging and preview server, forwarding what arrives there to the destinations you configure in your Tag Manager, and keeping a traffic log.

The processing lasts as long as your agreement lasts.

Which data it concerns

Exactly what passes through is up to you, because you set up the measurement. In practice it concerns:

  • technical details of the visit: IP address, user agent, referring page, time, and the address requested;
  • identifiers you send along, such as cookie IDs, click IDs and a customer or user ID;
  • event data you send along, such as pages viewed, products and order values;
  • contact details you send along, for example a hashed email address with enhanced conversions.

The data subjects are the visitors and customers of your website.

What should not pass through

Do not send special categories of personal data through your measurement server: data about health, race, religion, political opinion, trade union membership, sexual orientation, or biometric and genetic data. Nor criminal offence data.

Our product is not set up for that and we have taken no additional measures for it. If you do it anyway, that is your choice and your responsibility.

On your instruction only

We process your data solely on your documented instruction. Using the service as intended counts as that instruction.

We do not use your data for ourselves: not to improve our product, not to train models, and not to sell or show to anyone else. What we keep for ourselves is the number of requests per day per measurement server — that is a figure and not personal data, and we need it to watch your limit and make your invoice.

Where a law requires something else of us, we tell you beforehand, unless that same law forbids it.

If we consider an instruction of yours to infringe data protection law, we say so and may suspend carrying it out.

Confidentiality

Everyone with access to your data at our end is bound to confidentiality, also after the work or the employment has ended. We grant access only to those who need it for their work.

Security

We take appropriate technical and organisational measures, matched to the risk. Concretely:

  • encrypted traffic: all traffic to your measurement address goes over https, with a certificate we request and renew automatically;
  • separated measurement servers: every customer has their own container pair; there is no shared store in which customers’ data sits mixed together;
  • role-based access: what someone sees depends on their role on the account, and invoices are visible only to the owner;
  • encrypted passwords, never stored in readable form;
  • limited administrative access to the underlying machines, only for those who need it;
  • automatic clean-up of data whose retention period has expired.

We may adjust the measures as long as the level of protection stays the same or improves.

Other parties we engage

You give us general authorisation to engage other processors. Which ones those are is in the sub-processor list, with what they do and where they sit.

If the list changes

If we add one or replace one, we tell you at least thirty days in advance at the email address of the account owner. If you have a reasoned objection, let us know within that period; if we cannot resolve it, you may cancel with effect from the date the change takes effect, at no cost for the remainder of your period.

Our responsibility remains

With every party we engage we make the same arrangements as set out here. If such a party does something wrong, we are liable to you for it as if we had done it ourselves.

Where the data sits

Your measurement server and your traffic history sit within the European Union, with Hetzner in Germany or Finland. We do not transfer that data to a country outside the EU.

That applies to the data passing through your measurement server. For payment data it is different; that is set out in the sub-processor list and in our privacy statement.

Where your data goes next once your measurement server forwards it — to Google, Meta or another destination — you decide in your Tag Manager. That transfer is your processing, not ours.

If something goes wrong

If we discover a personal data breach, we report it without undue delay and in any case within 48 hours of becoming aware, to the email address of the account owner.

We report what happened, which data and how many data subjects it likely concerns, what the likely consequences are, and what we are doing about it. If we do not yet know everything, we send what we do know first.

Reporting to the supervisory authority and informing data subjects is yours to do; that belongs to your role as controller. We assist you with everything we have.

Assistance with requests and obligations

Requests from data subjects

If you receive a request for access, correction, erasure or portability, we help you carry it out as far as the data sits with us. If such a request reaches us by mistake, we forward it and do not answer it ourselves.

Assessments and consultation

We assist you, as far as reasonably possible, with a data protection impact assessment and with consulting the supervisory authority.

For assistance more extensive than supplying data we already hold, we may charge reasonable costs. We say so in advance.

Audits

On request we give you the information needed to demonstrate that we comply with this agreement.

If you want an audit, that is possible at most once a year, with thirty days’ notice, during working hours, and without the service suffering for it. The costs are yours, unless the audit reveals a significant failing. An auditor that is a competitor of ours we may refuse.

On a reasonable suspicion of a breach, the once-a-year limit does not apply.

At the end

At the end of your agreement we delete your data, or return it if you ask for that within thirty days.

Concretely: your measurement server pair is cleared away and your traffic history deleted. Back-ups still running are overwritten within the ordinary cycle of at most thirty days.

Data we are legally required to keep — invoices, for instance — we keep for as long as we must, and do nothing else with.

Order of precedence

Where this agreement and the terms and conditions conflict, this agreement prevails, as far as the processing of personal data is concerned.

This agreement exists in Dutch and in English. In case of any difference, the Dutch text prevails.