Data processing agreement

Version 1 · 5 November 2026. Effective date: 5 November 2026. English is the only language version.

This data processing agreement (“DPA”) is part of the terms of service between the customer (the “controller”) and MAAT Automation, trading as Wholetally (the “processor”). It applies when the processor processes personal data on behalf of the controller through the service, and it implements Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). Terms such as personal data, processing and personal data breach have the meaning given in the GDPR. If the DPA and the terms conflict, the DPA prevails for data protection matters. Customers who need a separately signed PDF can request one at hello@wholetally.com; the online DPA applies automatically to every account.

1. Subject matter, duration, nature and purpose

The processor provides web analytics: it receives page views and events from the controller’s websites, stores them, and shows aggregated reports, AI summaries, email reports and API/MCP access to the controller. Processing lasts as long as the controller’s account exists, plus the deletion period in section 10. Details are in Annex I.

2. Instructions

• The processor processes personal data only on documented instructions of the controller. The terms, this DPA and the settings the controller chooses in the dashboard or through the API (such as hash mode, compliance mode and retention) are those instructions.
• The processor informs the controller if, in its opinion, an instruction infringes the GDPR, and if EU or Member State law requires processing beyond the instructions (unless that law prohibits informing).
• The processor does not use the controller’s data for its own purposes, does not sell it and does not use it for advertising or to train AI models.

3. Confidentiality

Everyone the processor authorises to process the data is bound to confidentiality by contract or by law.

4. Security

The processor takes the technical and organisational measures in Annex II, appropriate to the risk as required by Article 32 GDPR. It may update these measures as long as the overall level of security does not decrease.

5. Sub-processors

• The controller gives general authorisation for the sub-processors in Annex III (also published on the sub-processor list).
• The processor informs the controller by email at least 30 days before adding or replacing a sub-processor. The controller may object on reasonable data protection grounds within that period; if the parties can’t resolve the objection, the controller may terminate the affected service and receive a refund of prepaid fees for the remaining period.
• The processor imposes data protection obligations on each sub-processor that are at least as protective as this DPA and remains liable to the controller for their performance.

6. International transfers

Analytics and account data are stored in the EU. Where a sub-processor processes data outside the EEA, the processor ensures a valid transfer mechanism under Chapter V GDPR: an adequacy decision (including the EU-US Data Privacy Framework for participating providers) or the Standard Contractual Clauses, with supplementary measures where needed.

7. Assistance

• The processor helps the controller, through the dashboard, API and by email, to respond to requests from data subjects. Because the service stores no IP addresses, cookies or visitor IDs, individual records usually can’t be linked to a person; the processor explains this where relevant.
• The processor forwards requests it receives directly from data subjects to the controller without undue delay and does not answer them itself.
• The processor helps with data protection impact assessments and prior consultations by providing the information in this DPA and reasonable additional information.

8. Personal data breaches

The processor notifies the controller without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting the controller’s data. The notification includes, as far as known, the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken or proposed. The processor updates the controller as more becomes known.

9. Audits

The processor makes available all information needed to demonstrate compliance with Article 28 GDPR. The controller may carry out an audit, or have one carried out by an independent auditor bound to confidentiality, once a year with 30 days’ notice, or after a breach. Audits take place during business hours and at the controller’s cost, without disproportionate disruption. Information requests by email are the first step.

10. Deletion and return

During the agreement the controller can export its data at any time. Within 30 days after the account ends, the processor deletes the controller’s personal data, including copies, unless EU or Member State law requires storage. Backups are overwritten within their rotation period (Cloudflare D1 Time Travel, at most 30 days on our paid plan).

11. Liability and term

The liability provisions of the terms of service apply, without limiting the rights of data subjects under Article 82 GDPR. This DPA ends when the processor no longer processes personal data for the controller. Sections that by their nature continue (confidentiality, deletion) survive.

Annex I. Description of the processing

• Data subjects: visitors to the controller’s websites and apps; users of the controller’s dashboard account.
• Categories of data: page address, referrer, UTM parameters, country (derived from the IP address, which is not stored), browser, operating system and device type (derived from the user agent, which is not stored), screen size class, event names and properties sent by the controller, revenue amounts with their attributed source (from the controller’s payment provider), bot/crawler classification. Optional, only in daily hash mode: a one-way hash of salt, site, IP address and user agent, kept for at most about two days. Account users: email address and usage records.
• Special categories: none. The controller must not send any.
• Frequency: continuous, for every page view and event.
• Retention: as set per site (default 395 days, minimum 30 days); hashes about two days; daily salts one day.
• Processor contact: hello@wholetally.com. Controller: the customer named in the account.

Annex II. Technical and organisational measures

• Data minimisation by design: no cookies or device storage, no stored IP addresses, no visitor IDs, no fingerprinting.
• Daily random salt for the optional hash mode, deleted after one day; hashes kept separately from page view records and deleted after about two days.
• Automatic deletion of page view records after the configured retention period.
• Encryption in transit (TLS) for all connections; Cloudflare D1 encrypts all stored data at rest with AES-256-GCM (keys managed by Cloudflare).
• Email and password sign-in: passwords stored only as salted PBKDF2 hashes; single-use password reset links valid for 30 minutes; reset links, sessions and API tokens stored only as hashes; signed, HttpOnly session cookies.
• Scoped API tokens (read or write) that can be revoked at any time; integration secrets stored encrypted.
• Rate limiting on sign-in and ingestion; bot filtering on incoming hits.
• Access to production systems limited to the processor’s owner, with multi-factor authentication enabled on Cloudflare and on other provider accounts that offer it.
• Tenant isolation: every query is scoped to the controller’s sites.
• AI features receive aggregated statistics only, never visitor-level records, IP addresses or hashes.
• Database stored in the EU jurisdiction of the hosting provider; point-in-time recovery for incidents.
• Incident response: on suspicion of a personal data breach the owner assesses scope and risk without undue delay, contains the incident, documents findings, and notifies affected controllers within 48 hours as in section 8; supervisory authorities are notified when the law requires it.

Annex III. Sub-processors