Data Processing Agreement

Scope

This summary describes how open-telemetry.net processes personal data on behalf of customers (the controller). It forms the basis of the Data Processing Agreement (DPA) we sign on request, under Art. 28 UK GDPR and EU GDPR.

Subject matter and duration

Measurement of website visits, performance and ad delivery for the customer's own sites, for the duration of the service agreement and the configured retention period.

Categories of data

Page URL (without query string or fragment), referrer host, UTM campaign tags, country (derived from IP, IP not stored with events), browser and device class, screen width, language, performance timings and ad slot measurements.

Data subjects

Visitors to the customer's websites.

Our commitments

We process data only on documented instructions; ensure personnel confidentiality; implement the security measures below; assist with data subject requests and breach notification; delete or return all data at the end of the service; and make available the information needed to demonstrate compliance, including audits on reasonable notice.

Security measures

TLS in transit; encryption at rest; role-based access with an audit log; separation of customer data per site; EU and UK data regions; breach notification to customers without undue delay and within 48 hours of becoming aware.

Sub-processors

Cloudflare, Inc. (network, DNS and edge delivery); an infrastructure hosting provider located in the United Kingdom or European Union (compute and storage). We give customers 30 days' notice of any change.

Signing

To receive the full DPA for signature, write to [email protected] with your company name and the site IDs concerned. We return it within two working days.