Data Processing Addendum

1. Parties, scope, and roles

The parties are the customer (the "Controller") and Egger, Inc., Delaware, United States (the "Processor"), operating OpenRevenue. This DPA applies wherever the customer's use of OpenRevenue involves personal data protected by the GDPR, UK GDPR, or similar laws.

For visitor analytics and customer-connected analytics integrations described below, the customer determines purposes and means and is the Controller. We process only on documented instructions: these Terms/DPA, the product's configuration as set by the customer, and the documented behavior of the service.

For OpenRevenue account, billing, security, and platform administration data, Egger, Inc. acts as an independent controller as described in the Privacy Policy.

2. Definitions

"Personal data", "processing", "data subject", "controller", "processor", "sub-processor", and "supervisory authority" have the meanings given in the GDPR. "Visitor data" means data generated by the OpenRevenue tracker (and related ingest APIs) on the customer's sites. "Connected data" means optional datasets the customer routes to OpenRevenue (for example revenue transactions or imported analytics history).

3. Details of the processing

• Subject matter and purpose: providing web analytics, realtime views, funnels, performance metrics, sharing/widgets, APIs, digests/alerts, and optional attribution or import features the customer enables—nothing else.
• Duration: the life of the customer's relevant projects/account, plus deletion and backup windows in the Privacy Policy and Terms.
• Data subjects: visitors of the customer's sites and apps; where connected data is enabled, individuals represented in those records (for example purchasers in payment metadata).
• Categories of data: usage data (paths, referrers, campaign parameters, device/browser/OS family, approximate geo, timing, performance metrics), visitor and session identifiers as implemented by the product, customer-defined event names/properties, and connected transaction or import fields the customer authorizes.
• Special categories: none intended. The customer agrees not to send special-category data or direct identifiers into events, properties, paths, or identify-style fields.

4. Pseudonymization and product design

OpenRevenue is designed to support privacy-friendly analytics: no advertising network, no cross-site advertising profile, and no session replay. Visitor identifiers are first-party random IDs when browser storage is available, with a daily-rotating server-side fallback when storage is blocked. IP addresses may be processed for geo, security, and fallback identification and may be stored with events as described in the Privacy Policy.

These measures reduce risk but do not mean visitor data is outside the GDPR's definition of personal data in all cases. Controllers should assess their own use, notices, and legal bases—including ePrivacy/cookie rules where first-party storage is used.

5. Processor obligations

• Process personal data only on documented instructions, unless Union or Member State law requires otherwise (in which case we inform the customer unless legally prohibited).
• Ensure persons authorized to process the data are bound by confidentiality.
• Implement and maintain the security measures in section 6.
• Notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with information reasonably available to help the customer meet their own notification duties.
• Assist the customer, taking the nature of processing into account, with data subject requests, security, DPIAs, and consultations with authorities, to the extent the customer cannot fulfill these alone through the product.
• Delete or return personal data after the end of processing services as described in section 8, and make available information reasonably necessary to demonstrate compliance as in section 9.

6. Security measures

• Encryption in transit (HTTPS/TLS) for the script, dashboard, and APIs.
• Access controls, authentication options (including passkeys and two-factor authentication), hashed API secrets, and least-privilege operational access.
• Visitor analytics stored and queried on self-hosted ClickHouse infrastructure at Hetzner in Falkenstein, Germany.
• Isolation of customer projects in the application data model; monitoring and abuse prevention.
• Infrastructure providers listed in the Privacy Policy subprocessors table, bound by their own security programs and our contracts with them.

7. Subprocessors

The customer authorizes the subprocessors listed in the Privacy Policy (the living register for this DPA). We will update that list when providers that process personal data for OpenRevenue change. If a customer objects on reasonable data-protection grounds to a new subprocessor and we cannot offer a workable alternative, the customer may terminate the affected service and receive a pro-rated refund of prepaid unused fees where applicable.

We remain responsible to the customer for our subprocessors' performance insofar as they process personal data for us, and we impose data-protection obligations no less protective than this DPA in substance.

8. Deletion, return, and data subject requests

Customers can delete projects and accounts in the product; those actions are instructions to delete associated personal data from primary stores according to our deletion workflows. Exports and APIs provide return/portability where the product supports them.

If a data subject contacts us about a customer's site, we will direct them to the customer (controller) and assist the customer as section 5 requires. For visitor analytics, product design may limit our ability to locate an individual's rows; we will say so clearly when that is the case.

9. Audits

At most once per 12-month period, on 30 days' written notice, the customer may request written information and documentation reasonably necessary to verify compliance with this DPA. If that is insufficient for a genuine regulatory requirement, the parties will agree in good faith on scope, timing, confidentiality, and cost of any further review. Audits do not extend to other customers' data or information that would compromise security.

10. International transfers

OpenRevenue and its subprocessors may process personal data in the European Union, the United States, and other countries. Visitor analytics stored in ClickHouse is hosted on Hetzner in Falkenstein, Germany. Where a transfer from the EEA/UK/Switzerland to a country without an adequacy decision requires a transfer mechanism, the parties rely on Standard Contractual Clauses (processor modules as applicable), incorporated by reference, and/or a subprocessor's Data Privacy Framework certification where it holds one.

11. Liability, precedence, and term

Liability under this DPA follows the Terms of Service. On data-protection conflicts between this DPA and the Terms, this DPA controls. It takes effect when the customer first uses the service as a processor relationship, continues while we process personal data for the customer, and survival clauses (confidentiality, deletion) continue as needed.

We may update this DPA as law and the product evolve, with notice consistent with the Terms. The version published at /dpa with its date is authoritative. Questions: support@openrevenue.com.