Data processing agreement (DPA)

1. Subject matter, nature and purpose

Audience measurement of the controller’s websites: collection, cleaning, storage, calculation of aggregated statistics, reports and sharing as decided by the controller.

2. Data subjects and data

Data subjects: the visitors to the controller’s sites. Data processed:

• the address of the page viewed (cleaned: identifiers, emails, tokens and non-authorised parameters removed before storage), and the page title only if the customer enables it;
• the referring site (referrer) and campaign parameters (utm_*);
• the type of browser, system and device, the screen size, the language;
• the country, inferred from the IP address at the time of the visit;
• the events the customer chooses to measure (for example "sign-up"), without personal data;
• a visit identifier calculated from the IP address, the browser and a salt renewed every day: in Essential mode, it does not make it possible to recognise a visitor from one day to the next;
• in Complete mode only, if the customer enables it for a site and after the visitor’s consent in the banner: the fingerprint (site-specific HMAC) of a random identifier kept for 6 months at most in the visitor’s browser, never the identifier itself; the log of page views and events linked to this fingerprint, with their source. This data is pseudonymised and therefore remains personal data;
• proof of the visitor’s choice (acceptance, refusal or withdrawal): date, choice, scope, version and language of the text presented, receipt fingerprint;
• to set bots aside: the browser identification, the indication that the browser is driven by a program, and the network of origin (data centre or not). Bot hits are not recorded as visits; only their number per day and per type is kept.

All this measurement data is only collected after the visitor’s prior consent, in both modes. The IP address is used to calculate the daily identifier and the country, and to recognise data centre networks (bots), and is then stored nowhere. No cookie is used. In the visitor’s browser, AlpiStats remembers their choice (acceptance or refusal, scope, date, text version) and, in Complete mode after consent, the random identifier described above.

3. Duration and retention

The agreement lasts as long as the customer has an account. The following periods are the same for all visitors:

• the visitor’s choice (acceptance or refusal) is valid for 6 months, not extended by a simple visit; the Complete mode random identifier is used for 6 months at most;
• detailed data (events, sessions, Complete mode pseudonymised log) is deleted automatically 6 months after it is recorded;
• monthly and daily totals that are truly anonymous (page views, visits) are kept for 25 months;
• proof of consent (date, choice, scope, version and language of the text, receipt fingerprint) is kept as long as the data it justifies exists, and 12 months at most.

Data is deleted immediately with the site or the account, and from backups at the latest 30 days later. Technical logs contain neither IP addresses nor the content of submissions and are erased by automatic rotation after a few days.

4. Instructions

The processor processes the data only on the controller’s documented instructions, given through the service settings (domains, Essential or Complete measurement mode, rewriting rules, retained parameters, sharing, reports). It informs the controller if an instruction appears to it to be contrary to the law.

The processor starts no measurement before the visitor’s valid consent and stops it after a refusal, a withdrawal or the expiry of the choice, with no fallback to another measurement; if the site’s configuration is unavailable, measurement is suspended.

5. Confidentiality

The persons authorised to access the data are bound by confidentiality. The processor does not use the data for its own purposes, does not sell it and does not cross-reference it between customers, apart from aggregated counts needed for operations (volumes, rejections).

6. Security measures

• visit data hosted, processed and backed up in Switzerland;
• server-side cleaning before storage (recognised personal data removed);
• encryption of data in transit (TLS) and of backups;
• server access by key only, firewall, database and statistics engine not exposed to the Internet;
• access rights limited to what is strictly necessary, hashed passwords, tokens stored as a fingerprint;
• log of sensitive actions; regular restoration tests of backups.

7. Sub-processors

The controller authorises the sub-processors published on the "Sub-processors" page. For visit data, this is solely Infomaniak Network SA (Switzerland), the hosting provider. Any addition or replacement is announced by email at least 30 days in advance; the controller may object by cancelling at no cost.

8. Transfers

Visit data does not leave Switzerland. Switzerland benefits from an adequacy decision of the European Commission.

9. Assistance

The processor helps the controller to respond to requests from data subjects and to meet its obligations (security, impact assessments), to the extent the data allows. In Essential mode, in principle, it does not make it possible to identify a visitor. In Complete mode, the log is pseudonymised: the visitor can withdraw their consent at any time via the badge, which stops measurement, erases the identifier in their browser and deletes the pseudonymised log data linked to them; the processor assists the controller with these withdrawals and with the corresponding erasure requests. Proof of the choice and of the withdrawal is kept separately and no longer feeds any measurement.

10. Personal data breach

The processor informs the controller as soon as possible, and at the latest 48 hours after becoming aware of it, of any data security breach that concerns the controller, with the information available and the measures taken.

11. End of the agreement

At the end of the agreement, the data is deleted in accordance with article 3; beforehand, the customer may export their statistics (PDF) and their account data.

12. Verification

On request, the processor makes available the information necessary to demonstrate compliance with this agreement (contact@alpistats.ch). On-site audits take place by appointment, at the requester’s expense, at most once a year unless there is an incident.

13. General provisions

In all other respects, the terms of service apply, in particular for liability, governing law and place of jurisdiction. In the event of a contradiction on data protection, this agreement prevails.