Parties and scope
This Data Processing Agreement (DPA) is between the customer using FluxTrace (Customer) and Ecorpin, at Patna, Bihar, India (Processor).
The Customer is the controller/Data Fiduciary. FluxTrace is the processor acting only on the Customer's documented instructions, including the service configuration selected by the Customer.
Subject matter and duration
The subject matter is product and web analytics processing. Processing begins when the Customer sends data to FluxTrace and continues for the term of the Customer's account and any applicable retention period.
The purpose is to ingest, store, analyse, display, export, and secure analytics data through the FluxTrace service.
Data subjects and data types
Data subjects may include visitors, users, prospects, customers, and Customer personnel. Personal data may include persistent localStorage visitor IDs, daily session identifiers, online identifiers, page paths, referrers, UTM parameters, city and country derived from IP, device and browser information, optional customer-provided identified user IDs and traits, and event properties selected by the Customer.
The Customer must not send sensitive personal data, credentials, payment-card data, or form-field contents unless the parties have separately agreed to appropriate safeguards.
Processor obligations
FluxTrace will process personal data only on documented instructions from the Customer, ensure personnel are bound by confidentiality duties, implement appropriate technical and organisational measures, and assist the Customer with data-subject requests, security assessments, and breach notifications where required by law.
FluxTrace will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data and will provide reasonably available information for the Customer's legal obligations.
Subprocessors and transfers
FluxTrace may use subprocessors described in the Privacy Policy to provide hosting, database, cache, email, billing, and export services. FluxTrace will impose written data-protection obligations on subprocessors that are appropriate to the processing they perform.
Data is stored and processed in India and Asia. Where a transfer is subject to additional legal requirements, the parties will cooperate in using the safeguards required by applicable law.
Deletion, return, and audits
On termination, FluxTrace will make Customer data available for export where the service supports it and delete data according to the Customer's plan retention window, unless applicable law requires longer retention. Customer remains responsible for deleting any data it exported or sent to third-party destinations.
On reasonable written request, and no more than once each year unless a material incident requires otherwise, FluxTrace will provide information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality and security safeguards.
Contact
For DPA questions or requests, contact fluxtrace@ecorpin.com.