# Data Processing Agreement (DPA) _GDPR art. 28 · MVSP Analytics (mvsp.ai) · v1 · 2026-09-30_ This DPA supplements the Terms of Service under which the site operator ("**Controller**") uses MVSP Analytics ("**Processor**"). Where the Terms and this DPA conflict on data-protection matters, this DPA prevails. ## 1. Definitions Terms defined in the GDPR (Regulation (EU) 2016/679) have the same meaning here. "**Personal Data**" means the personal data described in `PROCESSING.md`, processed by Processor on behalf of Controller. ## 2. Subject-matter, duration, nature and purpose - **Subject-matter:** the operation of the MVSP Analytics service. - **Duration:** for as long as Controller uses the service, plus the retention period defined in `PROCESSING.md`. - **Nature and purpose:** aggregate web analytics — collecting anonymised pageviews and events from Controller's website(s) and making them queryable in a dashboard. - **Categories of data subjects and Personal Data:** as described in `PROCESSING.md`. ## 3. Instructions Processor shall process Personal Data only on documented instructions from Controller, including: - The instructions embedded in the Terms and this DPA; - The behaviour codified in the MVSP Analytics source code and public API; - Any additional written instructions Controller sends to `privacy@mvsp.ai`. Processor shall immediately inform Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. ## 4. Confidentiality Processor ensures that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. ## 5. Security (art. 32) Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Measures currently in place are listed in `PROCESSING.md` § "Technical and organisational measures" and include, at minimum: - TLS in transit; - Unconditional IP anonymisation at ingest; - No collection of persistent user identifiers; - Rate limiting and audit logging; - Access restricted by admin token and HttpOnly session cookie; - Data storage confined to the EU. ## 6. Sub-processors (art. 28(2)) - Controller grants general authorisation for Processor to engage the sub-processors listed in `SUBPROCESSORS.md`. - Processor shall announce any addition or replacement of sub-processors on that page at least **30 days** before the change takes effect, giving Controller the opportunity to object. - Processor imposes the same data-protection obligations on its sub-processors as are set out here. ## 7. Data subject rights (art. 28(3)(e)) - Processor provides a self-service erasure endpoint (`POST /privacy/erase-session`) and a browser helper (`mvspAnalytics.erase()`) so data subjects can exercise their right to erasure directly. Access and portability are likewise self-service via `POST /privacy/access-session` (`mvspAnalytics.exportData()`). - For rectification or restriction requests (and access/portability requests that cannot be served by the self-service endpoint), Processor will assist Controller within 10 working days of a written request to `privacy@mvsp.ai`. ## 8. Data breach notification (art. 33) Processor notifies Controller without undue delay, and in any event within **72 hours**, after becoming aware of a personal data breach. The notification includes: - The nature of the breach and categories / approximate number of data subjects affected; - The likely consequences; - Measures taken or proposed to address the breach. ## 9. Data Protection Impact Assessment (art. 35–36) Processor assists Controller — taking into account the nature of processing and the information available — in carrying out DPIAs and in prior consultations with the supervisory authority. ## 10. Deletion or return (art. 28(3)(g)) On termination of the service: - Personal Data covered by the standard retention (365 days for BigQuery rows) is deleted automatically by table-level expiry. - Firestore records related to Controller's sites are deleted within 30 days of a written request from Controller. - Backups: none. There is no separate backup system that could retain deleted data. ## 11. Audit rights (art. 28(3)(h)) Processor makes available to Controller all information necessary to demonstrate compliance with GDPR art. 28, including: - This DPA and the accompanying `PROCESSING.md`, `SUBPROCESSORS.md`; - The publicly available source code at github.com/…/mvsp.ai; - A written response to reasonable questions sent to `privacy@mvsp.ai`. On-site audits are not offered given the service's scale, but Controller may inspect the source code and infrastructure documentation at any time. ## 12. International transfers None for the analytics service: all analytics processing takes place in the EU. The separate MVSP Email API uses Resend, Inc. (US entity) as a sub-processor, with e-mail delivered through Resend's EU region and EU Standard Contractual Clauses as the transfer safeguard (see `SUBPROCESSORS.md`); it does not receive analytics data. Should Processor ever need to transfer Personal Data outside the EEA, it will use the European Commission's Standard Contractual Clauses and update `SUBPROCESSORS.md` at least 30 days before the transfer begins. ## 13. Term and termination This DPA takes effect when Controller starts using the service and terminates when Controller stops using it and all Personal Data has been deleted per § 10. ## 14. Governing law and jurisdiction Norwegian law. Courts of Oslo have exclusive jurisdiction, subject to the mandatory jurisdiction rules of the GDPR. --- To countersign: reply to `privacy@mvsp.ai` with the text **"We accept MVSP Analytics DPA v1 (2026-09-30) on behalf of \."** Include the site slug(s) the DPA applies to. We keep a record of every acceptance.