Data Processing Addendum

1. Scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between ReDigital Online Optimization Inc (“Processor”, “we”) and the Customer (“Controller”, “you”). It applies to personal data in the traffic data you send to Lume (“Customer Personal Data”). It meets the requirements of Article 28 of the EU and UK GDPR, PIPEDA and Quebec’s private-sector privacy law, and the service-provider requirements of US state privacy laws. If this DPA conflicts with the Terms, this DPA wins for Customer Personal Data.

2. Details of the processing

• Subject matter and purpose: providing traffic analytics, agent classification and verification to you.
• Duration: the term of your subscription, plus the deletion periods in section 9.
• Data subjects: visitors to your websites and applications, including the people behind automated requests.
• Categories of data: request metadata (method, host, path and referrer without query strings, utm_source, user agent, Accept-Language, response status and time), country and network derived from the IP address, a truncated IP prefix (/24 for IPv4, /48 for IPv6), and any optional agent-protocol metadata you choose to send. Full IP addresses are used transiently and never stored.
• Special categories: none intended. Do not send special-category data.

3. Our obligations

We will:

1. process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use of the Service, unless the law requires otherwise (in which case we tell you first, unless the law forbids it);
2. ensure that people authorized to process it are bound by confidentiality;
3. apply the security measures in section 7;
4. use subprocessors only as set out in section 5;
5. help you, taking into account the nature of the processing, to respond to data-subject requests;
6. help you with security, breach notification, data-protection impact assessments and prior consultations;
7. delete or return Customer Personal Data at the end of the Service, as set out in section 9;
8. make available the information needed to demonstrate compliance, and allow audits as set out in section 8;
9. tell you promptly if we believe an instruction infringes data-protection law.

We do not sell Customer Personal Data, share it for cross-context behavioural advertising, or use it for any purpose other than providing the Service, except to produce aggregated statistics that identify no individual, customer or site.

4. Your obligations

You are responsible for the lawfulness of the collection, including giving your visitors any notice and obtaining any consent the law requires, and for the instructions you give us.

5. Subprocessors

You authorize us to use the subprocessors listed on our Subprocessors page. Each is bound by written terms that protect data at least as much as this DPA, and we remain responsible for them. We will give at least 30 days’ notice before adding or replacing a subprocessor, by updating that page and emailing account owners. You may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, you may terminate the affected Service and receive a pro-rata refund of prepaid fees for it.

6. International transfers

Customer Personal Data is stored and processed in the United States. For transfers from the EEA, the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor), are incorporated into this DPA; for the UK, the International Data Transfer Addendum; for Switzerland, the Clauses as adapted for the Swiss FADP. Where a recipient is certified under the EU-US Data Privacy Framework, we may rely on that certification instead.

7. Technical and organizational measures

• Data minimization: query strings and fragments removed at ingest; IP addresses truncated before storage; full IPs deleted from the processing queue as soon as verification finishes.
• Encryption: TLS for data in transit; third-party credentials encrypted at rest (AES-256-GCM).
• Access control: ingest and API tokens stored only as a SHA-256 hash, scoped to write or read, and revocable at any time; dashboard sign-in through our authentication provider.
• Tenant isolation: every query is scoped on the server to the customer’s own projects.
• Retention: traffic data deleted automatically after 395 days.
• Monitoring: uptime and error monitoring of our services, with logs that carry no full IP addresses.
• Vendors: subprocessors chosen for their security practices and bound by data-processing terms.

8. Audits

On written request, no more than once a year, we will answer reasonable security questionnaires and provide the information needed to show compliance with this DPA. An on-site audit is available only where a supervisory authority requires it or after a breach affecting your data, on reasonable notice and at your cost.

9. Breaches, deletion and return

Breaches. We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Customer Personal Data, with the information you need to meet your own obligations.

Deletion. Traffic data is deleted automatically 395 days after each request. When your organization is deleted, its access is revoked immediately and its account data is deleted 30 days later; traffic data already recorded is no longer accessible through the Service and is deleted when its retention period ends. You can export data with the dashboard’s CSV export, where your plan includes it, before you leave.

10. Signed copy

This DPA applies automatically when you accept the Terms. If you need a countersigned copy, email [email protected].